diff --git a/.github/workflows/sharevb-ci.yml b/.github/workflows/sharevb-ci.yml
index 7bd6246297..1cd9a8abb4 100644
--- a/.github/workflows/sharevb-ci.yml
+++ b/.github/workflows/sharevb-ci.yml
@@ -11,14 +11,14 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - run: |
           echo "Before: corepack version => $(corepack --version || echo 'not installed')"
           npm install -g corepack@latest
           echo "After : corepack version => $(corepack --version)"
           corepack enable
           pnpm --version
-      - uses: actions/setup-node@v6.4.0
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 24
           cache: 'pnpm'
diff --git a/.github/workflows/sharevb-codeql-analysis.yml b/.github/workflows/sharevb-codeql-analysis.yml
index fbd16877c5..398b4d7b0f 100644
--- a/.github/workflows/sharevb-codeql-analysis.yml
+++ b/.github/workflows/sharevb-codeql-analysis.yml
@@ -37,11 +37,11 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v7.0.0
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v4.36.3
+      uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -55,7 +55,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v4.36.3
+      uses: github/codeql-action/autobuild@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -69,4 +69,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v4.36.3
+      uses: github/codeql-action/analyze@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
diff --git a/.github/workflows/sharevb-docker-nightly-release.yml b/.github/workflows/sharevb-docker-nightly-release.yml
index c1a6471a5a..172b7b9722 100644
--- a/.github/workflows/sharevb-docker-nightly-release.yml
+++ b/.github/workflows/sharevb-docker-nightly-release.yml
@@ -15,7 +15,7 @@ jobs:
     outputs:
       should_run: ${{ steps.should_run.outputs.should_run }}
     steps:
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: print latest_commit
         run: echo ${{ github.sha }}
 
@@ -31,14 +31,14 @@ jobs:
     if: ${{ needs.check_date.outputs.should_run != 'false' }}
 
     steps:
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - run: |
           echo "Before: corepack version => $(corepack --version || echo 'not installed')"
           npm install -g corepack@latest
           echo "After : corepack version => $(corepack --version)"
           corepack enable
           pnpm --version
-      - uses: actions/setup-node@v6.4.0
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 24
           cache: 'pnpm'
@@ -63,7 +63,7 @@ jobs:
     steps:
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@v6.2.0
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           images: sharevb/it-tools
           labels: |
@@ -71,29 +71,29 @@ jobs:
 
       # Checkout the repository
       - name: Checkout repository
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v4.4.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v4.4.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4.2.0
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4.2.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Build and push
-        uses: docker/build-push-action@v7.3.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           file: ./Dockerfile
@@ -116,7 +116,7 @@ jobs:
         run: echo "RELEASE_VERSION=nightly" >> $GITHUB_ENV
 
       - name: Checkout
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - run: |
           echo "Before: corepack version => $(corepack --version || echo 'not installed')"
@@ -125,7 +125,7 @@ jobs:
           corepack enable
           pnpm --version
 
-      - uses: actions/setup-node@v6.4.0
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 24
           cache: 'pnpm'
@@ -148,7 +148,7 @@ jobs:
           echo "$EOF" >> $GITHUB_OUTPUT
 
       - name: Create Release
-        uses: softprops/action-gh-release@v3.0.1
+        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           files: it-tools-${{ env.RELEASE_VERSION }}.zip
diff --git a/.github/workflows/sharevb-docker-realease-baseurl-it-tools.yml b/.github/workflows/sharevb-docker-realease-baseurl-it-tools.yml
index 3401913d79..762a2749ca 100644
--- a/.github/workflows/sharevb-docker-realease-baseurl-it-tools.yml
+++ b/.github/workflows/sharevb-docker-realease-baseurl-it-tools.yml
@@ -13,14 +13,14 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - run: |
           echo "Before: corepack version => $(corepack --version || echo 'not installed')"
           npm install -g corepack@latest
           echo "After : corepack version => $(corepack --version)"
           corepack enable
           pnpm --version
-      - uses: actions/setup-node@v6.4.0
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 24
           cache: 'pnpm'
@@ -44,7 +44,7 @@ jobs:
     steps:
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@v6.2.0
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           images: sharevb/it-tools
           labels: |
@@ -52,29 +52,29 @@ jobs:
 
