From 0970e695df8b7134c0f2bf182dff52b68b10f7ad Mon Sep 17 00:00:00 2001
From: Eric Lim <eric.lim@datadoghq.com>
Date: Tue, 3 Nov 2026 14:56:23 +0000
Subject: [PATCH 1/6] [CIEXE-2681] Use published internal-Buildx Docker CI
 images

---
 ci/input_files/build.yaml.tpl | 27 ++++++++++++++++++---------
 scripts/setup_python_env.sh   |  3 +--
 2 files changed, 19 insertions(+), 11 deletions(-)

diff --git a/ci/input_files/build.yaml.tpl b/ci/input_files/build.yaml.tpl
index cf89c5eac..e5d48a404 100644
--- a/ci/input_files/build.yaml.tpl
+++ b/ci/input_files/build.yaml.tpl
@@ -14,6 +14,11 @@ default:
       # Retry when the runner fails to start
       - runner_system_failure
 
+# The Noble Python image uses managed system Python and does not include AWS CLI.
+.install-python-tools: &install-python-tools
+  - apt-get update
+  - apt-get install -y --no-install-recommends awscli python3-venv python-is-python3
+
 # This is for serverless framework
 .install-node: &install-node
   - apt-get update
@@ -38,7 +43,7 @@ default:
 build-layer ({{ $runtime.name }}-{{ $runtime.arch }}):
   stage: build
   tags: ["arch:amd64"]
-  image: registry.ddbuild.io/images/docker:20.10
+  image: registry.ddbuild.io/images/docker:27.3.1@sha256:966b6cd18c53e3730e7aaea2c0ca6b6b9877dcff11d9446f25ee5bc2293585d0
   artifacts:
     expire_in: 1 day # Unsigned zips expire in 1 day
     paths:
@@ -53,7 +58,7 @@ build-layer ({{ $runtime.name }}-{{ $runtime.arch }}):
 check-layer-size ({{ $runtime.name }}-{{ $runtime.arch }}):
   stage: test
   tags: ["arch:amd64"]
-  image: registry.ddbuild.io/images/docker:20.10
+  image: registry.ddbuild.io/images/docker:27.3.1@sha256:966b6cd18c53e3730e7aaea2c0ca6b6b9877dcff11d9446f25ee5bc2293585d0
   needs:
     - build-layer ({{ $runtime.name }}-{{ $runtime.arch }})
   dependencies:
@@ -99,7 +104,7 @@ unit-test ({{ $runtime.name }}-{{ $runtime.arch }}):
 integration-test ({{ $runtime.name }}-{{ $runtime.arch }}):
   stage: test
   tags: ["arch:amd64"]
-  image: registry.ddbuild.io/images/docker:20.10-py3
+  image: registry.ddbuild.io/images/docker:29.4.0-noble-py3@sha256:a1e09b5d90ac6c8576313064f1b0e5809ba718355715fb43a832ea7aa1ec7b70
   rules:
     - if: '$SKIP_E2E_TESTS == "true"'
       when: never
@@ -112,6 +117,7 @@ integration-test ({{ $runtime.name }}-{{ $runtime.arch }}):
   variables:
     CI_ENABLE_CONTAINER_IMAGE_BUILDS: "true"
   before_script:
+    - *install-python-tools
     - *install-node
     - EXTERNAL_ID_NAME=integration-test-externalid ROLE_TO_ASSUME=sandbox-integration-test-deployer AWS_ACCOUNT=425362996713 source ./ci/get_secrets.sh
     - yarn global add serverless@^3.38.0 --prefix /usr/local
@@ -124,7 +130,7 @@ integration-test ({{ $runtime.name }}-{{ $runtime.arch }}):
 sign-layer ({{ $runtime.name }}-{{ $runtime.arch }}):
   stage: sign
   tags: ["arch:amd64"]
-  image: registry.ddbuild.io/images/docker:20.10-py3
+  image: registry.ddbuild.io/images/docker:29.4.0-noble-py3@sha256:a1e09b5d90ac6c8576313064f1b0e5809ba718355715fb43a832ea7aa1ec7b70
   rules:
     - if: '$CI_COMMIT_TAG =~ /^v.*/'
       when: manual
