CarlesDD · Oct 5, 2026 · Sep 29, 2026 · Sep 30, 2026 · Sep 30, 2026 · Sep 30, 2026
@@ -68,6 +68,7 @@ jobs:
             "utils/build/docker/python_lambda/runtime.base.Dockerfile" \
             "utils/build/docker/java_lambda/runtime.base.Dockerfile" \
             "utils/build/docker/ruby_lambda/runtime.base.Dockerfile" \
+            "utils/build/docker/nodejs_lambda/runtime.base.Dockerfile" \
             "utils/build/docker/base-images.lock.json" \
             "mirror_images.yaml" \
             "mirror_images.lock.yaml" \
@@ -129,7 +130,7 @@ jobs:
           else
             gh pr create \
               --title "Update pinned lambda extension version" \
-              --body "Automated update of the pinned public.ecr.aws/datadog/lambda-extension version used by the python_lambda, java_lambda, and ruby_lambda base images" \
+              --body "Automated update of the pinned public.ecr.aws/datadog/lambda-extension version used by the python_lambda, java_lambda, ruby_lambda, and nodejs_lambda base images" \
               --head "$BRANCH_NAME" \
               --base main
           fi

@@ -286,6 +286,10 @@ images:
     digest: sha256:128b7524cde00a739246166feef66b0d512388005dc125b0f11034555a8b6a70
     target: registry.ddbuild.io/system-tests/mirror/datadog/system-tests:nextjs.base-95582a903467
     tag: nextjs.base-95582a903467
+  datadog/system-tests:nodejs-lambda-runtime.base-f7f78c7298cf:
+    digest: sha256:6f2d40e78bc96937010874e2b7f23ef9effb5e087c0cdf674f9b1ca0bcb631a8
+    target: registry.ddbuild.io/system-tests/mirror/datadog/system-tests:nodejs-lambda-runtime.base-f7f78c7298cf
+    tag: nodejs-lambda-runtime.base-f7f78c7298cf
   datadog/system-tests:nodejs_buddy-v1:
     digest: sha256:71d124f74d4d7ac706f1afa8d5950864e1e931ec3b511f540b49eb6328c0338e
     target: registry.ddbuild.io/system-tests/mirror/datadog/system-tests:nodejs_buddy-v1

@@ -79,6 +79,7 @@
 - "datadog/system-tests:java_buddy-v1"
 - "datadog/system-tests:lambda-proxy-v1"
 - "datadog/system-tests:nextjs.base-95582a903467"
+- "datadog/system-tests:nodejs-lambda-runtime.base-f7f78c7298cf"
 - "datadog/system-tests:nodejs_buddy-v1"
 - "datadog/system-tests:openai-py.base-b4fd56aee3f2"
 - "datadog/system-tests:php-fpm-7.0.base-137961f277f1"

@@ -6,6 +6,7 @@
     "system_tests_base_nodejs_express4_typescript": "datadog/system-tests:express4-typescript.base-eb800c09d602",
     "system_tests_base_nodejs_express5": "datadog/system-tests:express5.base-6eecdb28aed2",
     "system_tests_base_nodejs_fastify": "datadog/system-tests:fastify.base-bce27c61b3f5",
+    "system_tests_base_nodejs_lambda_nodejs_lambda_runtime": "datadog/system-tests:nodejs-lambda-runtime.base-f7f78c7298cf",
     "system_tests_base_nodejs_nextjs": "datadog/system-tests:nextjs.base-95582a903467",
     "system_tests_base_php_apache_mod_7_0": "datadog/system-tests:apache-mod-7.0.base-d171f9d9cd49",
     "system_tests_base_php_apache_mod_7_0_zts": "datadog/system-tests:apache-mod-7.0-zts.base-c32a9f8fabfa",

@@ -0,0 +1,21 @@
+# Docker Buildx bake file for nodejs_lambda base images
+#
+# `context` is always this directory: base image Dockerfiles only COPY files from
+# here, so paths in the Dockerfile are relative to it (see build_base_images.py,
+# which derives base_image_dependencies from these COPY instructions).
+
+group "default" {
+  targets = [
+    "runtime",
+  ]
+}
+
+target "_common" {
+  context = "."
+}
+
+target "runtime" {
+  inherits   = ["_common"]
+  dockerfile = "runtime.base.Dockerfile"
+  tags       = ["datadog/system-tests:nodejs-lambda-runtime.base"]
+}
@@ -22,13 +22,12 @@ else
     esac
     echo "Detected Node.js major: ${NODE_MAJOR}, using layer runtime version: ${NODE_VERSION}"
 
-    LATEST_TAG=$(curl -fsSL -H "Accept: application/vnd.github.v3+json" \
-        https://api.github.com/repos/DataDog/datadog-lambda-js/releases/latest \
-        | grep '"tag_name"' | head -1 | sed 's/.*"tag_name": *"//;s/".*//')
-    echo "Latest release tag: ${LATEST_TAG}"
-
+    # Resolves directly to the latest release's asset (a github.com redirect), unlike
+    # api.github.com/.../releases/latest which needs a separate call to get the tag name
+    # first and hits that API's much lower unauthenticated rate limit (60/hour/IP).
+    # python_lambda and ruby_lambda's install scripts use the same shortcut.
     ZIP_NAME="datadog_lambda_node${NODE_VERSION}.zip"
-    DOWNLOAD_URL="https://github.com/DataDog/datadog-lambda-js/releases/download/${LATEST_TAG}/${ZIP_NAME}"
+    DOWNLOAD_URL="https://github.com/DataDog/datadog-lambda-js/releases/latest/download/${ZIP_NAME}"
     echo "Downloading ${DOWNLOAD_URL}"
     curl -fsSLO "${DOWNLOAD_URL}"
 

