[pull] main from onyx-dot-app:main

.github/actions/build-model-server-image/action.yml

@@ -28,11 +28,15 @@ inputs:
     description: "ECR registry host for the Docker Hub pull-through cache (the ECR_REGISTRY repo variable)"
     required: true
   docker-username:
-    description: "Docker Hub username (must have access to the DHI catalog on dhi.io)"
-    required: true
+    description: >-
+      Docker Hub username with DHI catalog access. Optional -- without it the image
+      builds on its public base defaults instead of the hardened ones.
+    required: false
+    default: ""
   docker-token:
     description: "Docker Hub token"
-    required: true
+    required: false
+    default: ""
 runs:
   using: "composite"
   steps:
@@ -59,14 +63,13 @@ runs:
       with:
         ecr-registry: ${{ inputs.ecr-registry }}
 
-    # Dockerfile.model_server pulls its hardened Python base from dhi.io, authenticated
-    # with the same Docker account credentials (the account must have DHI catalog access).
-    - name: Login to Docker Hardened Images (dhi.io)
-      uses: docker/login-action@c99871dec2022cc055c062a10cc1a1310835ceb4
+    # Dockerfile.model_server defaults to the public Python bases. CI builds ship on the
+    # hardened DHI equivalents, passed as build args below.
+    - name: Resolve Docker Hardened Image bases
+      uses: ./.github/actions/dhi-base-images
       with:
-        registry: dhi.io
-        username: ${{ inputs.docker-username }}
-        password: ${{ inputs.docker-token }}
+        docker-username: ${{ inputs.docker-username }}
+        docker-token: ${{ inputs.docker-token }}
 
     - name: Build and push Model Server Docker image
       uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # ratchet:docker/build-push-action@v6
@@ -77,6 +80,7 @@ runs:
         platforms: ${{ inputs.platforms }}
         build-args: |
           BASE_IMAGE_REGISTRY=${{ env.BASE_IMAGE_REGISTRY }}
+          ${{ env.DHI_PYTHON_BUILD_ARGS }}
         tags: ${{ inputs.runs-on-ecr-cache }}:${{ inputs.tag-prefix }}-${{ inputs.run-id }}
         cache-from: |
           type=registry,ref=${{ inputs.runs-on-ecr-cache }}:model-server-cache-${{ inputs.github-sha }}

.github/actions/dhi-base-images/action.yml

@@ -0,0 +1,56 @@
+name: "Docker Hardened Image bases"
+description: >-
+  Logs in to dhi.io and exports the build args that point web/Dockerfile and
+  backend/Dockerfile.model_server at the pinned Docker Hardened Images (DHI).
+  Both Dockerfiles default to public Docker Hub images, so without DHI credentials
+  (fork pull requests) this action exports nothing and the defaults apply.
+inputs:
+  docker-username:
+    description: "Docker Hub username (the account must have DHI catalog access)"
+    required: false
+    default: ""
+  docker-token:
+    description: "Docker Hub token"
+    required: false
+    default: ""
+runs:
+  using: "composite"
+  steps:
+    - name: Check for DHI credentials
+      id: creds
+      shell: bash
+      env:
+        DOCKER_USERNAME: ${{ inputs.docker-username }}
+        DOCKER_TOKEN: ${{ inputs.docker-token }}
+      run: |
+        if [ -n "${DOCKER_USERNAME}" ] && [ -n "${DOCKER_TOKEN}" ]; then
+          echo "available=true" >> "$GITHUB_OUTPUT"
+        else
+          echo "available=false" >> "$GITHUB_OUTPUT"
+          echo "No DHI credentials; the images build on their public base defaults."
+        fi
+
+    - name: Login to Docker Hardened Images (dhi.io)
+      if: steps.creds.outputs.available == 'true'
+      uses: docker/login-action@c99871dec2022cc055c062a10cc1a1310835ceb4
+      with:
+        registry: dhi.io
+        username: ${{ inputs.docker-username }}
+        password: ${{ inputs.docker-token }}
+
+    # Single source of truth for the DHI digests. Refresh one with:
+    # docker buildx imagetools inspect <image reference>
+    - name: Export DHI build args
+      if: steps.creds.outputs.available == 'true'
+      shell: bash
+      run: |
+        {
+          echo "DHI_NODE_BUILD_ARGS<<EOF"
+          echo "NODE_BUILDER_IMAGE=dhi.io/node:24-debian13-dev@sha256:25a83f18150669e9ce3c9437327add4d75ae4ea26cbdb5e8747b66d3b74a567a"
+          echo "NODE_RUNTIME_IMAGE=dhi.io/node:24-debian13@sha256:805278f24c1146c6d3c96577b6256f8f97c43196fff88315fe3291a1ce118ddd"
+          echo "EOF"
+          echo "DHI_PYTHON_BUILD_ARGS<<EOF"
+          echo "PYTHON_BUILDER_IMAGE=dhi.io/python:3.13-debian13-dev@sha256:7933d16e50454c39bca6e935027166d5e5b05c6c03383dc2f58e8fe6e2440b7d"
+          echo "PYTHON_RUNTIME_IMAGE=dhi.io/python:3.13-debian13@sha256:05827957dafc7b83633d56f24d9281525d3546a1d600eef90385c7212d3def5e"
+          echo "EOF"
+        } >> "$GITHUB_ENV"