@@ -141,6 +147,7 @@ sign-layer ({{ $runtime.name }}-{{ $runtime.arch }}):
     paths:
       - .layers/datadog_lambda_py-{{ $runtime.arch }}-{{ $runtime.python_version }}.zip
   before_script:
+    - *install-python-tools
     - apt-get update
     - apt-get install -y uuid-runtime
     {{ with $environment := (ds "environments").environments.prod }}
@@ -155,7 +162,7 @@ sign-layer ({{ $runtime.name }}-{{ $runtime.arch }}):
 publish-layer-{{ $environment_name }} ({{ $runtime.name }}-{{ $runtime.arch }}):
   stage: publish
   tags: ["arch:amd64"]
-  image: registry.ddbuild.io/images/docker:20.10-py3
+  image: registry.ddbuild.io/images/docker:29.4.0-noble-py3@sha256:a1e09b5d90ac6c8576313064f1b0e5809ba718355715fb43a832ea7aa1ec7b70
   rules:
     - if: '$SKIP_E2E_TESTS == "true"'
       when: never
@@ -190,6 +197,7 @@ publish-layer-{{ $environment_name }} ({{ $runtime.name }}-{{ $runtime.arch }}):
           - {{ .code }}
         {{- end}}
   before_script:
+    - *install-python-tools
     - EXTERNAL_ID_NAME={{ $environment.external_id }} ROLE_TO_ASSUME={{ $environment.role_to_assume }} AWS_ACCOUNT={{ $environment.account }} source ./ci/get_secrets.sh
   script:
     - STAGE={{ $environment_name }} PYTHON_VERSION={{ $runtime.python_version }} ARCH={{ $runtime.arch }} DOTENV={{ $dotenv }} ./ci/publish_layers.sh
@@ -201,8 +209,9 @@ publish-layer-{{ $environment_name }} ({{ $runtime.name }}-{{ $runtime.arch }}):
 publish-pypi-package:
   stage: publish
   tags: ["arch:amd64"]
-  image: registry.ddbuild.io/images/docker:20.10-py3
+  image: registry.ddbuild.io/images/docker:29.4.0-noble-py3@sha256:a1e09b5d90ac6c8576313064f1b0e5809ba718355715fb43a832ea7aa1ec7b70
   before_script:
+    - *install-python-tools
     - ./scripts/setup_python_env.sh
   cache: []
   rules:
@@ -217,7 +226,7 @@ publish-pypi-package:
 layer bundle:
   stage: build
   tags: ["arch:amd64"]
-  image: registry.ddbuild.io/images/docker:20.10
+  image: registry.ddbuild.io/images/docker:27.3.1@sha256:966b6cd18c53e3730e7aaea2c0ca6b6b9877dcff11d9446f25ee5bc2293585d0
   needs:
     {{ range (ds "runtimes").runtimes }}
     - build-layer ({{ .name }}-{{ .arch }})
@@ -238,7 +247,7 @@ layer bundle:
 
 signed layer bundle:
   stage: sign
-  image: registry.ddbuild.io/images/docker:20.10-py3
+  image: registry.ddbuild.io/images/docker:29.4.0-noble-py3@sha256:a1e09b5d90ac6c8576313064f1b0e5809ba718355715fb43a832ea7aa1ec7b70
   tags: ["arch:amd64"]
   rules:
     - if: '$CI_COMMIT_TAG =~ /^v.*/'
@@ -286,7 +295,7 @@ e2e-test:
 
 e2e-test-status:
   stage: e2e
-  image: registry.ddbuild.io/images/docker:20.10-py3
+  image: registry.ddbuild.io/images/docker:29.4.0-noble-py3@sha256:a1e09b5d90ac6c8576313064f1b0e5809ba718355715fb43a832ea7aa1ec7b70
   tags: ["arch:amd64"]
   timeout: 3h
   rules:
diff --git a/scripts/setup_python_env.sh b/scripts/setup_python_env.sh
index 42dfa7108..fdf871cc7 100755
--- a/scripts/setup_python_env.sh
+++ b/scripts/setup_python_env.sh
@@ -65,8 +65,7 @@ if [ -z "${IS_LINT:-}" ] || [ "${IS_LINT}" = "0" ] || [ "${IS_LINT}" = "false" ]
     spec_ddtrace_dep
 fi
 
