fix(build): close remaining mutable image inputs

tests/unit/test_macos_container_util.py

@@ -146,6 +146,29 @@ resolver #2
             ],
         )
 
+    def test_pinned_local_image_ref_tags_and_verifies_exact_id(self):
+        image = "sha256:" + "a" * 64
+        completed = util.subprocess.CompletedProcess(
+            args=[], returncode=0, stdout="", stderr="",
+        )
+        with patch.object(util, "image_id", return_value=image) as inspect, \
+             patch.object(util.subprocess, "run", return_value=completed) as run:
+            pinned = util.pinned_local_image_ref("registry:5000/agent:latest")
+        self.assertEqual(
+            f"registry:5000/agent:sha256-{'a' * 64}",
+            pinned,
+        )
+        run.assert_called_once_with(
+            ["container", "image", "tag", image, pinned],
+            capture_output=True,
+            text=True,
+            check=False,
+        )
+        self.assertEqual(
+            [("registry:5000/agent:latest",), (pinned,)],
+            [call.args for call in inspect.call_args_list],
+        )
+
     def test_commit_container_execs_tar_and_builds_image(self):
         # stderr is bytes because subprocess.run uses stderr=PIPE without text=True
         completed = util.subprocess.CompletedProcess(

tests/unit/test_macos_nested_containers.py

@@ -107,12 +107,16 @@ class TestNestedContainersImage(unittest.TestCase):
         def build(image: str, context: str, *, dockerfile: str) -> None:
             calls.append((image, context, dockerfile))
             text = Path(dockerfile).read_text(encoding="utf-8")
-            self.assertIn("FROM agent:base", text)
+            self.assertIn("ARG DOCKER_CLI_BASE_IMAGE", text)
+            self.assertIn("FROM ${DOCKER_CLI_BASE_IMAGE} AS docker_cli", text)
+            self.assertIn("FROM agent:sha256-deadbeef", text)
             self.assertIn("aardvark-dns fuse-overlayfs netavark nftables passt podman", text)
             self.assertIn("USER node", text)
             self.assertTrue((Path(context) / "nested-containers-init.sh").is_file())
 
-        image = nested_containers.build_image("agent:base", build)
+        image = nested_containers.build_image(
+            "agent:base", build, lambda _ref: "agent:sha256-deadbeef",
+        )
         self.assertEqual("agent:base-nested-containers", image)
         self.assertEqual("agent:base-nested-containers", calls[0][0])
 
@@ -127,7 +131,9 @@ class TestNestedContainersImage(unittest.TestCase):
         def build(_image: str, _context: str, *, dockerfile: str) -> None:
             seen.append(Path(dockerfile).read_text(encoding="utf-8"))
 
-        nested_containers.build_image("agent:base", build)
+        nested_containers.build_image(
+            "agent:base", build, lambda _ref: "agent:sha256-deadbeef",
+        )
         for package in ("podman", "passt", "nftables", "aardvark-dns"):
             self.assertIn(package, seen[0])
 
@@ -143,7 +149,9 @@ class TestNestedContainersImage(unittest.TestCase):
         def build(_image: str, _context: str, *, dockerfile: str) -> None:
             seen.append(Path(dockerfile).read_text(encoding="utf-8"))
 
-        nested_containers.build_image("agent:base", build)
+        nested_containers.build_image(
+            "agent:base", build, lambda _ref: "agent:sha256-deadbeef",
+        )
         text = seen[0]
         self.assertIn("sed -i '/^node:/d' /etc/subuid /etc/subgid", text)
         self.assertNotIn("subuid", text.replace(
@@ -286,7 +294,9 @@ class TestBuildOrLoadImages(unittest.TestCase):
             "agent:base", str(launch_mod.resources.build_root()),
             dockerfile="/repo/Dockerfile",
         )
-        derived.assert_called_once_with("agent:base", build)
+        derived.assert_called_once_with(
+            "agent:base", build, launch_mod.container_mod.pinned_local_image_ref,
+        )
         self.assertEqual("agent:base-nested-containers", images.agent)
 
     def test_derived_image_layers_onto_a_committed_image(self) -> None:
@@ -307,7 +317,11 @@ class TestBuildOrLoadImages(unittest.TestCase):
             images = launch_mod.build_or_load_images(plan)
 
         build.assert_not_called()
-        derived.assert_called_once_with("agent:committed", build)
+        derived.assert_called_once_with(
+            "agent:committed",
+            build,
+            launch_mod.container_mod.pinned_local_image_ref,
+        )
         self.assertEqual("agent:committed-nested-containers", images.agent)
 
     def test_cached_policy_refuses_to_build_the_derived_image(self) -> None:

tests/unit/test_resources.py

@@ -50,6 +50,21 @@ class TestCheckoutMode(unittest.TestCase):
             r"^python:\d+\.\d+\.\d+-.+@sha256:[0-9a-f]{64}$",
         )
 
+    def test_generated_dockerfile_uses_central_input_from_build_root(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            dockerfile = Path(tmp) / "Dockerfile"
+            dockerfile.write_text(
+                "ARG DOCKER_CLI_BASE_IMAGE\n"
+                "FROM ${DOCKER_CLI_BASE_IMAGE}\n",
+                encoding="utf-8",
+            )
+            args = resources.image_build_args(dockerfile, context=tmp)
+        self.assertEqual({"DOCKER_CLI_BASE_IMAGE"}, set(args))
+        self.assertRegex(
+            args["DOCKER_CLI_BASE_IMAGE"],
+            r"^docker:\d+-cli@sha256:[0-9a-f]{64}$",
+        )
+
     def test_bundled_resources_all_exist_at_root(self):
         # Drift guard: every path setup.py bundles must exist in the checkout.
         root = resources.build_root()