jfxs/flutter repository overview

⁠Docker Flutter

A fully automated Docker image bundling the Flutter⁠ SDK on Debian, with continuous builds, regression testing, and CI‑ready tooling — no more downloading and unpacking Flutter on every CI run.

• amd64 only (the official Flutter Linux SDK has no arm64 tarball),
• automatically kept up to date by Renovate⁠ (base image and Flutter version),
• image signed with Cosign⁠,
• a software bill of materials (SBOM) attestation added using Syft⁠,
• available on Docker Hub and Quay.io.

The main repository.

The Docker Hub registry.

The Quay.io registry.

This image includes the Flutter SDK (and the Dart SDK it bundles) only — no Android SDK, no Java, no Chrome. It covers flutter pub get, flutter analyze, flutter test, and flutter build web; it does not support flutter build apk/appbundle/ios.

⁠Running Flutter

Example to run Flutter commands against your project in the current directory:

docker run -it --rm -v $(pwd):/flutter jfxs/flutter flutter pub get

docker run -it --rm -v $(pwd):/flutter jfxs/flutter flutter analyze

docker run -it --rm -v $(pwd):/flutter jfxs/flutter flutter test

docker run -it --rm -v $(pwd):/flutter jfxs/flutter flutter build web

To check the Flutter/Dart versions bundled in the image:

docker run -t --rm jfxs/flutter flutter --version
docker run -t --rm jfxs/flutter dart --version

⁠Replacing an inline flutter CI job

Instead of a job that downloads and unpacks the Flutter SDK on every run:

.flutter-job:
  image: debian:bookworm-slim
  variables:
    FLUTTER_VERSION: "3.47.1"
  before_script:
    - apt-get update && apt-get install -y --no-install-recommends ca-certificates curl git xz-utils && rm -rf /var/lib/apt/lists/*
    - curl -fsSL -o /tmp/flutter.tar.xz "https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_${FLUTTER_VERSION}-stable.tar.xz"
    - tar -xf /tmp/flutter.tar.xz -C /opt
    - rm /tmp/flutter.tar.xz
    - export PATH="/opt/flutter/bin:${PATH}"
    - git config --global --add safe.directory /opt/flutter
    - flutter config --no-analytics
    - flutter pub get
  cache:
    key:
      files:
        - pubspec.lock
    paths:
      - .pub-cache/

use the pre-built image directly:

.flutter-job:
  image: jfxs/flutter:3.47.1-001
  before_script:
    - flutter pub get

⁠Built with

Docker latest tag is 3.47.5-001, 3.47, 3⁠ and has:

Dockerhub Overview page⁠ has the details of the last published image.

⁠Versioning

Docker tag definition:

• the Flutter version used,
• a dash
• an increment to differentiate build with the same version starting at 001

<flutter_version>-<increment>

Example: 3.47.1-001

⁠Signature and attestation

Cosign⁠ public key:

-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEa3yV6+yd/l4zh/tfT6Tx+zn0dhy3
BhFqSad1norLeKSCN2MILv4fZ9GA6ODOlJOw+7vzUvzZVr9IXnxEdjoWJw==
-----END PUBLIC KEY-----

The public key is also available online: https://gitlab.com/op_so/docker/cosign-public-key/-/raw/main/cosign.pub⁠.

To verify an image:

cosign verify --key cosign.pub $IMAGE_URI

To verify and get the SBOM attestation:

cosign verify-attestation --key cosign.pub --type spdxjson $IMAGE_URI | jq '.payload | @base64d | fromjson | .predicate'

⁠Authors

• FX Soubirou - Initial work - GitLab repositories⁠

⁠License

This program is free software: you can redistribute it and/or modify it under the terms of the MIT License (MIT). See the LICENSE⁠ for details.