       # Checkout the repository
       - name: Checkout repository
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v4.4.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v4.4.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4.2.0
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4.2.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Build and push (BASE_URL)
-        uses: docker/build-push-action@v7.3.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           file: ./Dockerfile
diff --git a/.github/workflows/sharevb-docker-realease-latest.yml b/.github/workflows/sharevb-docker-realease-latest.yml
index ce2bf0b97e..d5dde36a07 100644
--- a/.github/workflows/sharevb-docker-realease-latest.yml
+++ b/.github/workflows/sharevb-docker-realease-latest.yml
@@ -13,14 +13,14 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - run: |
           echo "Before: corepack version => $(corepack --version || echo 'not installed')"
           npm install -g corepack@latest
           echo "After : corepack version => $(corepack --version)"
           corepack enable
           pnpm --version
-      - uses: actions/setup-node@v6.4.0
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 24
           cache: 'pnpm'
@@ -47,7 +47,7 @@ jobs:
     steps:
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@v6.2.0
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           images: sharevb/it-tools
           labels: |
@@ -55,29 +55,29 @@ jobs:
 
       # Checkout the repository
       - name: Checkout repository
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v4.4.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v4.4.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4.2.0
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4.2.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Build and push
-        uses: docker/build-push-action@v7.3.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           file: ./Dockerfile
diff --git a/.github/workflows/sharevb-e2e-tests.yml b/.github/workflows/sharevb-e2e-tests.yml
index 399aace2e1..157f4a995d 100644
--- a/.github/workflows/sharevb-e2e-tests.yml
+++ b/.github/workflows/sharevb-e2e-tests.yml
@@ -12,7 +12,7 @@ jobs:
       matrix:
         shard: [1/3, 2/3, 3/3]
     steps:
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - run: |
           echo "Before: corepack version => $(corepack --version || echo 'not installed')"
@@ -21,7 +21,7 @@ jobs:
           corepack enable
           pnpm --version
 
-      - uses: actions/setup-node@v6.4.0
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 24
           cache: 'pnpm'
@@ -37,7 +37,7 @@ jobs:
         run: pnpm build
 
       - name: Restore Playwright browsers from cache
-        uses: actions/cache@v6.1.0
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.cache/ms-playwright
           key: ${{ runner.os }}-playwright-${{ steps.playwright-version.outputs.PLAYWRIGHT_VERSION }}-${{ hashFiles('**/playwright.config.ts') }}
diff --git a/.github/workflows/sharevb-github-pages-publish.yml b/.github/workflows/sharevb-github-pages-publish.yml
index 2a85c0a619..42c62741da 100644
--- a/.github/workflows/sharevb-github-pages-publish.yml
+++ b/.github/workflows/sharevb-github-pages-publish.yml
@@ -32,14 +32,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Install Node.js
-        uses: actions/setup-node@v6.4.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 24
 
-      - uses: pnpm/action-setup@v6.0.9
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
         name: Install pnpm
         id: pnpm-install
         with:
@@ -50,13 +50,13 @@ jobs:
           BASE_URL="/it-tools/" pnpm build
           cp dist/index.html dist/404.html
       - name: Setup Pages
-        uses: actions/configure-pages@v6.0.0
+        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
 
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v5.0.0
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
           path: './dist'
 
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v5.0.0
\ No newline at end of file
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
\ No newline at end of file
diff --git a/.github/workflows/sharevb-releases.yml b/.github/workflows/sharevb-releases.yml
index a35c67febf..a3e5852f09 100644
--- a/.github/workflows/sharevb-releases.yml
+++ b/.github/workflows/sharevb-releases.yml
@@ -14,7 +14,7 @@ jobs:
     steps:
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@v6.2.0
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           images: sharevb/it-tools
 
@@ -22,29 +22,29 @@ jobs:
         run: echo "RELEASE_VERSION=${GITHUB_REF#refs/tags/v}" >> $GITHUB_ENV
 
       - name: Checkout
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v4.4.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v4.4.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4.2.0
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4.2.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Build and push (BASE_URL)
-        uses: docker/build-push-action@v7.3.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           file: ./Dockerfile
@@ -62,7 +62,7 @@ jobs:
             ghcr.io/sharevb/it-tools:${{ env.RELEASE_VERSION}}-baseurl-it-tools
 
       - name: Build and push
-        uses: docker/build-push-action@v7.3.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           file: ./Dockerfile
@@ -85,7 +85,7 @@ jobs:
         run: echo "RELEASE_VERSION=${GITHUB_REF#refs/tags/v}" >> $GITHUB_ENV
 
       - name: Checkout
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - run: |
           echo "Before: corepack version => $(corepack --version || echo 'not installed')"
@@ -94,7 +94,7 @@ jobs:
           corepack enable
           pnpm --version
 
-      - uses: actions/setup-node@v6.4.0
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 24
           cache: 'pnpm'
@@ -117,7 +117,7 @@ jobs:
           echo "$EOF" >> $GITHUB_OUTPUT
 