-pip install virtualenv
-virtualenv venv
+python3 -m venv venv
 source venv/bin/activate
 pip install .[dev]
 pip install poetry

From 628602f5473603ee5ebe828bb2e46135a6e7faa2 Mon Sep 17 00:00:00 2001
From: Eric Lim <eric.lim@datadoghq.com>
Date: Thu, 5 Nov 2026 11:34:24 +0000
Subject: [PATCH 2/6] fix(ci): skip redundant pip install in layer publishing

---
 ci/input_files/build.yaml.tpl | 1 +
 1 file changed, 1 insertion(+)

diff --git a/ci/input_files/build.yaml.tpl b/ci/input_files/build.yaml.tpl
index e5d48a404..9e73b873f 100644
--- a/ci/input_files/build.yaml.tpl
+++ b/ci/input_files/build.yaml.tpl
@@ -198,6 +198,7 @@ publish-layer-{{ $environment_name }} ({{ $runtime.name }}-{{ $runtime.arch }}):
         {{- end}}
   before_script:
     - *install-python-tools
+    - export SKIP_PIP_INSTALL=true
     - EXTERNAL_ID_NAME={{ $environment.external_id }} ROLE_TO_ASSUME={{ $environment.role_to_assume }} AWS_ACCOUNT={{ $environment.account }} source ./ci/get_secrets.sh
   script:
     - STAGE={{ $environment_name }} PYTHON_VERSION={{ $runtime.python_version }} ARCH={{ $runtime.arch }} DOTENV={{ $dotenv }} ./ci/publish_layers.sh

From 8d227c27fe6f17728bb8ccb4c5d5315a050c1bf7 Mon Sep 17 00:00:00 2001
From: Eric Lim <eric.lim@datadoghq.com>
Date: Thu, 12 Nov 2026 13:03:25 +0000
Subject: [PATCH 3/6] Pin CI images with internal Buildx v0.38.2-dd.3

