5 ms·
Not a lot of people pull by hash; they pull by tag. Tags are not immutable, so the image I get from "python:3.11" today will almost certainly change due to secu
by mac-chaffee 4y ago
Not a lot of people pull by hash; they pull by tag. Tags are not immutable, so the image I get from "python:3.11" today will almost certainly change due to security updates and I will be none the wiser.
- adolph 4y agoI can see that. A human specifiable name is important. My proposal is that each time an image is pulled, the hash is recorded and retained even if the underlying container image is removed. When the same image is pulled again, if the files change from the previous hash, either fail or warn the user. I can see how pinning to a specific patch version is not a great idea and that "python:3.11" keeps people from pinning to an insecure version.