.github/workflows/deployment.yml

@@ -535,14 +535,13 @@ jobs:
           username: ${{ env.DOCKER_USERNAME }}
           password: ${{ env.DOCKER_TOKEN }}
 
-      # web/Dockerfile pulls its hardened Node base from dhi.io, authenticated with the same
-      # Docker account credentials (the account must have access to the DHI catalog).
-      - name: Login to Docker Hardened Images (dhi.io)
-        uses: docker/login-action@c99871dec2022cc055c062a10cc1a1310835ceb4
+      # web/Dockerfile defaults to the public Node bases. Release builds ship on the
+      # hardened DHI equivalents, passed as build args below.
+      - name: Resolve Docker Hardened Image bases
+        uses: ./.github/actions/dhi-base-images
         with:
-          registry: dhi.io
-          username: ${{ env.DOCKER_USERNAME }}
-          password: ${{ env.DOCKER_TOKEN }}
+          docker-username: ${{ env.DOCKER_USERNAME }}
+          docker-token: ${{ env.DOCKER_TOKEN }}
 
       - name: Build and push AMD64
         id: build
@@ -554,6 +553,7 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           build-args: |
             ONYX_VERSION=${{ github.ref_name }}
+            ${{ env.DHI_NODE_BUILD_ARGS }}
             NODE_OPTIONS=--max-old-space-size=8192
           cache-from: |
             type=registry,ref=${{ env.REGISTRY_IMAGE }}:edge
@@ -617,14 +617,13 @@ jobs:
           username: ${{ env.DOCKER_USERNAME }}
           password: ${{ env.DOCKER_TOKEN }}
 
-      # web/Dockerfile pulls its hardened Node base from dhi.io, authenticated with the same
-      # Docker account credentials (the account must have access to the DHI catalog).
-      - name: Login to Docker Hardened Images (dhi.io)
-        uses: docker/login-action@c99871dec2022cc055c062a10cc1a1310835ceb4
+      # web/Dockerfile defaults to the public Node bases. Release builds ship on the
+      # hardened DHI equivalents, passed as build args below.
+      - name: Resolve Docker Hardened Image bases
+        uses: ./.github/actions/dhi-base-images
         with:
-          registry: dhi.io
-          username: ${{ env.DOCKER_USERNAME }}
-          password: ${{ env.DOCKER_TOKEN }}
+          docker-username: ${{ env.DOCKER_USERNAME }}
+          docker-token: ${{ env.DOCKER_TOKEN }}
 
       - name: Build and push ARM64
         id: build
@@ -636,6 +635,7 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           build-args: |
             ONYX_VERSION=${{ github.ref_name }}
+            ${{ env.DHI_NODE_BUILD_ARGS }}
             NODE_OPTIONS=--max-old-space-size=8192
           cache-from: |
             type=registry,ref=${{ env.REGISTRY_IMAGE }}:edge
@@ -791,14 +791,13 @@ jobs:
           username: ${{ env.DOCKER_USERNAME }}
           password: ${{ env.DOCKER_TOKEN }}
 
-      # web/Dockerfile pulls its hardened Node base from dhi.io, authenticated with the same
-      # Docker account credentials (the account must have access to the DHI catalog).
-      - name: Login to Docker Hardened Images (dhi.io)
-        uses: docker/login-action@c99871dec2022cc055c062a10cc1a1310835ceb4
+      # web/Dockerfile defaults to the public Node bases. Release builds ship on the
+      # hardened DHI equivalents, passed as build args below.
+      - name: Resolve Docker Hardened Image bases
+        uses: ./.github/actions/dhi-base-images
         with:
-          registry: dhi.io
-          username: ${{ env.DOCKER_USERNAME }}
-          password: ${{ env.DOCKER_TOKEN }}
+          docker-username: ${{ env.DOCKER_USERNAME }}
+          docker-token: ${{ env.DOCKER_TOKEN }}
 