---
 ci/input_files/build.yaml.tpl | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/ci/input_files/build.yaml.tpl b/ci/input_files/build.yaml.tpl
index 9e73b873f..51c4d8ccc 100644
--- a/ci/input_files/build.yaml.tpl
+++ b/ci/input_files/build.yaml.tpl
@@ -43,7 +43,7 @@ default:
 build-layer ({{ $runtime.name }}-{{ $runtime.arch }}):
   stage: build
   tags: ["arch:amd64"]
-  image: registry.ddbuild.io/images/docker:27.3.1@sha256:966b6cd18c53e3730e7aaea2c0ca6b6b9877dcff11d9446f25ee5bc2293585d0
+  image: registry.ddbuild.io/images/docker:v152537305-593bdcb-27.3.1@sha256:0d9ee7bf1fc4c02ca8a2ad6c14b421ef89fa90d63b832ad4515f5fabdd6b0200
   artifacts:
     expire_in: 1 day # Unsigned zips expire in 1 day
     paths:
@@ -58,7 +58,7 @@ build-layer ({{ $runtime.name }}-{{ $runtime.arch }}):
 check-layer-size ({{ $runtime.name }}-{{ $runtime.arch }}):
   stage: test
   tags: ["arch:amd64"]
-  image: registry.ddbuild.io/images/docker:27.3.1@sha256:966b6cd18c53e3730e7aaea2c0ca6b6b9877dcff11d9446f25ee5bc2293585d0
+  image: registry.ddbuild.io/images/docker:v152537305-593bdcb-27.3.1@sha256:0d9ee7bf1fc4c02ca8a2ad6c14b421ef89fa90d63b832ad4515f5fabdd6b0200
   needs:
     - build-layer ({{ $runtime.name }}-{{ $runtime.arch }})
   dependencies:
@@ -104,7 +104,7 @@ unit-test ({{ $runtime.name }}-{{ $runtime.arch }}):
 integration-test ({{ $runtime.name }}-{{ $runtime.arch }}):
   stage: test
   tags: ["arch:amd64"]
-  image: registry.ddbuild.io/images/docker:29.4.0-noble-py3@sha256:a1e09b5d90ac6c8576313064f1b0e5809ba718355715fb43a832ea7aa1ec7b70
+  image: registry.ddbuild.io/images/docker:v152556028-36457c2-29.4.0-noble-py3@sha256:87eb41a1ee25cec0470ba98ecee89fb67ce4bf935f06129b00e29d496720ead4
   rules:
     - if: '$SKIP_E2E_TESTS == "true"'
       when: never
@@ -130,7 +130,7 @@ integration-test ({{ $runtime.name }}-{{ $runtime.arch }}):
 sign-layer ({{ $runtime.name }}-{{ $runtime.arch }}):
   stage: sign
   tags: ["arch:amd64"]
-  image: registry.ddbuild.io/images/docker:29.4.0-noble-py3@sha256:a1e09b5d90ac6c8576313064f1b0e5809ba718355715fb43a832ea7aa1ec7b70
+  image: registry.ddbuild.io/images/docker:v152556028-36457c2-29.4.0-noble-py3@sha256:87eb41a1ee25cec0470ba98ecee89fb67ce4bf935f06129b00e29d496720ead4
   rules:
     - if: '$CI_COMMIT_TAG =~ /^v.*/'
       when: manual
@@ -162,7 +162,7 @@ sign-layer ({{ $runtime.name }}-{{ $runtime.arch }}):
 publish-layer-{{ $environment_name }} ({{ $runtime.name }}-{{ $runtime.arch }}):
   stage: publish
   tags: ["arch:amd64"]
-  image: registry.ddbuild.io/images/docker:29.4.0-noble-py3@sha256:a1e09b5d90ac6c8576313064f1b0e5809ba718355715fb43a832ea7aa1ec7b70
+  image: registry.ddbuild.io/images/docker:v152556028-36457c2-29.4.0-noble-py3@sha256:87eb41a1ee25cec0470ba98ecee89fb67ce4bf935f06129b00e29d496720ead4
   rules:
     - if: '$SKIP_E2E_TESTS == "true"'
       when: never
@@ -210,7 +210,7 @@ publish-layer-{{ $environment_name }} ({{ $runtime.name }}-{{ $runtime.arch }}):
 publish-pypi-package:
   stage: publish
   tags: ["arch:amd64"]
-  image: registry.ddbuild.io/images/docker:29.4.0-noble-py3@sha256:a1e09b5d90ac6c8576313064f1b0e5809ba718355715fb43a832ea7aa1ec7b70
+  image: registry.ddbuild.io/images/docker:v152556028-36457c2-29.4.0-noble-py3@sha256:87eb41a1ee25cec0470ba98ecee89fb67ce4bf935f06129b00e29d496720ead4
   before_script:
     - *install-python-tools
     - ./scripts/setup_python_env.sh
@@ -227,7 +227,7 @@ publish-pypi-package:
 layer bundle:
   stage: build
   tags: ["arch:amd64"]
-  image: registry.ddbuild.io/images/docker:27.3.1@sha256:966b6cd18c53e3730e7aaea2c0ca6b6b9877dcff11d9446f25ee5bc2293585d0
+  image: registry.ddbuild.io/images/docker:v152537305-593bdcb-27.3.1@sha256:0d9ee7bf1fc4c02ca8a2ad6c14b421ef89fa90d63b832ad4515f5fabdd6b0200
   needs:
     {{ range (ds "runtimes").runtimes }}
     - build-layer ({{ .name }}-{{ .arch }})
@@ -248,7 +248,7 @@ layer bundle:
 
