4 ms·

What's the difference between this and say: FROM ubuntu:16.04 Won't that pull the latest official Ubuntu image with that tag?

dlor 8y ago
There are a few reasons you might want to use our version of these images: - If you're running on GCP, pulling images from GCR will likely be much faster than Dockerhub given network locality. - Content Trust. DockerHub images are maintained by a large team of upstream maintainers and volunteers. These images are fully managed by Google, and you can examine and audit the full supply chain from source to built image.
- andrey_utkin 8y ago
  I think you're listing wrong reasons to prefer Google's images, while there are some right reasons. * Faster fetch - not a big deal IMO (edit: you could just mirror, you don't have to do the patching) * Content trust - but trust to e.g. Canonical's Ubuntu is required anyway, right? And then, you have to trust Google. Examples of reasons I would take as good: * Does Google routinely do audit of original distro images, so that it's less of a risk to use community distro like Debian? It could. * Is Google "manning" the work on the actual distributed software, accepting users' bugreports and then working with upstream to fix it? It could. Even-more-downstream-distro is actually not a bad idea.
- cpuguy83 8y ago
  The upstream images are also validated from source to built image, and constantly scanned for vulnerabilities. At best such a comment is completely ignorant of the existing ecosystem.
  - cpuguy83 8y ago
    Disclosure: I work at Microsoft on Azure, previously at Docker on the core engine.
- cpuguy83 8y ago
  If you really wanted to contribute to the ecosystem you could have offered another vulnerability list to work against, work with upstream to deal with issues, and mirror the existing bits on GCR for your customers. --- edit add disclosure statement Disclosure: I work at Microsoft on Azure, previously at Docker on the core engine.
  - TheIronYuppie 8y ago
    There's nothing about this that excludes that work as well. But, there's nothing to say that the upstream distro would accept the changes. Google has more stringent requirements that a general distro, and you're choosing to follow those requirements (at the benefit of Google's automated scanning). It's totally your choice. Disclosure: I work at Microsoft on Azure.
    - cpuguy83 8y ago
      > But, there's nothing to say that the upstream distro would accept the changes If upstream didn't accept it, then it shouldn't be masquerading as what upstream is... which is what changing `FROM $image` to point to Google's image does. > and you're choosing to follow those requirements From what I gathered from the article, Google is changing the meaning of `FROM $image` to mean Google's build of the image. There is no choice in the matter outside of using Google's services. Disclosure (and sorry for not mentioning in the original comment, I've updated): I work at Microsoft on Azure, and formerly at Docker on the core engine.
      - dlor 8y ago
        Nothing is changing with FROM - not sure what gave you that impression. We're simply offering some new base images people can choose to use if they want to. These also happen to be the ones that have been in use by some of our "more serverless" offerings, where users don't get to supply a Dockerfile, for some time now.
        cpuguy83 8y ago

dlor 8y ago

There are a few reasons you might want to use our version of these images: - If you're running on GCP, pulling images from GCR will likely be much faster than Dockerhub given network locality. - Content Trust. DockerHub images are maintained by a large team of upstream maintainers and volunteers. These images are fully managed by Google, and you can examine and audit the full supply chain from source to built image.

andrey_utkin 8y ago
I think you're listing wrong reasons to prefer Google's images, while there are some right reasons. * Faster fetch - not a big deal IMO (edit: you could just mirror, you don't have to do the patching) * Content trust - but trust to e.g. Canonical's Ubuntu is required anyway, right? And then, you have to trust Google. Examples of reasons I would take as good: * Does Google routinely do audit of original distro images, so that it's less of a risk to use community distro like Debian? It could. * Is Google "manning" the work on the actual distributed software, accepting users' bugreports and then working with upstream to fix it? It could. Even-more-downstream-distro is actually not a bad idea.
cpuguy83 8y ago
The upstream images are also validated from source to built image, and constantly scanned for vulnerabilities. At best such a comment is completely ignorant of the existing ecosystem.
- cpuguy83 8y ago
  Disclosure: I work at Microsoft on Azure, previously at Docker on the core engine.
cpuguy83 8y ago
If you really wanted to contribute to the ecosystem you could have offered another vulnerability list to work against, work with upstream to deal with issues, and mirror the existing bits on GCR for your customers. --- edit add disclosure statement Disclosure: I work at Microsoft on Azure, previously at Docker on the core engine.
- TheIronYuppie 8y ago
  There's nothing about this that excludes that work as well. But, there's nothing to say that the upstream distro would accept the changes. Google has more stringent requirements that a general distro, and you're choosing to follow those requirements (at the benefit of Google's automated scanning). It's totally your choice. Disclosure: I work at Microsoft on Azure.
  - cpuguy83 8y ago
    > But, there's nothing to say that the upstream distro would accept the changes If upstream didn't accept it, then it shouldn't be masquerading as what upstream is... which is what changing `FROM $image` to point to Google's image does. > and you're choosing to follow those requirements From what I gathered from the article, Google is changing the meaning of `FROM $image` to mean Google's build of the image. There is no choice in the matter outside of using Google's services. Disclosure (and sorry for not mentioning in the original comment, I've updated): I work at Microsoft on Azure, and formerly at Docker on the core engine.
    - dlor 8y ago
      Nothing is changing with FROM - not sure what gave you that impression. We're simply offering some new base images people can choose to use if they want to. These also happen to be the ones that have been in use by some of our "more serverless" offerings, where users don't get to supply a Dockerfile, for some time now.
      - cpuguy83 8y ago