search

argoproj / argo-cd

Declarative Continuous Deployment for Kubernetes
https://argo-cd.readthedocs.io
Apache License 2.0
17.94k stars 5.46k forks source link

Multiple latest tags existing #19318

Open T-Rehfisch-GD opened 3 months ago

T-Rehfisch-GD commented 3 months ago

Hello,

at the moment there are two "latest" tags existing for argocd. One in Dockerhub that is three years old (https://hub.docker.com/r/argoproj/argocd/tags?page=&page_size=&ordering=&name=latest) and one in Quay that was last modified today.

We are using an enterprise artifact repository for accessing any docker remote. In our configuration we have a virtual repository for read access where all our internal and external docker registries are part of. When pulling latest for argocd we get the three year old version as Dockerhub is configured before Quay in the search order of our virtual repository structure.

Nevertheless we could easily fix this by changing the search order and putting Quay before Dockerhub it is wrong from my point of view that the latest in Dockerhub still exists and therefore want to request to delete it there.

Best regards Torsten

ChristianCiach commented 3 months ago

I don't have an opinion about whether the latest tag from docker hub should be deleted. But I think you are living dangerously by assuming that the image repos (like argoproj/argocd) of two different registries (docker hub and quay) are "the same" in any way. There is nothing stopping me from registering a group name at quay that is already registered by someone else at docker hub (or vice versa) and push some malware to it. I think you really should always use the fully qualified repo reference (including the registry hostname) to reference your images.

crenshaw-dev commented 3 months ago

+1 to everything @ChristianCiach said.

@alexmt do you have access to delete the image from DockerHub?