core: add --pull option to DockerBuldOptions to allow force pull of referenced images

[pechersky]

Describe the feature

We add a readonly alwaysPullReference?: boolean to the DockerBuildOptions interface, which is then used in the dockerArgs to add a --pull argument to the docker build command. This will allow users to run the docker build command which always tries to use the most recent referenced images.

Use Case

In the docker build step, we allow the user to turn caching off via cacheDisabled. When deploying a stack locally, I want to make sure that my referenced images in Dockerfiles in FROM some/remote:tag are up to date. The docker build --pull command does this by basically in-lining a docker pull some/remote:tag; docker build. This is more surgical than a --no-cache since --no-cache invalidates all layers. However, in the build --pull case, if the referenced image is up-to-date, all the existing layers are in sync; or if it is not, only the stages that rely on the now updated reference image will need new layers.

Proposed Solution

Add a line herehttps://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/core/lib/bundling.ts#L361:

..(options.alwaysPullReference ? ['--pull'] : []),

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

CDK version used

2.178.1

Environment details (OS name and version, etc.)

Ubuntu 20.04 (WSL)

[pahud]

Thanks for the feature request! This is a great suggestion that would provide more granular control over docker image pulling behavior during builds.

The proposed alwaysPullReference option makes sense because:

1. It's more efficient than --no-cache when you only want to ensure referenced base images are up-to-date
2. It follows existing docker CLI conventions with the --pull flag
3. It's backward compatible as an optional parameter

The implementation looks straightforward and clean. While it looks fine with me, I'm bringing it up to CDK team for further inputs.