 signed layer bundle:
   stage: sign
-  image: registry.ddbuild.io/images/docker:29.4.0-noble-py3@sha256:a1e09b5d90ac6c8576313064f1b0e5809ba718355715fb43a832ea7aa1ec7b70
+  image: registry.ddbuild.io/images/docker:v152556028-36457c2-29.4.0-noble-py3@sha256:87eb41a1ee25cec0470ba98ecee89fb67ce4bf935f06129b00e29d496720ead4
   tags: ["arch:amd64"]
   rules:
     - if: '$CI_COMMIT_TAG =~ /^v.*/'
@@ -296,7 +296,7 @@ e2e-test:
 
 e2e-test-status:
   stage: e2e
-  image: registry.ddbuild.io/images/docker:29.4.0-noble-py3@sha256:a1e09b5d90ac6c8576313064f1b0e5809ba718355715fb43a832ea7aa1ec7b70
+  image: registry.ddbuild.io/images/docker:v152556028-36457c2-29.4.0-noble-py3@sha256:87eb41a1ee25cec0470ba98ecee89fb67ce4bf935f06129b00e29d496720ead4
   tags: ["arch:amd64"]
   timeout: 3h
   rules:

From 7337b98d0cdc453c35345ee732f7ae8e89b72040 Mon Sep 17 00:00:00 2001
From: Eric Lim <eric.lim@datadoghq.com>
Date: Thu, 12 Nov 2026 14:03:18 +0000
Subject: [PATCH 4/6] Fix Python CI tools and isolate image validation from
 Lambda deployment

---
 ci/input_files/build.yaml.tpl | 29 ++++++++++++++++++++++++++++-
 1 file changed, 28 insertions(+), 1 deletion(-)

diff --git a/ci/input_files/build.yaml.tpl b/ci/input_files/build.yaml.tpl
index 51c4d8ccc..74e5a6f21 100644
--- a/ci/input_files/build.yaml.tpl
+++ b/ci/input_files/build.yaml.tpl
@@ -17,7 +17,10 @@ default:
 # The Noble Python image uses managed system Python and does not include AWS CLI.
 .install-python-tools: &install-python-tools
   - apt-get update
-  - apt-get install -y --no-install-recommends awscli python3-venv python-is-python3
+  - apt-get install -y --no-install-recommends python3-venv python-is-python3
+  - python3 -m venv /opt/ci-python-tools
+  - /opt/ci-python-tools/bin/pip install awscli
+  - export PATH="/opt/ci-python-tools/bin:$PATH"
 
 # This is for serverless framework
 .install-node: &install-node
@@ -31,6 +34,18 @@ default:
   - apt-get install nodejs -y
   - npm install --global yarn
 
+validate-python-ci-tools:
+  stage: test
+  tags: ["arch:amd64"]
+  image: registry.ddbuild.io/images/docker:v152556028-36457c2-29.4.0-noble-py3@sha256:87eb41a1ee25cec0470ba98ecee89fb67ce4bf935f06129b00e29d496720ead4
+  before_script:
+    - *install-python-tools
+  script:
+    - aws --version
+    - python --version
+    - python -m pip --version
+    - docker buildx version | grep -F "github.com/docker/buildx v0.38.2-dd.3 "
+
 {{ range $runtime := (ds "runtimes").runtimes }}
 
