Trusted build about baseimage-docker HOT 6 CLOSED

We've received some requests but I haven't given it a lot of attention so far because our current build process works, and because the inability to delete trusted builds makes me a bit wary of playing with them to see how they work.

The biggest issue I have right now with trusted builds is whether they can support our strict versioning and tagging policy. Each release has its own version and tag. "latest" always refers to the latest version. We discourage people from using ":latest" though. Can trusted builds handle our versioning/tagging policy?

from baseimage-docker.

Disclaimer: I'm not that much used to create trusted builds repo, as I just started to play with them recently.

If you can't delete builds, you can delete repositories (even for trusted builds), So I think it's ok to have a sandbox repository to test that.

Creating a trusted build from phusion/baseimage-docker doesn't require to change anything in the files: just to create the docker trusted build repo by provinding few informations:

• branch name
• github repo
• tag (default: latest)
• Dockerfile location inside github repo
• whether or not a commit on github build automatically a new docker index trusted build.

But indeed, I didn't find an official way to tag each build with a new version. There is a way to trigger a build by posting on a specific url using a simple token as authentication, but it doesn't seems that url accept a tag name (while this would be the best way to provide it I suppose).

There would be a way to do it from script, because you can update the "global tag" used for your repo on a page, so you could change the tag name with a curl call, and then trigger manually a build with another curl call. putting thoses curl calls in the Make would make it work somehow, but you would be requested credentials anyway in order to login on the index web site anyway.

So it's possible in a way, but not elegant.

from baseimage-docker.

If I have to jump through those hoops, it makes me wonder what the added value of trusted builds is. In theory, people would have the guarantee that we didn't add anything to the images that aren't in the public sources, but that just means the trust is simply shifted from us to Docker inc. What prevents them from adding something to the images that we didn't authorize? You can argue that their name is at stake, but so is ours. People are already trusting that our sources don't contain malware.

from baseimage-docker.

Can trusted builds handle our versioning/tagging policy?

As an update to this conversation, the Docker Registry has recently implemented the ability to link trusted builds to either particular github branches or tags. This means no hoops to jump through: just point the registry to your branch/tag and automatically have it rebuild the image when you update the repository code.

from baseimage-docker.

Hi , I done writing a trusted builds for the this baseimage
https://registry.hub.docker.com/u/angelrr7702/docker-baseimage/
https://github.com/QuantumObject/docker-baseimage

At the moment I remove ssh and vim at it ... I keep a copy of the original license of phusion/baseimage/ and for documentation I make reference to the original:

https://github.com/phusion/baseimage-docker

from baseimage-docker.

Trusted builds have been replaced with automated builds: https://docs.docker.com/docker-hub/builds/#add-and-run-a-new-build

from baseimage-docker.