4 ms·

Maybe I missed it in the article, but a big (maybe bigger?) problem is that all packages are directly sourced from upstream. Tags can be mutated in most (not a

Maybe I missed it in the article, but a big (maybe bigger?) problem is that all packages are directly sourced from upstream. Tags can be mutated in most (not all) container registries. A tag that you have vetted today could change without your knowledge. Helm chart versions can also be overwritten. Ideally, everything should be pulled from repositories you control.

jacques_chester 6y ago
I've been writing a book and I devoted several pages to the notion that you should always, always, use fully-digested container image references. Which reminds me: never don't do that. Always use fully-digested references. Don't fail to use fully-digested references.
- microbass 6y ago
  Could you please expand, with an example, if possible?
  - jacques_chester 6y ago
    Manning allows folks a time-limited preview of their books (I think it's ten minutes per day?). The relevant section is here: https://livebook.manning.com/book/knative-in-action/chapter-9/v-6/11 https://livebook.manning.com/book/knative-in-action/chapter-... The gist is that tags are mutable and deletable. Local caching means that every node can disagree on what the tag resolves to, and so can the registry. What version corresponds to which tag at which location at a given time is not deterministic. The only way out is to use fully-digested references. The digest means that there can be no mutation of what's being pointed to. It will mean the same in every configuration and on every node, no matter when the reference is resolved and no matter when the reference was created.
    - orf 6y ago
      It also means every layer has to be kept indefinitely, forever. Tags at the very least are pointers that stop indefinite and exponential storage growth.
      - jacques_chester 6y ago
        Tags don't help exponential growth, because you cannot reliably reason from a tag-only reference back to the exact assets it represents. That's feasible with fully-digested references.

jacques_chester 6y ago

I've been writing a book and I devoted several pages to the notion that you should always, always, use fully-digested container image references. Which reminds me: never don't do that. Always use fully-digested references. Don't fail to use fully-digested references.

microbass 6y ago
Could you please expand, with an example, if possible?
- jacques_chester 6y ago
  Manning allows folks a time-limited preview of their books (I think it's ten minutes per day?). The relevant section is here: https://livebook.manning.com/book/knative-in-action/chapter-9/v-6/11 https://livebook.manning.com/book/knative-in-action/chapter-... The gist is that tags are mutable and deletable. Local caching means that every node can disagree on what the tag resolves to, and so can the registry. What version corresponds to which tag at which location at a given time is not deterministic. The only way out is to use fully-digested references. The digest means that there can be no mutation of what's being pointed to. It will mean the same in every configuration and on every node, no matter when the reference is resolved and no matter when the reference was created.
  - orf 6y ago
    It also means every layer has to be kept indefinitely, forever. Tags at the very least are pointers that stop indefinite and exponential storage growth.
    - jacques_chester 6y ago
      Tags don't help exponential growth, because you cannot reliably reason from a tag-only reference back to the exact assets it represents. That's feasible with fully-digested references.