 # TODO(astuyve) - figure out python build cache
@@ -106,6 +121,9 @@ integration-test ({{ $runtime.name }}-{{ $runtime.arch }}):
   tags: ["arch:amd64"]
   image: registry.ddbuild.io/images/docker:v152556028-36457c2-29.4.0-noble-py3@sha256:87eb41a1ee25cec0470ba98ecee89fb67ce4bf935f06129b00e29d496720ead4
   rules:
+    # Image-maintenance validation has no authorization to deploy Lambda services.
+    - if: '$CI_COMMIT_BRANCH == "ericlim/internal-buildx-modern-docker-20261103" || $CI_MERGE_REQUEST_SOURCE_BRANCH_NAME == "ericlim/internal-buildx-modern-docker-20261103"'
+      when: never
     - if: '$SKIP_E2E_TESTS == "true"'
       when: never
     - when: on_success
@@ -164,6 +182,9 @@ publish-layer-{{ $environment_name }} ({{ $runtime.name }}-{{ $runtime.arch }}):
   tags: ["arch:amd64"]
   image: registry.ddbuild.io/images/docker:v152556028-36457c2-29.4.0-noble-py3@sha256:87eb41a1ee25cec0470ba98ecee89fb67ce4bf935f06129b00e29d496720ead4
   rules:
+    # Image-maintenance validation has no authorization to deploy Lambda services.
+    - if: '$CI_COMMIT_BRANCH == "ericlim/internal-buildx-modern-docker-20261103" || $CI_MERGE_REQUEST_SOURCE_BRANCH_NAME == "ericlim/internal-buildx-modern-docker-20261103"'
+      when: never
     - if: '$SKIP_E2E_TESTS == "true"'
       when: never
     - if: '"{{ $environment_name }}" == "sandbox" && $REGION == "{{ $e2e_region }}" && "{{ $runtime.arch }}" == "amd64"'
@@ -276,6 +297,9 @@ e2e-test:
     project: DataDog/serverless-e2e-tests
     strategy: depend
   rules:
+    # Image-maintenance validation has no authorization to deploy Lambda services.
+    - if: '$CI_COMMIT_BRANCH == "ericlim/internal-buildx-modern-docker-20261103" || $CI_MERGE_REQUEST_SOURCE_BRANCH_NAME == "ericlim/internal-buildx-modern-docker-20261103"'
+      when: never
     - if: '$SKIP_E2E_TESTS == "true"'
       when: never
     - when: on_success
@@ -300,6 +324,9 @@ e2e-test-status:
   tags: ["arch:amd64"]
   timeout: 3h
   rules:
+    # Image-maintenance validation has no authorization to deploy Lambda services.
+    - if: '$CI_COMMIT_BRANCH == "ericlim/internal-buildx-modern-docker-20261103" || $CI_MERGE_REQUEST_SOURCE_BRANCH_NAME == "ericlim/internal-buildx-modern-docker-20261103"'
+      when: never
     - if: '$SKIP_E2E_TESTS == "true"'
       when: never
     - when: on_success

From ef580828acb407a32d570413716d79acf1902391 Mon Sep 17 00:00:00 2001
From: Eric Lim <eric.lim@datadoghq.com>
Date: Fri, 13 Nov 2026 13:36:38 +0000
Subject: [PATCH 5/6] ci: pin Docker 27.3.1 to the image published from master

---
 ci/input_files/build.yaml.tpl | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/ci/input_files/build.yaml.tpl b/ci/input_files/build.yaml.tpl
index 74e5a6f21..2ef178f48 100644
--- a/ci/input_files/build.yaml.tpl
+++ b/ci/input_files/build.yaml.tpl
@@ -58,7 +58,7 @@ validate-python-ci-tools:
 build-layer ({{ $runtime.name }}-{{ $runtime.arch }}):
   stage: build
   tags: ["arch:amd64"]
-  image: registry.ddbuild.io/images/docker:v152537305-593bdcb-27.3.1@sha256:0d9ee7bf1fc4c02ca8a2ad6c14b421ef89fa90d63b832ad4515f5fabdd6b0200
+  image: registry.ddbuild.io/images/docker:27.3.1@sha256:66bf4f361622deb610f186243ca16e779556c963d4d35d0545c8de65e94e356a
   artifacts:
     expire_in: 1 day # Unsigned zips expire in 1 day
     paths:
@@ -73,7 +73,7 @@ build-layer ({{ $runtime.name }}-{{ $runtime.arch }}):
 check-layer-size ({{ $runtime.name }}-{{ $runtime.arch }}):
   stage: test
   tags: ["arch:amd64"]
-  image: registry.ddbuild.io/images/docker:v152537305-593bdcb-27.3.1@sha256:0d9ee7bf1fc4c02ca8a2ad6c14b421ef89fa90d63b832ad4515f5fabdd6b0200
+  image: registry.ddbuild.io/images/docker:27.3.1@sha256:66bf4f361622deb610f186243ca16e779556c963d4d35d0545c8de65e94e356a
   needs:
     - build-layer ({{ $runtime.name }}-{{ $runtime.arch }})
   dependencies:
@@ -248,7 +248,7 @@ publish-pypi-package:
 layer bundle:
   stage: build
   tags: ["arch:amd64"]
-  image: registry.ddbuild.io/images/docker:v152537305-593bdcb-27.3.1@sha256:0d9ee7bf1fc4c02ca8a2ad6c14b421ef89fa90d63b832ad4515f5fabdd6b0200
+  image: registry.ddbuild.io/images/docker:27.3.1@sha256:66bf4f361622deb610f186243ca16e779556c963d4d35d0545c8de65e94e356a
   needs:
     {{ range (ds "runtimes").runtimes }}
     - build-layer ({{ .name }}-{{ .arch }})

