makefiles/docker.inc.mk: Pin riotbuild version with BUILD_IN_DOCKER=1

We had a number of issues being reported that in the end were caused
by building with a version of riotbuild incompatible with the source.

This commits adds a check that the used image is in the listed of
known to work versions, unless `DOCKER_IMAGE` is not the default.
Users overwriting `DOCKER_IMAGE` are expected to know what they are
doing.

makefiles/docker.inc.mk

@@ -1,4 +1,5 @@
-export DOCKER_IMAGE ?= docker.io/riot/riotbuild:latest
+DOCKER_IMAGE_DEFAULT := docker.io/riot/riotbuild:latest
+export DOCKER_IMAGE ?= $(DOCKER_IMAGE_DEFAULT)
 export DOCKER_BUILD_ROOT ?= /data/riotbuild
 DOCKER_RIOTBASE ?= $(DOCKER_BUILD_ROOT)/riotbase
 # List of Docker-enabled make goals
@@ -11,6 +12,19 @@ export DOCKER_MAKECMDGOALS_POSSIBLE = \
   #
 export DOCKER_MAKECMDGOALS = $(filter $(DOCKER_MAKECMDGOALS_POSSIBLE),$(MAKECMDGOALS))
 
+COMPATIBLE_RIOTBUILD_VERSIONS := \
+	b6af289bf59df73766d685d0df8b8aa98d4fd07b19457699a8a946d204a3405d \
+	#
+
+ifeq (1,$(BUILD_IN_DOCKER))
+  ifeq ($(DOCKER_IMAGE),$(DOCKER_IMAGE_DEFAULT))
+    DOCKER_IMAGE_VERSION := $(shell $(DOCKER) image inspect --format "{{.Id}}" $(DOCKER_IMAGE))
+    ifeq (,$(filter $(DOCKER_IMAGE_VERSION),$(COMPATIBLE_RIOTBUILD_VERSIONS)))
+      $(error The container $(DOCKER_IMAGE) in version $(DOCKER_IMAGE_VERSION) is not compatbile with this version of RIOT. Try running "$(DOCKER) pull $(DOCKER_IMAGE)")
+    endif
+  endif
+endif
+
 # Docker creates the files .dockerinit and .dockerenv in the root directory of
 # the container, we check for the files to determine if we are inside a container.
 ifneq (,$(wildcard /.dockerinit /.dockerenv))