       - name: Create Release
-        uses: softprops/action-gh-release@v3.0.1
+        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           files: it-tools-${{ env.RELEASE_VERSION }}.zip
diff --git a/.github/workflows/sharevb-vercel-preview.yml b/.github/workflows/sharevb-vercel-preview.yml
index 07a8f7ebb2..7e1238713e 100644
--- a/.github/workflows/sharevb-vercel-preview.yml
+++ b/.github/workflows/sharevb-vercel-preview.yml
@@ -13,7 +13,7 @@ jobs:
   Deploy-Preview:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
       - name: Install Vercel CLI
         run: npm install --global vercel@latest
       - name: Pull Vercel Environment Information
diff --git a/.github/workflows/sharevb-vercel-prod.yml b/.github/workflows/sharevb-vercel-prod.yml
index 0b54735894..3407584796 100644
--- a/.github/workflows/sharevb-vercel-prod.yml
+++ b/.github/workflows/sharevb-vercel-prod.yml
@@ -13,7 +13,7 @@ jobs:
   Deploy-Production:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
       - name: Install Vercel CLI
         run: npm install --global vercel@latest
       - name: Pull Vercel Environment Information
diff --git a/Dockerfile b/Dockerfile
index 63d1d84323..380d17ab7f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
 # build stage
-FROM --platform=$BUILDPLATFORM node:24-alpine AS build-stage
+FROM --platform=$BUILDPLATFORM node:24-alpine@sha256:d32cdf619f63fe0471182d08996dd516c6275bb5fd31ae06e55a570bd9e1ad43 AS build-stage
 # Set environment variables for non-interactive npm installs
 ENV NPM_CONFIG_LOGLEVEL=warn
 ENV CI=true
@@ -21,7 +21,7 @@ ENV VITE_VERCEL_ENV=production
 RUN pnpm build
 
 # production stage
-FROM nginxinc/nginx-unprivileged:stable-alpine AS production-stage
+FROM nginxinc/nginx-unprivileged:stable-alpine@sha256:44e36330f74d4f3a1d4e222acca9e23b401fb87811a7597024502bb759c4dd49 AS production-stage
 
