4 ms·
# GOOD: image: "nginx:1.21.6" nothing "good" about it, literally no different from ":latest". only full hash reference.
by keymone 5y ago
# GOOD:
image: "nginx:1.21.6"
nothing "good" about it, literally no different from ":latest".
only full hash reference.
- fuzzy2 5y agoSure version tags could also move, but by convention they do not. Unlike the latest tag, which by convention does move a lot.
- isbvhodnvemrwvn 5y agoBy convention npm packages are not deleted or hijacked.
- fuzzy2 5y agoYou do realize that NPM package versions already are immutable? Dunno since when though. Deletion is possible within limits but it also is with Docker. All the hashes in the world won't bring back a deleted image.
- keymone 5y agoversion numbers are never immutable. they are arbitrary labels that are created by some centralized authority and can be changed by that same authority. artifacts being removed is much less of a problem as artifacts being spoofed with malicious content.
- isbvhodnvemrwvn 5y agoThey were made immutable after the issue was already widespread. Which is also why I'd heavily encourage to use hashes to pin container versions, even though people might not see the immediate need to do so.
- delusional 5y agoFrom the original article > This brings up an interesting side point, in that Docker Hub and most other registries allow mutable tags by default. So nginx:1.21.6 might not be the same image today as it was yesterday. In reality, you probably need a mechanism to enforce tag immutability: e.g., your own registry mirror, or referring to images by SHA)
- keymone 5y agoyeah, well, i stopped reading when i saw that "GOOD" example. it's not. and that isn't a "side point", that's the most critical point for preserving security and reproducibility of builds.
- delusional 5y agoIt's literally the line that follows that example. Why do you think it's useful to comment when you haven't even read the topic of discussion. You're like a person not reading the book at a voluntary book club. If you don't want to read it, just don't show up.
- keymone 5y agoi suggest you to read my comment again, because so far what you've said applies to you more than to me.
- zufallsheld 5y agoWell then you'd vendor your docker images anyway and not pull them from the internet, right?
- keymone 5y agoSure, and many do that, but you don't have to if you refer by digest of image's contents.
- hughrr 5y agoStuff like this makes me miss pinned RPM packages.