Closed hanneskaeufler closed 3 weeks ago
We use crane in oci_push
rule which might explain better why this permission is needed. My instinct says that this permission is justified as oci_push is idempotent therefore needs to do some probing to determine if the image exists.
Going to close as there is nothing for us to fix here.
Using
oci_push
like so:and running on CI
yields
This was not needed with
rules_docker
. Is that a bug or expected? Obviously I'd like my permissions to be as tight as can be.