 LABEL maintainer="ShareVB <sharevb@gmail.com>" \
       org.opencontainers.image.authors="ShareVB <sharevb@gmail.com>"
diff --git a/docker-compose.yml b/docker-compose.yml
index 56caf7afc3..30c427c734 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,7 +1,7 @@
 services:
   it-tools:
     container_name: it-tools
-    image: sharevb/it-tools:latest
+    image: sharevb/it-tools:latest@sha256:d08fa3dece36b1eb54de1a6b8433a8380b75a00a7ed47d5082e9974df53bb06d
     pull_policy: always
     restart: unless-stopped
     ports:
diff --git a/docker-subfolder-sample/docker-compose.yml b/docker-subfolder-sample/docker-compose.yml
index 6c181e55cc..ea3ed22b14 100644
--- a/docker-subfolder-sample/docker-compose.yml
+++ b/docker-subfolder-sample/docker-compose.yml
@@ -1,11 +1,11 @@
 services:
   it-tools:
     container_name: it-tools-subfolder
-    image: ghcr.io/sharevb/it-tools:baseurl-it-tools
+    image: ghcr.io/sharevb/it-tools:baseurl-it-tools@sha256:794b1d22f04bf597e6d9c41914a4dbd8bc3a60862e323329e84932bc7864b2b5
     pull_policy: always
     restart: unless-stopped
   nginx-reverse-proxy:
-    image: nginx:alpine
+    image: nginx:alpine@sha256:4a73073bd557c65b759505da037898b61f1be6cbcc3c2c3aeac22d2a470c1752
     depends_on:
       - it-tools
     volumes:
diff --git a/docker-tools-filter-and-home-content/docker-compose.yml b/docker-tools-filter-and-home-content/docker-compose.yml
index 00ade135ce..bfa2bcaafa 100644
--- a/docker-tools-filter-and-home-content/docker-compose.yml
+++ b/docker-tools-filter-and-home-content/docker-compose.yml
@@ -1,6 +1,6 @@
 services:
   it-tools:
-    image: sharevb/it-tools:latest
+    image: sharevb/it-tools:latest@sha256:d08fa3dece36b1eb54de1a6b8433a8380b75a00a7ed47d5082e9974df53bb06d
     pull_policy: always
     restart: unless-stopped
     volumes:
diff --git a/docker-with-services/docker-compose.yml b/docker-with-services/docker-compose.yml
index 8a510ed129..fb0afa9a92 100644
--- a/docker-with-services/docker-compose.yml
+++ b/docker-with-services/docker-compose.yml
@@ -1,6 +1,6 @@
 services:
   it-tools:
-    image: sharevb/it-tools:latest
+    image: sharevb/it-tools:latest@sha256:d08fa3dece36b1eb54de1a6b8433a8380b75a00a7ed47d5082e9974df53bb06d
     pull_policy: always
     restart: unless-stopped
     environment:
@@ -10,7 +10,7 @@ services:
     ports:
       - 8080:8080
   docker-image-download-server:
-    image: sharevb/docker-image-download-server:latest
+    image: sharevb/docker-image-download-server:latest@sha256:d1a5ffa5041c2b248c02e25b799818bbeca4a55fced1b9db1ccdc9fa4045793a
     pull_policy: always
     restart: unless-stopped
     environment:
@@ -20,13 +20,13 @@ services:
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
   ws-tcp-udp-bridge:
-    image: sharevb/ws-tcp-udp-bridge:latest
+    image: sharevb/ws-tcp-udp-bridge:latest@sha256:2992e0c5682c4059f8863cf5dd95507db95ccd28745a7a5516f03bca39567816
     pull_policy: always
     restart: unless-stopped
     ports:
       - 8002:8080
   network-utils-ws:
-    image: sharevb/network-utils-ws:latest
+    image: sharevb/network-utils-ws:latest@sha256:0d03a2e4735942cf8134277848d30c286756befe60a67c56bf7a47092ccfe80f
     pull_policy: always
     restart: unless-stopped
     environment:
@@ -34,7 +34,7 @@ services:
     ports:
       - 8003:8000
   puppeteer-htmltopdf:
-    image: sharevb/puppeteer-htmltopdf:latest
+    image: sharevb/puppeteer-htmltopdf:latest@sha256:e5b3884c59a4e0f8d0f19d2b45f6f9eed10e5718a6009b304897d549ab44072a
     pull_policy: always
     restart: unless-stopped
     environment:
@@ -42,7 +42,7 @@ services:
     ports:
       - 8004:3000
   cors-anywhere:
-    image: sharevb/cors-anywhere:latest
+    image: sharevb/cors-anywhere:latest@sha256:8660dd3ce5c9dce8d365d37bc5e723e0ddb749643138b36b72a2798d853c3474
     pull_policy: always
     restart: unless-stopped
     environment:
diff --git a/package.json b/package.json
index 8672ee68ec..a60cd61754 100644
--- a/package.json
+++ b/package.json
@@ -406,11 +406,11 @@
     "yaml": "^2.9.0"
   },
   "devDependencies": {
-    "@iconify-json/mdi": "^1.2.3",
-    "@iconify-json/tabler": "^1.2.35",
-    "@intlify/unplugin-vue-i18n": "^11.2.4",
-    "@playwright/test": "^1.62.0",
-    "@tsconfig/node24": "^24.0.4",
+    "@iconify-json/mdi": "1.2.3",
+    "@iconify-json/tabler": "1.2.35",
+    "@intlify/unplugin-vue-i18n": "11.2.4",
+    "@playwright/test": "1.62.0",