From 61558e200ff4d4ecaad15caa36812adbed9aa52a Mon Sep 17 00:00:00 2001
From: Eric Lim <eric.lim@datadoghq.com>
Date: Fri, 13 Nov 2026 15:46:45 +0000
Subject: [PATCH 6/6] ci: follow maintained shared image tags

---
 ci/input_files/build.yaml.tpl | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/ci/input_files/build.yaml.tpl b/ci/input_files/build.yaml.tpl
index 2ef178f48..3f35b13f2 100644
--- a/ci/input_files/build.yaml.tpl
+++ b/ci/input_files/build.yaml.tpl
@@ -37,14 +37,14 @@ default:
 validate-python-ci-tools:
   stage: test
   tags: ["arch:amd64"]
-  image: registry.ddbuild.io/images/docker:v152556028-36457c2-29.4.0-noble-py3@sha256:87eb41a1ee25cec0470ba98ecee89fb67ce4bf935f06129b00e29d496720ead4
+  image: registry.ddbuild.io/images/docker:29.4.0-noble-py3
   before_script:
     - *install-python-tools
   script:
     - aws --version
     - python --version
     - python -m pip --version
-    - docker buildx version | grep -F "github.com/docker/buildx v0.38.2-dd.3 "
+    - docker buildx version
 