       - name: Build and push AMD64
         id: build
@@ -810,6 +809,7 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           build-args: |
             ONYX_VERSION=${{ github.ref_name }}
+            ${{ env.DHI_NODE_BUILD_ARGS }}
             NEXT_PUBLIC_CLOUD_ENABLED=true
             WEB_FRAME_PROTECTION_ENABLED=false
             NEXT_PUBLIC_POSTHOG_KEY=${{ secrets.POSTHOG_KEY }}
@@ -884,14 +884,13 @@ jobs:
           username: ${{ env.DOCKER_USERNAME }}
           password: ${{ env.DOCKER_TOKEN }}
 
-      # web/Dockerfile pulls its hardened Node base from dhi.io, authenticated with the same
-      # Docker account credentials (the account must have access to the DHI catalog).
-      - name: Login to Docker Hardened Images (dhi.io)
-        uses: docker/login-action@c99871dec2022cc055c062a10cc1a1310835ceb4
+      # web/Dockerfile defaults to the public Node bases. Release builds ship on the
+      # hardened DHI equivalents, passed as build args below.
+      - name: Resolve Docker Hardened Image bases
+        uses: ./.github/actions/dhi-base-images
         with:
-          registry: dhi.io
-          username: ${{ env.DOCKER_USERNAME }}
-          password: ${{ env.DOCKER_TOKEN }}
+          docker-username: ${{ env.DOCKER_USERNAME }}
+          docker-token: ${{ env.DOCKER_TOKEN }}
 
       - name: Build and push ARM64
         id: build
@@ -903,6 +902,7 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           build-args: |
             ONYX_VERSION=${{ github.ref_name }}
+            ${{ env.DHI_NODE_BUILD_ARGS }}
             NEXT_PUBLIC_CLOUD_ENABLED=true
             WEB_FRAME_PROTECTION_ENABLED=false
             NEXT_PUBLIC_POSTHOG_KEY=${{ secrets.POSTHOG_KEY }}
@@ -1351,14 +1351,13 @@ jobs:
           username: ${{ env.DOCKER_USERNAME }}
           password: ${{ env.DOCKER_TOKEN }}
 
-      # Dockerfile.model_server pulls its hardened Python base from dhi.io, authenticated
-      # with the same Docker account credentials (the account must have DHI catalog access).
-      - name: Login to Docker Hardened Images (dhi.io)
-        uses: docker/login-action@c99871dec2022cc055c062a10cc1a1310835ceb4
+      # Dockerfile.model_server defaults to the public Python bases. Release builds ship
+      # on the hardened DHI equivalents, passed as build args below.
+      - name: Resolve Docker Hardened Image bases
+        uses: ./.github/actions/dhi-base-images
         with:
-          registry: dhi.io
-          username: ${{ env.DOCKER_USERNAME }}
-          password: ${{ env.DOCKER_TOKEN }}
+          docker-username: ${{ env.DOCKER_USERNAME }}
+          docker-token: ${{ env.DOCKER_TOKEN }}
 
       - name: Build and push AMD64
         id: build
@@ -1372,6 +1371,7 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           build-args: |
             ONYX_VERSION=${{ github.ref_name }}
+            ${{ env.DHI_PYTHON_BUILD_ARGS }}
           cache-from: |
             type=registry,ref=${{ env.REGISTRY_IMAGE }}:edge
             type=registry,ref=${{ env.REGISTRY_IMAGE }}:latest
@@ -1437,14 +1437,13 @@ jobs:
           username: ${{ env.DOCKER_USERNAME }}
           password: ${{ env.DOCKER_TOKEN }}
 
-      # Dockerfile.model_server pulls its hardened Python base from dhi.io, authenticated
-      # with the same Docker account credentials (the account must have DHI catalog access).
-      - name: Login to Docker Hardened Images (dhi.io)
-        uses: docker/login-action@c99871dec2022cc055c062a10cc1a1310835ceb4
+      # Dockerfile.model_server defaults to the public Python bases. Release builds ship
+      # on the hardened DHI equivalents, passed as build args below.
+      - name: Resolve Docker Hardened Image bases
+        uses: ./.github/actions/dhi-base-images
         with:
-          registry: dhi.io
-          username: ${{ env.DOCKER_USERNAME }}
-          password: ${{ env.DOCKER_TOKEN }}
+          docker-username: ${{ env.DOCKER_USERNAME }}
+          docker-token: ${{ env.DOCKER_TOKEN }}
 