+    "@tsconfig/node24": "24.0.4",
     "@types/arr-diff": "^4.0.3",
     "@types/bcryptjs": "^3.0.0",
     "@types/big.js": "^7.0.0",
@@ -448,41 +448,41 @@
     "@types/ua-parser-js": "^0.7.39",
     "@types/unist": "^3.0.3",
     "@types/utf8": "^3.0.3",
-    "@types/uuid": "^11.0.0",
-    "@vitejs/plugin-vue": "^6.0.7",
-    "@vitejs/plugin-vue-jsx": "^5.1.6",
-    "@vue/compiler-sfc": "^3.5.39",
-    "@vue/runtime-dom": "^3.5.39",
-    "@vue/test-utils": "^2.4.11",
-    "@vue/tsconfig": "^0.9.1",
-    "axios": "^1.18.1",
-    "commander": "^15.0.0",
-    "consola": "^3.4.2",
-    "dotenv": "^17.4.2",
-    "fast-glob": "^3.3.3",
-    "hygen": "^6.2.11",
-    "jsdom": "^29.1.1",
-    "less": "^4.6.7",
-    "oxfmt": "^0.57.0",
-    "oxlint": "^1.72.0",
-    "rollup-plugin-visualizer": "^7.0.1",
-    "semver": "^7.8.5",
-    "typescript": "~6.0.3",
-    "unocss": "^66.7.4",
-    "unocss-preset-scrollbar": "^4.0.0",
-    "unplugin-icons": "^23.0.1",
-    "unplugin-vue-components": "^32.1.0",
-    "unplugin-vue-markdown": "^32.0.0",
-    "vite": "^8.1.3",
-    "vite-plugin-node-polyfills": "^0.28.0",
-    "vite-plugin-pwa": "^1.3.0",
-    "vite-plugin-wasm": "^3.6.0",
-    "vite-svg-loader": "^5.1.1",
-    "vitest": "^4.1.9",
-    "vue-i18n-extract": "^2.0.7",
-    "workbox-build": "^7.4.1",
-    "workbox-window": "^7.4.1",
-    "zx": "^8.8.5"
+    "@types/uuid": "11.0.0",
+    "@vitejs/plugin-vue": "6.0.7",
+    "@vitejs/plugin-vue-jsx": "5.1.6",
+    "@vue/compiler-sfc": "3.5.39",
+    "@vue/runtime-dom": "3.5.39",
+    "@vue/test-utils": "2.4.11",
+    "@vue/tsconfig": "0.9.1",
+    "axios": "1.18.1",
+    "commander": "15.0.0",
+    "consola": "3.4.2",
+    "dotenv": "17.4.2",
+    "fast-glob": "3.3.3",
+    "hygen": "6.2.11",
+    "jsdom": "29.1.1",
+    "less": "4.6.7",
+    "oxfmt": "0.57.0",
+    "oxlint": "1.72.0",
+    "rollup-plugin-visualizer": "7.0.1",
+    "semver": "7.8.5",
+    "typescript": "6.0.3",
+    "unocss": "66.7.4",
+    "unocss-preset-scrollbar": "4.0.0",
+    "unplugin-icons": "23.0.1",
+    "unplugin-vue-components": "32.1.0",
+    "unplugin-vue-markdown": "32.0.0",
+    "vite": "8.1.3",
+    "vite-plugin-node-polyfills": "0.28.0",
+    "vite-plugin-pwa": "1.3.0",
+    "vite-plugin-wasm": "3.6.0",
+    "vite-svg-loader": "5.1.1",
+    "vitest": "4.1.9",
+    "vue-i18n-extract": "2.0.7",
+    "workbox-build": "7.4.1",
+    "workbox-window": "7.4.1",
+    "zx": "8.8.5"
   },
   "packageManager": "pnpm@11.11.0+sha512.4463f65fd80ed80d69bc1d4bf163ee94f605c7380fc318bb5b2ebe15f8cd12d49c51a4d59e951b401e764d3b6ca751cbf51bc50ed7001a6bcb4935e684c34882",
   "scarfSettings": {
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 21f69f31e7..9517f03485 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -1103,19 +1103,19 @@ importers:
         version: 2.9.0
     devDependencies:
       '@iconify-json/mdi':
-        specifier: ^1.2.3
+        specifier: 1.2.3
         version: 1.2.3
       '@iconify-json/tabler':
-        specifier: ^1.2.35
+        specifier: 1.2.35
         version: 1.2.35
       '@intlify/unplugin-vue-i18n':
-        specifier: ^11.2.4
+        specifier: 11.2.4
         version: 11.2.4(@vue/compiler-dom@3.5.39)(eslint@10.6.0(jiti@2.7.0))(rollup@4.62.2)(typescript@6.0.3)(vite@8.1.3(@types/node@24.13.3)(jiti@2.7.0)(less@4.6.7)(terser@5.48.0)(yaml@2.9.0))(vue-i18n@11.4.6(vue@3.5.39(typescript@6.0.3)))(vue@3.5.39(typescript@6.0.3))
       '@playwright/test':
-        specifier: ^1.62.0
+        specifier: 1.62.0
         version: 1.62.0
       '@tsconfig/node24':
-        specifier: ^24.0.4
+        specifier: 24.0.4
         version: 24.0.4
       '@types/arr-diff':
         specifier: ^4.0.3
@@ -1229,109 +1229,109 @@ importers:
         specifier: ^3.0.3
         version: 3.0.3
       '@types/uuid':
-        specifier: ^11.0.0
+        specifier: 11.0.0
         version: 11.0.0
       '@vitejs/plugin-vue':
-        specifier: ^6.0.7
+        specifier: 6.0.7
         version: 6.0.7(vite@8.1.3(@types/node@24.13.3)(jiti@2.7.0)(less@4.6.7)(terser@5.48.0)(yaml@2.9.0))(vue@3.5.39(typescript@6.0.3))
       '@vitejs/plugin-vue-jsx':
-        specifier: ^5.1.6
+        specifier: 5.1.6
         version: 5.1.6(vite@8.1.3(@types/node@24.13.3)(jiti@2.7.0)(less@4.6.7)(terser@5.48.0)(yaml@2.9.0))(vue@3.5.39(typescript@6.0.3))
       '@vue/compiler-sfc':
-        specifier: ^3.5.39
+        specifier: 3.5.39
         version: 3.5.39