@@ -1,10 +1,4 @@
-FROM public.ecr.aws/lambda/nodejs:18
-
-RUN yum install -y unzip findutils socat && yum clean all
-
-# Add the Datadog Extension
-RUN mkdir -p /opt/extensions
-COPY --from=public.ecr.aws/datadog/lambda-extension:latest /opt/. /opt/
+FROM system_tests_base_nodejs_lambda_nodejs_lambda_runtime
 
 COPY utils/build/docker/nodejs_lambda/install_datadog_lambda.sh binaries* /binaries/
 RUN chmod +x /binaries/install_datadog_lambda.sh && /binaries/install_datadog_lambda.sh

@@ -1,10 +1,4 @@
-FROM public.ecr.aws/lambda/nodejs:18
-
-RUN yum install -y unzip findutils socat && yum clean all
-
-# Add the Datadog Extension
-RUN mkdir -p /opt/extensions
-COPY --from=public.ecr.aws/datadog/lambda-extension:latest /opt/. /opt/
+FROM system_tests_base_nodejs_lambda_nodejs_lambda_runtime
 
 COPY utils/build/docker/nodejs_lambda/install_datadog_lambda.sh binaries* /binaries/
 RUN chmod +x /binaries/install_datadog_lambda.sh && /binaries/install_datadog_lambda.sh

@@ -1,10 +1,4 @@
-FROM public.ecr.aws/lambda/nodejs:18
-
-RUN yum install -y unzip findutils socat && yum clean all
-
-# Add the Datadog Extension
-RUN mkdir -p /opt/extensions
-COPY --from=public.ecr.aws/datadog/lambda-extension:latest /opt/. /opt/
+FROM system_tests_base_nodejs_lambda_nodejs_lambda_runtime
 
 COPY utils/build/docker/nodejs_lambda/install_datadog_lambda.sh binaries* /binaries/
 RUN chmod +x /binaries/install_datadog_lambda.sh && /binaries/install_datadog_lambda.sh

@@ -1,10 +1,4 @@
-FROM public.ecr.aws/lambda/nodejs:18
-
-RUN yum install -y unzip findutils socat && yum clean all
-
-# Add the Datadog Extension
-RUN mkdir -p /opt/extensions
-COPY --from=public.ecr.aws/datadog/lambda-extension:latest /opt/. /opt/
+FROM system_tests_base_nodejs_lambda_nodejs_lambda_runtime
 
 COPY utils/build/docker/nodejs_lambda/install_datadog_lambda.sh binaries* /binaries/
 RUN chmod +x /binaries/install_datadog_lambda.sh && /binaries/install_datadog_lambda.sh

@@ -1,10 +1,4 @@
-FROM public.ecr.aws/lambda/nodejs:18
-
-RUN yum install -y unzip findutils socat && yum clean all
-
-# Add the Datadog Extension
-RUN mkdir -p /opt/extensions
-COPY --from=public.ecr.aws/datadog/lambda-extension:latest /opt/. /opt/
+FROM system_tests_base_nodejs_lambda_nodejs_lambda_runtime
 
 COPY utils/build/docker/nodejs_lambda/install_datadog_lambda.sh binaries* /binaries/
 RUN chmod +x /binaries/install_datadog_lambda.sh && /binaries/install_datadog_lambda.sh

@@ -0,0 +1,10 @@
+FROM public.ecr.aws/lambda/nodejs:18
+
+RUN yum install -y unzip findutils socat && yum clean all
+
+# Add the Datadog Extension
+# Pinned (not :latest): the base-image content hash only covers local build-context
+# files, so a floating tag would freeze silently on first build and never refresh.
+# Bump this manually to pick up newer extension releases.
+RUN mkdir -p /opt/extensions
+COPY --from=public.ecr.aws/datadog/lambda-extension:100 /opt/. /opt/
@@ -7,8 +7,8 @@
 The extension is pinned (not `:latest`) because the base-image content hash only
 covers local build-context files: a floating tag would freeze silently on the
 image's first build and never refresh (see utils/build/docker/python_lambda/runtime.base.Dockerfile,
-utils/build/docker/java_lambda/runtime.base.Dockerfile, and
-utils/build/docker/ruby_lambda/runtime.base.Dockerfile). This script keeps that pin current.
+utils/build/docker/java_lambda/runtime.base.Dockerfile, utils/build/docker/ruby_lambda/runtime.base.Dockerfile,
+and utils/build/docker/nodejs_lambda/runtime.base.Dockerfile). This script keeps that pin current.
 """
 
 import re
@@ -22,6 +22,7 @@
     REPO_ROOT / "utils" / "build" / "docker" / "python_lambda" / "runtime.base.Dockerfile",
     REPO_ROOT / "utils" / "build" / "docker" / "java_lambda" / "runtime.base.Dockerfile",
     REPO_ROOT / "utils" / "build" / "docker" / "ruby_lambda" / "runtime.base.Dockerfile",
+    REPO_ROOT / "utils" / "build" / "docker" / "nodejs_lambda" / "runtime.base.Dockerfile",
 ]
 
 REGISTRY = "public.ecr.aws"