Base image invoicerr's product image builds on: nginx:bookworm + Debian's chromium (PDF
rendering) + Node.js.
linux/amd64 and linux/arm64. Not linux/arm/v7: Node 24 ships no linux-armv7l build. A 32-bit
Pi needs a 64-bit OS to run the arm64 image.
:latest is what invoicerr's Dockerfile builds FROM. It moves on every release, on the weekly
rebuild and on a manual rebuild of the default branch. :<version> is pinned, published alongside
:latest on release. :scheduled-<YYYYMMDD> is the weekly rebuild's own pin. :<branch-name>
comes from a manual workflow_dispatch; on any branch other than the default it never touches
:latest.
Monday 03:00 UTC, so Debian/chromium security patches reach :latest without a release.
Every build (scheduled, release, manual) runs with no layer cache, so apt-get upgrade always
installs the current Debian packages. A cached apt layer would republish last week's packages under
a new tag.
Actions tab -> "Publish Docker Image to GitHub Container Registry" -> "Run workflow". On the
default branch this moves :latest; on any other branch it only publishes :<branch-name>.