       '@vue/runtime-dom':
-        specifier: ^3.5.39
+        specifier: 3.5.39
         version: 3.5.39
       '@vue/test-utils':
-        specifier: ^2.4.11
+        specifier: 2.4.11
         version: 2.4.11(@vue/compiler-dom@3.5.39)(@vue/server-renderer@3.5.39(vue@3.5.39(typescript@6.0.3)))(vue@3.5.39(typescript@6.0.3))
       '@vue/tsconfig':
-        specifier: ^0.9.1
+        specifier: 0.9.1
         version: 0.9.1(typescript@6.0.3)(vue@3.5.39(typescript@6.0.3))
       axios:
-        specifier: ^1.18.1
+        specifier: 1.18.1
         version: 1.18.1
       commander:
-        specifier: ^15.0.0
+        specifier: 15.0.0
         version: 15.0.0
       consola:
-        specifier: ^3.4.2
+        specifier: 3.4.2
         version: 3.4.2
       dotenv:
-        specifier: ^17.4.2
+        specifier: 17.4.2
         version: 17.4.2
       fast-glob:
-        specifier: ^3.3.3
+        specifier: 3.3.3
         version: 3.3.3
       hygen:
-        specifier: ^6.2.11
+        specifier: 6.2.11
         version: 6.2.11
       jsdom:
-        specifier: ^29.1.1
+        specifier: 29.1.1
         version: 29.1.1
       less:
-        specifier: ^4.6.7
+        specifier: 4.6.7
         version: 4.6.7
       oxfmt:
-        specifier: ^0.57.0
+        specifier: 0.57.0
         version: 0.57.0(svelte@5.56.4(@typescript-eslint/types@8.62.1))
       oxlint:
-        specifier: ^1.72.0
+        specifier: 1.72.0
         version: 1.72.0
       rollup-plugin-visualizer:
-        specifier: ^7.0.1
+        specifier: 7.0.1
         version: 7.0.1(rolldown@1.1.4)(rollup@4.62.2)
       semver:
-        specifier: ^7.8.5
+        specifier: 7.8.5
         version: 7.8.5
       typescript:
-        specifier: ~6.0.3
+        specifier: 6.0.3
         version: 6.0.3
       unocss:
-        specifier: ^66.7.4
+        specifier: 66.7.4
         version: 66.7.4(vite@8.1.3(@types/node@24.13.3)(jiti@2.7.0)(less@4.6.7)(terser@5.48.0)(yaml@2.9.0))
       unocss-preset-scrollbar:
-        specifier: ^4.0.0
+        specifier: 4.0.0
         version: 4.0.0(unocss@66.7.4(vite@8.1.3(@types/node@24.13.3)(jiti@2.7.0)(less@4.6.7)(terser@5.48.0)(yaml@2.9.0)))
       unplugin-icons:
-        specifier: ^23.0.1
+        specifier: 23.0.1
         version: 23.0.1(@vue/compiler-sfc@3.5.39)(svelte@5.56.4(@typescript-eslint/types@8.62.1))
       unplugin-vue-components:
-        specifier: ^32.1.0
+        specifier: 32.1.0
         version: 32.1.0(rolldown@1.1.4)(rollup@4.62.2)(vite@8.1.3(@types/node@24.13.3)(jiti@2.7.0)(less@4.6.7)(terser@5.48.0)(yaml@2.9.0))(vue@3.5.39(typescript@6.0.3))(webpack@5.108.3(postcss@8.5.16))
       unplugin-vue-markdown:
-        specifier: ^32.0.0
+        specifier: 32.0.0
         version: 32.0.0(rolldown@1.1.4)(rollup@4.62.2)(vite@8.1.3(@types/node@24.13.3)(jiti@2.7.0)(less@4.6.7)(terser@5.48.0)(yaml@2.9.0))(webpack@5.108.3(postcss@8.5.16))
       vite:
-        specifier: ^8.1.3
+        specifier: 8.1.3
         version: 8.1.3(@types/node@24.13.3)(jiti@2.7.0)(less@4.6.7)(terser@5.48.0)(yaml@2.9.0)
       vite-plugin-node-polyfills:
-        specifier: ^0.28.0
+        specifier: 0.28.0
         version: 0.28.0(rollup@4.62.2)(vite@8.1.3(@types/node@24.13.3)(jiti@2.7.0)(less@4.6.7)(terser@5.48.0)(yaml@2.9.0))
       vite-plugin-pwa:
-        specifier: ^1.3.0
+        specifier: 1.3.0
         version: 1.3.0(vite@8.1.3(@types/node@24.13.3)(jiti@2.7.0)(less@4.6.7)(terser@5.48.0)(yaml@2.9.0))(workbox-build@7.4.1)(workbox-window@7.4.1)
       vite-plugin-wasm:
-        specifier: ^3.6.0
+        specifier: 3.6.0
         version: 3.6.0(vite@8.1.3(@types/node@24.13.3)(jiti@2.7.0)(less@4.6.7)(terser@5.48.0)(yaml@2.9.0))
       vite-svg-loader:
-        specifier: ^5.1.1
+        specifier: 5.1.1
         version: 5.1.1(vue@3.5.39(typescript@6.0.3))
       vitest:
-        specifier: ^4.1.9
+        specifier: 4.1.9
         version: 4.1.9(@types/node@24.13.3)(jsdom@29.1.1)(vite@8.1.3(@types/node@24.13.3)(jiti@2.7.0)(less@4.6.7)(terser@5.48.0)(yaml@2.9.0))
       vue-i18n-extract:
-        specifier: ^2.0.7
+        specifier: 2.0.7
         version: 2.0.7
       workbox-build:
-        specifier: ^7.4.1
+        specifier: 7.4.1
         version: 7.4.1
       workbox-window:
-        specifier: ^7.4.1
+        specifier: 7.4.1
         version: 7.4.1
       zx:
-        specifier: ^8.8.5
+        specifier: 8.8.5
         version: 8.8.5
 
 packages:
@@ -6041,6 +6041,7 @@ packages:
   cron-parser@4.9.0:
     resolution: {integrity: sha512-p0SaNjrHOnQeR8/VnfGbmg9te2kfyYSQ7Sc/j/6DtPL3JQvKxmjO9TSjNFpujqV3vEYYBvNNvXSxzyksBWAx1Q==}
     engines: {node: '>=12.0.0'}
+    deprecated: v4 is no longer maintained, upgrade to v5
 
   cron-validator@1.4.0:
     resolution: {integrity: sha512-wGcJ9FCy65iaU6egSH8b5dZYJF7GU/3Jh06wzaT9lsa5dbqExjljmu+0cJ8cpKn+vUyZa/EM4WAxeLR6SypJXw==}
@@ -6068,6 +6069,7 @@ packages:
 
   crypto-js@4.2.0:
     resolution: {integrity: sha512-KALDyEYgpY+Rlob/iriUtjV6d5Eq+Y191A5g4UqLAi8CyGP9N1+FdVbkc1SxKc2r4YAYqG8JzO2KGL+AizD70Q==}
+    deprecated: Active development of CryptoJS has been discontinued. This library is no longer maintained.
 
   crypto-random-string@2.0.0:
     resolution: {integrity: sha512-v1plID3y9r/lPhviJ1wrXpLeyUIGAZ2SHNYTEapm7/8A9nLPoyvVp3RK/EPFqn5kEznyWgYZNsRtYYIWbuG8KA==}
@@ -19426,7 +19428,7 @@ snapshots:
 
   md5.js@1.3.5:
     dependencies:
-      hash-base: 3.0.5
+      hash-base: 3.1.2
       inherits: 2.0.4
       safe-buffer: 5.2.1
 
diff --git a/src/tools/dockerfile-memo/dockerfile.md b/src/tools/dockerfile-memo/dockerfile.md
index 69cf3693c3..9b49ca9685 100644
--- a/src/tools/dockerfile-memo/dockerfile.md
+++ b/src/tools/dockerfile-memo/dockerfile.md
@@ -13,8 +13,8 @@ INSTRUCTION arguments
 Specifies the base image.
 
 ```Dockerfile
-FROM ubuntu:20.04
-FROM node:22-alpine
+FROM ubuntu:20.04@sha256:8feb4d8ca5354def3d8fce243717141ce31e2c428701f6682bd2fafe15388214
+FROM node:22-alpine@sha256:c610fcdfb1d5b4740dd70c284ed3cb16bb857e0f7166196e36a5501df7a3aa32
 ```
 
 ### `LABEL`
@@ -138,7 +138,7 @@ ONBUILD COPY . /app
 ## 🧪 Example Dockerfile
 
 ```Dockerfile
-FROM node:22-alpine
+FROM node:22-alpine@sha256:c610fcdfb1d5b4740dd70c284ed3cb16bb857e0f7166196e36a5501df7a3aa32
 
 LABEL maintainer="guillaume@example.com"
 
@@ -189,7 +189,7 @@ Dockerfile
 
 ```Dockerfile
 # Stage 1: Build
-FROM node:22-alpine AS builder
+FROM node:22-alpine@sha256:c610fcdfb1d5b4740dd70c284ed3cb16bb857e0f7166196e36a5501df7a3aa32 AS builder
 WORKDIR /app
 COPY package*.json ./
 RUN npm install
@@ -197,7 +197,7 @@ COPY . .
 RUN npm run build
 
 # Stage 2: Production
-FROM nginx:alpine
+FROM nginx:alpine@sha256:4a73073bd557c65b759505da037898b61f1be6cbcc3c2c3aeac22d2a470c1752
 COPY --from=builder /app/dist /usr/share/nginx/html
 ```
 
@@ -206,12 +206,12 @@ COPY --from=builder /app/dist /usr/share/nginx/html
 You can name each stage using `AS <name>` and reference it later with `--from=<name>`.
 
