3 ms·
The point is to link the docker image to the git commit, that just identifies the image by the image's own hash. Not the same thing.
by infogulch 5y ago
The point is to link the docker image to the git commit, that just identifies the image by the image's own hash. Not the same thing.
- jhugo 5y agoI'm not the parent commenter, but I'm sure they know that. I think their point is that the image which a tag refers to can be changed in the repository, so if you're concerned someone might generate a Git commit with a colliding hash and produce another build with the same hash, there is in fact a much simpler attack scenario: replace the container image in the repository with any different image with the same tag. The syntax they provided identifies the image by its own hash, so producing a different image with the same hash is _much_ more difficult.