ocis_full: reintroduce env interpolation with pinned tag+digest defaults

deployments/examples/ocis_full/.env

@@ -10,8 +10,7 @@ INSECURE=false
 
 ## Traefik Settings ##
 # Note: Traefik is always enabled and can't be disabled.
-# The recommended (and tested) version to pull. If no version is used, it pulls "latest"
-# Documentation/manual override only: default compose pins a tag+digest in docker-compose.yml.
+# The recommended (and tested) version to pull. If no version is used, the default pinned version from docker-compose.yml is used.
 # release notes: https://github.com/traefik/traefik/releases
 TRAEFIK_DOCKER_TAG=
 # Serve Traefik dashboard.
@@ -43,10 +42,9 @@ OCIS=:ocis.yml
 # For production releases: "owncloud/ocis"
 # For rolling releases:    "owncloud/ocis-rolling"
 # Defaults to production if not set otherwise
-# Documentation/manual override only: default compose pins a tag+digest in ocis*.yml.
 OCIS_DOCKER_IMAGE=owncloud/ocis
-# The oCIS container version.
-# Defaults to "latest" and points to the latest stable tag.
+# The oCIS container version (tag or tag@digest).
+# If empty, the default pinned version from ocis*.yml is used.
 OCIS_DOCKER_TAG=
 # Domain of oCIS, where you can find the frontend.
 # Defaults to "ocis.owncloud.test"
@@ -157,7 +155,7 @@ START_ADDITIONAL_SERVICES="notifications"
 # The importer needs additional COMPANION config, see the following lines for more details.
 ## The docker image to be used for uppy companion.
 # owncloud has built a container with public link import support.
-# Documentation/manual override only: default compose pins a tag+digest in web_extensions/importer.yml.
+# Set to override the default pinned image from web_extensions/importer.yml.
 COMPANION_IMAGE=
 # Domain of Uppy Companion. Defaults to "companion.owncloud.test".
 COMPANION_DOMAIN=
@@ -174,8 +172,7 @@ COMPANION_ONEDRIVE_SECRET=
 # Note: the leading colon is required to enable the service.
 TIKA=:tika.yml
 # Set the desired docker image tag or digest.
-# Defaults to "latest"
-# Documentation/manual override only: default compose pins a tag+digest in tika.yml.
+# If empty, the default pinned version from tika.yml is used.
 TIKA_IMAGE=
 
 ### IMPORTANT Note for Online Office Apps ###
@@ -187,8 +184,7 @@ TIKA_IMAGE=
 # Collabora web office is default enabled, comment if not required.
 # Note: the leading colon is required to enable the service.
 COLLABORA=:collabora.yml
-# The recommended (and tested) version to pull. If no version is used, it pulls "latest"
-# Documentation/manual override only: default compose pins a tag+digest in collabora.yml.
+# The recommended (and tested) version to pull. If no version is used, the default pinned version from collabora.yml is used.
 # release notes: https://www.collaboraonline.com/release-notes/
 COLLABORA_DOCKER_TAG=
 # Domain of Collabora, where you can find the frontend.
@@ -221,8 +217,7 @@ COLLABORA_SSL_VERIFICATION=false
 # Note: the leading colon is required to enable the service.
 #CLAMAV=:clamav.yml
 # Image version of the ClamAV container.
-# Defaults to "latest"
-# Documentation/manual override only: default compose pins a tag+digest in clamav.yml.
+# If empty, the default pinned version from clamav.yml is used.
 CLAMAV_DOCKER_TAG=
 
 
@@ -233,11 +228,11 @@ CLAMAV_DOCKER_TAG=
 # For community releases:  "onlyoffice/documentserver"
 # For enterprise releases: "onlyoffice/documentserver-ee"
 # Defaults to community if not set otherwise
-# Documentation/manual override only: default compose pins a tag+digest in onlyoffice.yml.
 ONLYOFFICE_IMAGE=onlyoffice/documentserver
-# The recommended (and tested) version to pull. If no version is used, it pulls "latest"
+# The recommended (and tested) version to pull (tag or tag@digest).
+# If empty, the default pinned version from onlyoffice.yml is used.
 # release notes: https://github.com/ONLYOFFICE/DocumentServer/releases
-ONLYOFFICE_DOCKER_TAG=9.2.1.1
+ONLYOFFICE_DOCKER_TAG=
 