 ```Dockerfile
-FROM golang:1.21 AS build
+FROM golang:1.21@sha256:4746d26432a9117a5f58e95cb9f954ddf0de128e9d5816886514199316e4a2fb AS build
 WORKDIR /src
 COPY . .
 RUN go build -o myapp
 
-FROM alpine:latest
+FROM alpine:latest@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
 COPY --from=build /src/myapp /usr/local/bin/myapp
 ENTRYPOINT ["myapp"]
 ```
@@ -243,7 +243,7 @@ Multistage builds help you avoid bloated images:
 
 ```Dockerfile
 # Build stage
-FROM node:22 AS build
+FROM node:22@sha256:0557ac14e0d45d02ed563067b82856ca5e7aa3437fa28d98d4350ea9c3d9494a AS build
 WORKDIR /app
 COPY package*.json ./
 RUN npm install
@@ -251,7 +251,7 @@ COPY . .
 RUN npm run build
 
 # Serve stage
-FROM nginx:alpine
+FROM nginx:alpine@sha256:4a73073bd557c65b759505da037898b61f1be6cbcc3c2c3aeac22d2a470c1752
 COPY --from=build /app/build /usr/share/nginx/html
 EXPOSE 80
 CMD ["nginx", "-g", "daemon off;"]
diff --git a/src/tools/dockerfile-memo/dockerfile.zh.md b/src/tools/dockerfile-memo/dockerfile.zh.md
index 5da6296a64..d16c0eac7a 100644
--- a/src/tools/dockerfile-memo/dockerfile.zh.md
+++ b/src/tools/dockerfile-memo/dockerfile.zh.md
@@ -13,8 +13,8 @@ INSTRUCTION arguments
 指定基础镜像。
 
 ```Dockerfile
-FROM ubuntu:20.04
-FROM node:22-alpine
+FROM ubuntu:20.04@sha256:8feb4d8ca5354def3d8fce243717141ce31e2c428701f6682bd2fafe15388214
+FROM node:22-alpine@sha256:c610fcdfb1d5b4740dd70c284ed3cb16bb857e0f7166196e36a5501df7a3aa32
 ```
 
 ### `LABEL`
@@ -138,7 +138,7 @@ ONBUILD COPY . /app
 ## 🧪 示例 Dockerfile
 
 ```Dockerfile
-FROM node:22-alpine
+FROM node:22-alpine@sha256:c610fcdfb1d5b4740dd70c284ed3cb16bb857e0f7166196e36a5501df7a3aa32
 
 LABEL maintainer="guillaume@example.com"
 
@@ -189,7 +189,7 @@ Dockerfile
 
 ```Dockerfile
 # 阶段 1：构建
-FROM node:22-alpine AS builder
+FROM node:22-alpine@sha256:c610fcdfb1d5b4740dd70c284ed3cb16bb857e0f7166196e36a5501df7a3aa32 AS builder
 WORKDIR /app
 COPY package*.json ./
 RUN npm install
@@ -197,7 +197,7 @@ COPY . .
 RUN npm run build
 
 # 阶段 2：生产
-FROM nginx:alpine
+FROM nginx:alpine@sha256:4a73073bd557c65b759505da037898b61f1be6cbcc3c2c3aeac22d2a470c1752
 COPY --from=builder /app/dist /usr/share/nginx/html
 ```
 
@@ -206,12 +206,12 @@ COPY --from=builder /app/dist /usr/share/nginx/html
 你可以使用 `AS <name>` 为每个阶段命名，并在之后通过 `--from=<name>` 引用它。
 
 ```Dockerfile
-FROM golang:1.21 AS build
+FROM golang:1.21@sha256:4746d26432a9117a5f58e95cb9f954ddf0de128e9d5816886514199316e4a2fb AS build
 WORKDIR /src
 COPY . .
 RUN go build -o myapp
 
-FROM alpine:latest
+FROM alpine:latest@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
 COPY --from=build /src/myapp /usr/local/bin/myapp
 ENTRYPOINT ["myapp"]
 ```
@@ -243,7 +243,7 @@ COPY --from=builder /app/output /app/output
 
 ```Dockerfile
 # 构建阶段
-FROM node:22 AS build
+FROM node:22@sha256:0557ac14e0d45d02ed563067b82856ca5e7aa3437fa28d98d4350ea9c3d9494a AS build
 WORKDIR /app
 COPY package*.json ./
 RUN npm install
@@ -251,7 +251,7 @@ COPY . .
 RUN npm run build
 
 # 服务阶段
-FROM nginx:alpine
+FROM nginx:alpine@sha256:4a73073bd557c65b759505da037898b61f1be6cbcc3c2c3aeac22d2a470c1752
 COPY --from=build /app/build /usr/share/nginx/html
 EXPOSE 80
 CMD ["nginx", "-g", "daemon off;"]