3 ms·

It's a feature docker refused to implement, and is one of the reasons Red Hat created podman, which is a drop in docker replacement (you can alias it to docker

It's a feature docker refused to implement, and is one of the reasons Red Hat created podman, which is a drop in docker replacement (you can alias it to docker for the most part), but it allows full control over what repos are checked. For docker, as I understand it to get something functionally similar you have to define a mirror for docker.io that's not really a mirror and then prefer that mirror and/or disallow traffic to docker.io in some fashion.

infogulch 5y ago
I've heard this argument a million times, but I really don't get it. If you want to control which images are deployed, you want to be running your own image registry anyway. So you already have full control: just limit images to ones in your private registry with its fully qualified name. Why do you also insist on being able to deploy with 'short' names? Arguably it's better because users can't confuse "enterprise customized ubuntu:20.04" with the public one and bother open source maintainers with internal issues.
- kbenson 5y ago
  Nobody is insisting on being able to deploy with short names (or at least not the people that actually care about this). They are insisting that someone screwing up and using a short name when they shouldn't doesn't go out to a third party that's not explicitly trusted. Making this about short names is completely missing the point. Requiring docker to be run with a "mirror" which isn't actually a mirror of docker.io and making it use your non-mirror mirror so docker.io can't be reached and everything still works is just a hacky way to trick docker into working in what many people think is a very valid way - where no external resources can be used as a container not just as a matter of policy, but as a matter of capability. Put simply, it's not about replacing the default repo, it's about excluding all external repos. Requiring they all use long names would be a perfectly acceptable trade off for most orgs I think, if that was an option offered.
  - infogulch 5y ago
    Ah thanks for clarifying. I think this issue gets muddled by people who do want to override the default repo to get short names, to which I roll my eyes. But it seems there is a real issue in that this: > just limit images to ones in your private registry ... is actually not possible for a basic docker install. (Every time I use the word "just" it turns on me, and this is not an exception.) There are some implementations that have this feature (k8s, podman, etc), but the fact that it's not possible in the industry default container solution is an issue.

infogulch 5y ago

I've heard this argument a million times, but I really don't get it. If you want to control which images are deployed, you want to be running your own image registry anyway. So you already have full control: just limit images to ones in your private registry with its fully qualified name. Why do you also insist on being able to deploy with 'short' names? Arguably it's better because users can't confuse "enterprise customized ubuntu:20.04" with the public one and bother open source maintainers with internal issues.

kbenson 5y ago
Nobody is insisting on being able to deploy with short names (or at least not the people that actually care about this). They are insisting that someone screwing up and using a short name when they shouldn't doesn't go out to a third party that's not explicitly trusted. Making this about short names is completely missing the point. Requiring docker to be run with a "mirror" which isn't actually a mirror of docker.io and making it use your non-mirror mirror so docker.io can't be reached and everything still works is just a hacky way to trick docker into working in what many people think is a very valid way - where no external resources can be used as a container not just as a matter of policy, but as a matter of capability. Put simply, it's not about replacing the default repo, it's about excluding all external repos. Requiring they all use long names would be a perfectly acceptable trade off for most orgs I think, if that was an option offered.
- infogulch 5y ago
  Ah thanks for clarifying. I think this issue gets muddled by people who do want to override the default repo to get short names, to which I roll my eyes. But it seems there is a real issue in that this: > just limit images to ones in your private registry ... is actually not possible for a basic docker install. (Every time I use the word "just" it turns on me, and this is not an exception.) There are some implementations that have this feature (k8s, podman, etc), but the fact that it's not possible in the industry default container solution is an issue.