 {{ range $runtime := (ds "runtimes").runtimes }}
 
@@ -58,7 +58,7 @@ validate-python-ci-tools:
 build-layer ({{ $runtime.name }}-{{ $runtime.arch }}):
   stage: build
   tags: ["arch:amd64"]
-  image: registry.ddbuild.io/images/docker:27.3.1@sha256:66bf4f361622deb610f186243ca16e779556c963d4d35d0545c8de65e94e356a
+  image: registry.ddbuild.io/images/docker:27.3.1
   artifacts:
     expire_in: 1 day # Unsigned zips expire in 1 day
     paths:
@@ -73,7 +73,7 @@ build-layer ({{ $runtime.name }}-{{ $runtime.arch }}):
 check-layer-size ({{ $runtime.name }}-{{ $runtime.arch }}):
   stage: test
   tags: ["arch:amd64"]
-  image: registry.ddbuild.io/images/docker:27.3.1@sha256:66bf4f361622deb610f186243ca16e779556c963d4d35d0545c8de65e94e356a
+  image: registry.ddbuild.io/images/docker:27.3.1
   needs:
     - build-layer ({{ $runtime.name }}-{{ $runtime.arch }})
   dependencies:
@@ -119,7 +119,7 @@ unit-test ({{ $runtime.name }}-{{ $runtime.arch }}):
 integration-test ({{ $runtime.name }}-{{ $runtime.arch }}):
   stage: test
   tags: ["arch:amd64"]
-  image: registry.ddbuild.io/images/docker:v152556028-36457c2-29.4.0-noble-py3@sha256:87eb41a1ee25cec0470ba98ecee89fb67ce4bf935f06129b00e29d496720ead4
+  image: registry.ddbuild.io/images/docker:29.4.0-noble-py3
   rules:
     # Image-maintenance validation has no authorization to deploy Lambda services.
     - if: '$CI_COMMIT_BRANCH == "ericlim/internal-buildx-modern-docker-20261103" || $CI_MERGE_REQUEST_SOURCE_BRANCH_NAME == "ericlim/internal-buildx-modern-docker-20261103"'
@@ -148,7 +148,7 @@ integration-test ({{ $runtime.name }}-{{ $runtime.arch }}):
 sign-layer ({{ $runtime.name }}-{{ $runtime.arch }}):
   stage: sign
   tags: ["arch:amd64"]
-  image: registry.ddbuild.io/images/docker:v152556028-36457c2-29.4.0-noble-py3@sha256:87eb41a1ee25cec0470ba98ecee89fb67ce4bf935f06129b00e29d496720ead4
+  image: registry.ddbuild.io/images/docker:29.4.0-noble-py3
   rules:
     - if: '$CI_COMMIT_TAG =~ /^v.*/'
       when: manual
@@ -180,7 +180,7 @@ sign-layer ({{ $runtime.name }}-{{ $runtime.arch }}):
 publish-layer-{{ $environment_name }} ({{ $runtime.name }}-{{ $runtime.arch }}):
   stage: publish
   tags: ["arch:amd64"]
-  image: registry.ddbuild.io/images/docker:v152556028-36457c2-29.4.0-noble-py3@sha256:87eb41a1ee25cec0470ba98ecee89fb67ce4bf935f06129b00e29d496720ead4
+  image: registry.ddbuild.io/images/docker:29.4.0-noble-py3
   rules:
     # Image-maintenance validation has no authorization to deploy Lambda services.
     - if: '$CI_COMMIT_BRANCH == "ericlim/internal-buildx-modern-docker-20261103" || $CI_MERGE_REQUEST_SOURCE_BRANCH_NAME == "ericlim/internal-buildx-modern-docker-20261103"'
@@ -231,7 +231,7 @@ publish-layer-{{ $environment_name }} ({{ $runtime.name }}-{{ $runtime.arch }}):
 publish-pypi-package:
   stage: publish
   tags: ["arch:amd64"]
-  image: registry.ddbuild.io/images/docker:v152556028-36457c2-29.4.0-noble-py3@sha256:87eb41a1ee25cec0470ba98ecee89fb67ce4bf935f06129b00e29d496720ead4
+  image: registry.ddbuild.io/images/docker:29.4.0-noble-py3
   before_script:
     - *install-python-tools
     - ./scripts/setup_python_env.sh
@@ -248,7 +248,7 @@ publish-pypi-package:
 layer bundle:
   stage: build
   tags: ["arch:amd64"]
-  image: registry.ddbuild.io/images/docker:27.3.1@sha256:66bf4f361622deb610f186243ca16e779556c963d4d35d0545c8de65e94e356a
+  image: registry.ddbuild.io/images/docker:27.3.1
   needs:
     {{ range (ds "runtimes").runtimes }}
     - build-layer ({{ .name }}-{{ .arch }})
@@ -269,7 +269,7 @@ layer bundle:
 
 signed layer bundle:
   stage: sign
-  image: registry.ddbuild.io/images/docker:v152556028-36457c2-29.4.0-noble-py3@sha256:87eb41a1ee25cec0470ba98ecee89fb67ce4bf935f06129b00e29d496720ead4
+  image: registry.ddbuild.io/images/docker:29.4.0-noble-py3
   tags: ["arch:amd64"]
   rules:
     - if: '$CI_COMMIT_TAG =~ /^v.*/'
@@ -320,7 +320,7 @@ e2e-test:
 
 e2e-test-status:
   stage: e2e
-  image: registry.ddbuild.io/images/docker:v152556028-36457c2-29.4.0-noble-py3@sha256:87eb41a1ee25cec0470ba98ecee89fb67ce4bf935f06129b00e29d496720ead4
+  image: registry.ddbuild.io/images/docker:29.4.0-noble-py3
   tags: ["arch:amd64"]
   timeout: 3h
   rules: