4 ms·

I'm not sure what you're trying to say exactly, but I'm pretty sure that this already exist and there are multiple solutions and self-hosted registries as well

• tarjei 8y ago
  I'm not talking about private hosting of containers, I'm talking about an alternative to today's public registry of container images that is 100% verifiable so that when something like this happens it is possible to be certain that no one has tampered with any of the container images.
  • 6nf 8y ago
    You mean something like posting signed hashes in a public place? So you can verify what you got is what you want?
  • icebraining 8y ago
    You can only have 100% verifiable container images if the Dockerfiles uploaded by users are reproducible (in the sense of https://reproducible-builds.org/ https://reproducible-builds.org/). The vast majority probably aren't, and I'm not sure the Hub could reliably detect those that are.
  • ericpauley 8y ago
    Do you mean formal verification? Verifying such a vast web service may be nearly impossible, especially since you'd still have to rely on a database server, os, and kernel, the most popular of which are seemingly fundamentally incompatible with verification.
  • techntoke 8y ago
    This is what the Notary portion of Harbor does: https://github.com/goharbor/harbor/blob/master/docs/use_notary.md https://github.com/goharbor/harbor/blob/master/docs/use_nota... https://docs.docker.com/notary/getting_started/ https://docs.docker.com/notary/getting_started/