       - name: Build and push ARM64
         id: build
@@ -1458,6 +1457,7 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           build-args: |
             ONYX_VERSION=${{ github.ref_name }}
+            ${{ env.DHI_PYTHON_BUILD_ARGS }}
           cache-from: |
             type=registry,ref=${{ env.REGISTRY_IMAGE }}:edge
             type=registry,ref=${{ env.REGISTRY_IMAGE }}:latest

.github/workflows/pr-playwright-tests.yml

@@ -120,6 +120,7 @@ jobs:
               - '.github/workflows/pr-playwright-tests.yml'
               - '.github/actions/setup-test-license/**'
               - '.github/actions/login-ecr-pullthrough-cache/**'
+              - '.github/actions/dhi-base-images/**'
             airgap:
               - 'backend/Dockerfile'
               - 'backend/Dockerfile.model_server'
@@ -147,6 +148,7 @@ jobs:
               - '.github/workflows/pr-playwright-tests.yml'
               - '.github/actions/build-model-server-image/**'
               - '.github/actions/login-ecr-pullthrough-cache/**'
+              - '.github/actions/dhi-base-images/**'
             mcp_oauth:
               - 'backend/onyx/server/features/mcp/**'
               - 'backend/tests/integration/mock_services/mcp_test_server/**'
@@ -196,14 +198,13 @@ jobs:
         with:
           ecr-registry: ${{ vars.ECR_REGISTRY }}
 
-      # web/Dockerfile pulls its hardened Node base from dhi.io, authenticated with the same
-      # Docker account credentials (the account must have access to the DHI catalog).
-      - name: Login to Docker Hardened Images (dhi.io)
-        uses: docker/login-action@c99871dec2022cc055c062a10cc1a1310835ceb4
+      # web/Dockerfile defaults to the public Node bases. CI builds ship on the hardened
+      # DHI equivalents, passed as build args below.
+      - name: Resolve Docker Hardened Image bases
+        uses: ./.github/actions/dhi-base-images
         with:
-          registry: dhi.io
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_TOKEN }}
+          docker-username: ${{ secrets.DOCKER_USERNAME }}
+          docker-token: ${{ secrets.DOCKER_TOKEN }}
 
       # SKIP_TYPE_CHECK cuts the build time of this image. Types are still checked
       # by the `typescript-check` prek hook in the Quality Checks PR workflow.
@@ -217,6 +218,7 @@ jobs:
           push: true
           build-args: |
             BASE_IMAGE_REGISTRY=${{ env.BASE_IMAGE_REGISTRY }}
+            ${{ env.DHI_NODE_BUILD_ARGS }}
             SKIP_TYPE_CHECK=1
           cache-from: |
             type=registry,ref=${{ env.RUNS_ON_ECR_CACHE }}:web-cache-${{ github.event.pull_request.head.sha || github.sha }}

CONTRIBUTING.md

@@ -306,16 +306,10 @@ If you want to make changes to Onyx and run those changes in Docker, you can als
 docker compose up -d --build
 ```
 
-> **Note:** Building the web image (`web/Dockerfile`) and the model-server image
-> (`backend/Dockerfile.model_server`) pulls their bases from Docker Hardened Images (`dhi.io`),
-> so you must authenticate first with a Docker account that has access to the DHI catalog:
->
-> ```bash
-> docker login dhi.io
-> ```
->
-> Pulling the pre-built `onyxdotapp/onyx-web-server` / `onyxdotapp/onyx-model-server` images
-> (the default `docker compose up -d` without `--build`) does not require this.
+> **Note:** Local builds use the public Docker Hub base images, so they need no extra
+> registry access. Our release builds override the base images with the Docker Hardened
+> Image (`dhi.io`) equivalents, so the published `onyxdotapp/onyx-web-server` and
+> `onyxdotapp/onyx-model-server` images differ from a local `--build` in their base layers.
 
 > **Note:** `docker-compose.yml`, `docker-compose.prod.yml` and
 > `docker-compose.prod-no-letsencrypt.yml` are generated from `docker-compose.template.yml`