4 ms·
Thank you for a very detailed write up. Here I am using shorthash for Docker image tags. I guess I will fix this asap.
by thangngoc89 2y ago
Thank you for a very detailed write up. Here I am using shorthash for Docker image tags. I guess I will fix this asap.
- demurgos 2y agoIdeally Docker would support a lockfile format so you don't have to manually manage the hashes. I'm still surprised how commonly people use named Docker tags when Docker Hub let's you mutate the corresponding image. In the meantime, the article is right that you should use the full-length digests for situations where you care about reproducibility.
- thangngoc89 2y agoAnytime you run apt install/apk install, your Docker image became unreproducible. I mainly use shorthash for easy manual inspection. The Dockerhub is set to clean up images older than 2 months so the risk if shorthash collision is very low (but not impossible)