4 ms·
From the original article > This brings up an interesting side point, in that Docker Hub and most other registries allow mutable tags by default. So nginx:1.21
by delusional 5y ago
From the original article
> This brings up an interesting side point, in that Docker Hub and most other registries allow mutable tags by default. So nginx:1.21.6 might not be the same image today as it was yesterday. In reality, you probably need a mechanism to enforce tag immutability: e.g., your own registry mirror, or referring to images by SHA)
- keymone 5y agoyeah, well, i stopped reading when i saw that "GOOD" example. it's not. and that isn't a "side point", that's the most critical point for preserving security and reproducibility of builds.
- delusional 5y agoIt's literally the line that follows that example. Why do you think it's useful to comment when you haven't even read the topic of discussion. You're like a person not reading the book at a voluntary book club. If you don't want to read it, just don't show up.
- keymone 5y agoi suggest you to read my comment again, because so far what you've said applies to you more than to me.
- zufallsheld 5y agoWell then you'd vendor your docker images anyway and not pull them from the internet, right?
- keymone 5y agoSure, and many do that, but you don't have to if you refer by digest of image's contents.