 # EE only: the path to your license file on the host.
 # To activate a license file, comment ONLYOFFICE_DEACTIVATE_LICENSE. Otherwise, it <must> stay uncommented.
@@ -262,8 +257,7 @@ ONLYOFFICE_DOMAIN=
 #MAIL_SERVER=:mailserver.yml
 # Domain for mail server. Defaults to "mail.owncloud.test".
 MAIL_SERVER_DOMAIN=
-# The recommended (and tested) version to pull. If no version is used, it pulls "latest"
-# Documentation/manual override only: default compose pins a tag+digest in mailserver.yml.
+# The recommended (and tested) version to pull. If no version is used, the default pinned version from mailserver.yml is used.
 # release notes: https://github.com/axllent/mailpit/releases
 MAIL_SERVER_DOCKER_TAG=
 

deployments/examples/ocis_full/clamav.yml

@@ -13,7 +13,7 @@ services:
       - "clamav-socket:/var/run/clamav"
 
   clamav:
-    image: clamav/clamav:1.5.1@sha256:e4f5060e4ef3f066a4c1234fbe45d8d876635f03b13e41aa679f89792968bc6c
+    image: clamav/clamav:${CLAMAV_DOCKER_TAG:-1.5.1@sha256:e4f5060e4ef3f066a4c1234fbe45d8d876635f03b13e41aa679f89792968bc6c}
     platform: linux/${IMAGE_ARCH:-amd64}
     # release notes: https://blog.clamav.net
     networks:

deployments/examples/ocis_full/collabora.yml

@@ -12,7 +12,7 @@ services:
       GRAPH_AVAILABLE_ROLES: "b1e2218d-eef8-4d4c-b82d-0f1a1b48f3b5,a8d5fe5e-96e3-418d-825b-534dbdf22b99,fb6c3e19-e378-47e5-b277-9732f9de6e21,58c63c02-1d89-4572-916a-870abc5a1b7d,2d00ce52-1fc2-4dbc-8b95-a73b73395f5a,1c996275-f1c9-4e71-abdf-a42f6495e960,312c0871-5ef7-4b3a-85b6-0e4074c64049,aa97fe03-7980-45ac-9e50-b325749fd7e6"
 
   collaboration:
-    image: owncloud/ocis:8.0.0@sha256:41e6d78f43507015e0c34b87bff49ae0744f261a92916f044e47d32067ff18ce
+    image: ${OCIS_DOCKER_IMAGE:-owncloud/ocis}:${OCIS_DOCKER_TAG:-8.0.0@sha256:41e6d78f43507015e0c34b87bff49ae0744f261a92916f044e47d32067ff18ce}
     platform: linux/${IMAGE_ARCH:-amd64}
     networks:
       ocis-net:
@@ -50,7 +50,7 @@ services:
     restart: always
 
   collabora:
-    image: collabora/code:25.04.8.1.1@sha256:3c58d0e9bae75e4647467d0c7d91cb66f261d3e814709aed590b5c334a04db26
+    image: collabora/code:${COLLABORA_DOCKER_TAG:-25.04.8.1.1@sha256:3c58d0e9bae75e4647467d0c7d91cb66f261d3e814709aed590b5c334a04db26}
     platform: linux/${IMAGE_ARCH:-amd64}
     networks:
       ocis-net:

deployments/examples/ocis_full/docker-compose.yml

@@ -1,7 +1,7 @@
 ---
 services:
   traefik:
-    image: traefik:v3.6.7@sha256:a9890c898f379c1905ee5b28342f6b408dc863f08db2dab20e46c267d1ff463a
+    image: traefik:${TRAEFIK_DOCKER_TAG:-v3.6.7@sha256:a9890c898f379c1905ee5b28342f6b408dc863f08db2dab20e46c267d1ff463a}
     platform: linux/${IMAGE_ARCH:-amd64}
     networks:
       ocis-net:

