4 ms·
Good time to point out that if you’re depending on public docker images, use the SHA reference. Named tags are mutable and you can’t depend on your layer cache
by ljm 7y ago
Good time to point out that if you’re depending on public docker images, use the SHA reference. Named tags are mutable and you can’t depend on your layer cache for stability. Any and all of that can change under your nose on a new build and you won’t know how to debug it without wasting a few hours sourcing the bug. The SHA protects you from that because there can only be one version of it.
(e.g I’ve had a few where a ruby image switched from Debian 9 to Debian 10, on most of the labels. It broke a lot of stuff and you just had to guess that they kept the old version on its own label, because Docker Hub didn’t say anything about it.)
- urda 7y agoI haven't done a ton of Docker DevOps at scale, but shouldn't teams be pulling images, vetting, and then hosting on their own hub?
- markovbot 7y agoThat'd probably be ideal but in reality most people don't do that.
- taberiand 7y agoWorse, I've had people scoff at the idea.
- jedieaston 7y agoAnd then things like the Docker Hub outage this week happen and people wonder why their pipelines grind to a halt.
- johnchristopher 7y agoHow hard is it to set up your own hub for private use ?
- jedieaston 7y agobasically a docker run, but if you need it in production, there's a couple other things you need to do. https://docs.docker.com/registry/configuration/ https://docs.docker.com/registry/configuration/
- eneveu 7y agoIt's easy. You can host a Docker registry yourself (e.g. Harbor or Portus), or use a managed one, like Google Cloud Registry if you use GCP / GKE. To publish an image to your own registry, you just need to pull from Docker Hub, re-tag the image, and push to your own repo. It's three commands. You can add some automated and/or manual steps to check the images for security flaws before publishing them.
- ljm 7y agocan you imagine a team volunteering for that? Nah, they’ll hope for the best from the public registry. The way people tackle their dependencies inside docker is utterly irresponsible.
- de_watcher 7y agoThey are supposed to. But as far as I remember among the bad practices perpetrated by the Docker developers there is even an unshakeable stance against adding an option to the mainline Docker so it doesn't try to connect to DockerHub when searching for the image to download.