deployments/examples/ocis_full/mailserver.yml

@@ -8,7 +8,7 @@ services:
       NOTIFICATIONS_SMTP_INSECURE: "true"
 
   mailserver:
-    image: axllent/mailpit:v1.28.0@sha256:c076638db1e15662150be4fb62b8a6e96ef6ba5bde90c838a0239225854830f7
+    image: axllent/mailpit:${MAIL_SERVER_DOCKER_TAG:-v1.28.0@sha256:c076638db1e15662150be4fb62b8a6e96ef6ba5bde90c838a0239225854830f7}
     platform: linux/${IMAGE_ARCH:-amd64}
     networks:
       - ocis-net

deployments/examples/ocis_full/ocis.yml

@@ -6,7 +6,7 @@ services:
         aliases:
           - ${OCIS_DOMAIN:-ocis.owncloud.test}
   ocis:
-    image: owncloud/ocis:8.0.0@sha256:41e6d78f43507015e0c34b87bff49ae0744f261a92916f044e47d32067ff18ce
+    image: ${OCIS_DOCKER_IMAGE:-owncloud/ocis}:${OCIS_DOCKER_TAG:-8.0.0@sha256:41e6d78f43507015e0c34b87bff49ae0744f261a92916f044e47d32067ff18ce}
     # changelog: https://github.com/owncloud/ocis/tree/master/changelog
     # release notes: https://doc.owncloud.com/ocis_release_notes.html
     networks:

deployments/examples/ocis_full/onlyoffice.yml

@@ -7,7 +7,7 @@ services:
           - ${ONLYOFFICE_DOMAIN:-onlyoffice.owncloud.test}
 
   collaboration-oo:
-    image: owncloud/ocis:8.0.0@sha256:41e6d78f43507015e0c34b87bff49ae0744f261a92916f044e47d32067ff18ce
+    image: ${OCIS_DOCKER_IMAGE:-owncloud/ocis}:${OCIS_DOCKER_TAG:-8.0.0@sha256:41e6d78f43507015e0c34b87bff49ae0744f261a92916f044e47d32067ff18ce}
     networks:
       ocis-net:
     depends_on:
@@ -45,7 +45,7 @@ services:
 
   onlyoffice:
     # note, you also need to add a volume when using the enterprise version, see below
-    image: onlyoffice/documentserver:9.2.1.1@sha256:fd00acbbbde3d8b1ead9b933aafa7c2df77e62c48b1b171886e6bef343c13882
+    image: ${ONLYOFFICE_IMAGE:-onlyoffice/documentserver}:${ONLYOFFICE_DOCKER_TAG:-9.2.1.1@sha256:fd00acbbbde3d8b1ead9b933aafa7c2df77e62c48b1b171886e6bef343c13882}
     networks:
       ocis-net:
     entrypoint:

deployments/examples/ocis_full/tika.yml

@@ -1,7 +1,7 @@
 ---
 services:
   tika:
-    image: apache/tika:3.2.3.0-full@sha256:21d8052de04e491ccf66e8680ade4da6f3d453a56d59f740b4167e54167219b7
+    image: ${TIKA_IMAGE:-apache/tika:3.2.3.0-full@sha256:21d8052de04e491ccf66e8680ade4da6f3d453a56d59f740b4167e54167219b7}
     # release notes: https://tika.apache.org
     networks:
       ocis-net:

deployments/examples/ocis_full/web_extensions/importer.yml

@@ -23,7 +23,7 @@ services:
     command: [ "-c", "cp -R /var/lib/nginx/html/importer/ /apps" ]
 
   companion:
-    image: transloadit/companion:5.8.0@sha256:65052a640897deb14fdf449fa88a121b8648f0fb06c52a1503fa4b3bb1d2564f
+    image: ${COMPANION_IMAGE:-transloadit/companion:5.8.0@sha256:65052a640897deb14fdf449fa88a121b8648f0fb06c52a1503fa4b3bb1d2564f}
     networks:
       - ocis-net
     environment: