Open gaius-qi opened 4 months ago
Update: Adopter interviews 2/5 complete cc: @nikhita
Currently undergoing joint-assessment with TAG Security.
Continuing to wait for joint-assessment to complete with TAG Security before resuming Due Diligence. cc: @nikhita
Dragonfly Graduation Application
Project Repo(s): https://github.com/dragonflyoss/Dragonfly2, https://github.com/dragonflyoss/Dragonfly and other repos under https://github.com/dragonflyoss. Project Site: https://d7y.io/ Sub-Projects: nydus, nydus-snapshotter, api, console, monitoring, client. Communication: Slack, Meetings, Mailing List(dragonfly-discuss@googlegroups.com), DingTalk(23304666).
Project points of contacts:
#dragonfly
channel on CNCF SlackGraduation Criteria Summary for Dragonfly
Adoption Assertion
The project has been adopted by the following organizations in a testing and integration or production capacity:
Criteria
Application Process Principles
Suggested
N/A
Required
All the subproject are list in the repos.
- [x] **If the project has subprojects: subproject leadership, contribution, maturity status documented, including add/remove process.** Mentioned at the beginning of our governance docs: This doc outlines the responsibilities of contributor roles in Dragonfly. The Dragonfly project is subdivided into sub-projects under (predominantly, but not exclusively) nydus, nydus-snapshotter, api, docs, console and client. Responsibilities for roles are scoped to these sub-projects (repos). ## Contributors and Community Note: this section may be augmented by the completion of a Governance Review from TAG Contributor Strategy. ### Suggested - [x] **Contributor ladder with multiple roles for contributors.** Documented in https://github.com/dragonflyoss/Dragonfly2/blob/main/GOVERNANCE.md. ### Required - [x] **Clearly defined and discoverable process to submit issues or changes.** Documented in https://github.com/dragonflyoss/Dragonfly2/blob/main/CONTRIBUTING.md. - [x] **Project must have, and document, at least one public communications channel for users and/or contributors.** We have several, listed at the top of this issue. - [x] **List and document all project communication channels, including subprojects (mail list/slack/etc.). List any non-public communications channels and what their special purpose is.** All listed [here](https://github.com/dragonflyoss/Dragonfly2#community). - [x] **Up-to-date public meeting schedulers and/or integration with CNCF calendar.** Public Dragonfly community meetings are listed in the [CNCF calendar](https://www.cncf.io/calendar/). Tracing in the [community](https://github.com/dragonflyoss/community). - [x] **Documentation of how to contribute, with increasing detail as the project matures.** Documented in https://github.com/dragonflyoss/Dragonfly2/blob/main/CONTRIBUTING.md. - [x] **Demonstrate contributor activity and recruitment.** We would like to thank teams who have made outstanding contributions, such as https://github.com/dragonflyoss/Dragonfly2/releases/tag/v2.0.9. ## Engineering Principles - [x] **Document project goals and objectives that illustrate the project’s differentiation in the Cloud Native landscape as well as outlines how this project fulfills an outstanding need and/or solves a problem differently.** Landing Page in [d7y.io](https://d7y.io/): `Provide efficient, stable, secure file distribution and image acceleration based on p2p technology to be the best practice and standard solution in cloud native architectures.` Now Dragonfly is not only used in image acceleration, but also has many use cases in file distribution and AI model distribution. - [x] **Document what the project does, and why it does it - including viable cloud native use cases.** Documented in https://d7y.io/docs/next/. - [x] **Document and maintain a public roadmap or other forward looking planning document or tracking mechanism.** See the [Roadmap](https://d7y.io/docs/next/roadmap-v2.0/) list. We will update it once a year. - [x] **Roadmap change process is documented.** Documented in https://github.com/dragonflyoss/community/blob/master/ROADMAP.md. - [x] **Document overview of project architecture and software design that demonstrates viable cloud native use cases, as part of the project's documentation.** Documented in https://d7y.io/docs/next/. - [x] **Document the project's release process and guidelines publicly in a RELEASES.md or equivalent file that defines:** - [x] Release expectations (scheduled or based on feature implementation) - [x] Tagging as stable, unstable, and security related releases - [x] Information on branch and tag strategies - [x] Branch and platform support and length of support - [x] Artifacts included in the release. - Additional information on topics such as LTS and edge releases are optional. Release expectations are a social contract between the project and its end users and hence changes to these should be well thought out, discussed, socialized and as necessary agreed upon by project leadership before getting rolled out. Documented in https://github.com/dragonflyoss/community/blob/master/RELEASE.md. - [x] **History of regular, quality releases.** Dragonfly publishs the release in https://github.com/dragonflyoss/Dragonfly2/releases. And we will release to the cncf blogs, refer to https://www.cncf.io/blog/2023/08/07/dragonfly-v2-1-0-is-released/. ## Security Note: this section may be augemented by a joint-assessment performed by TAG Security. ### Suggested - [ ] **Achieving OpenSSF Best Practices silver or gold badge.** We'll look into this down the road but it's not an immediate priority for us. ### Required - [x] **Clearly defined and discoverable process to report security issues.** [SECURITY.md](https://github.com/dragonflyoss/Dragonfly2/blob/main/SECURITY.md) stores in the repo. - [x] **Enforcing Access Control Rules to secure the code base against attacks (Example: two factor authentication enforcement, and/or use of ACL tools.)** 2FA required for GitHub org members. - [x] **Document assignment of security response roles and how reports are handled.** Documented in [Security Policy](https://github.com/dragonflyoss/Dragonfly2/blob/main/SECURITY.md#security-policy). - [x] **Document Security Self-Assessment.** Documented in [Security Self-Assessment](https://github.com/cncf/tag-security/pull/1326). We intend to merge the PR to TAG Security repository. - [x] **Third Party Security Review.** - [x] Moderate and low findings from the Third Party Security Review are planned/tracked for resolution as well as overall thematic findings, such as: improving project contribution guide providing a PR review guide to look for memory leaks and other vulnerabilities the project may be susceptible to by design or language choice ensuring adequate test coverage on all PRs. A third party security audit was performed by Trail of Bits, you can see the full report [here](https://github.com/dragonflyoss/Dragonfly2/blob/main/docs/security/dragonfly-comprehensive-report-2023.pdf). - [x] **Achieve the Open Source Security Foundation (OpenSSF) Best Practices passing badge.** https://www.bestpractices.dev/zh-CN/projects/7103 ## Ecosystem ### Suggested N/A ### Required - [x] **Publicly documented list of adopters, which may indicate their adoption level (dev/trialing, prod, etc.)** This list shows non-exhaustive [adopters](https://github.com/dragonflyoss/Dragonfly2/blob/main/ADOPTERS.md) of dragonfly. - [x] **Used in appropriate capacity by at least 3 independent + indirect/direct adopters, (these are not required to be in the publicly documented list of adopters)** We have more than 3 adopters, and with the rapid development of the AI ecosystem, Dragonfly is also being used as a model distribution service by more AI companies. The project provided the TOC with a list of adopters for verification of use of the project at the level expected, i.e. production use for graduation, dev/test for incubation. - [ ] **TOC verification of adopters.** Refer to the Adoption portion of this document. - [x] **Clearly documented integrations and/or compatibility with other CNCF projects as well as non-CNCF projects.** Dragonfly integrates with many CNCF projects: - [harbor](https://d7y.io/docs/next/operations/integrations/harbor/) preheats image by dragonfly. - [containerd](https://d7y.io/docs/next/operations/integrations/container-runtime/containerd/) distributes image by dragonfly. - [cri-o](https://d7y.io/docs/next/operations/integrations/container-runtime/cri-o/) distributes image by dragonfly. - [prometheus](https://d7y.io/docs/next/operations/best-practices/observability/monitoring/) to collect metrics. - [artifacthub](https://artifacthub.io/packages/helm/dragonfly/dragonfly) saves Dragonfly charts. - [gRPC](https://github.com/dragonflyoss/api) for high-performance remote procedure calls (RPC). - [Helm](https://d7y.io/docs/next/getting-started/installation/helm-charts/) used to deploy Dragonfly to Kubernetes. #### Adoption ##### Adopter 1 - DiDi/Service - used from 04/2023 _If the Adopting organization needs to remain anonymous, stating the industry vertical is sufficient._ MONTH YEAR ##### Adopter 2 - ByteDance/Internet - used from 09/2022 _If the Adopting organization needs to remain anonymous, stating the industry vertical is sufficient._ MONTH YEAR ##### Adopter 3 - Ant Group/Financial - used from 10/2018 _If the Adopting organization needs to remain anonymous, stating the industry vertical is sufficient._ MONTH YEAR ##### Adopter 4 - Kuaishou/Internet - used from 06/2019 _If the Adopting organization needs to remain anonymous, stating the industry vertical is sufficient._ MONTH YEAR ##### Adopter 5 - Alibaba/Internet - used from 10/2018 _If the Adopting organization needs to remain anonymous, stating the industry vertical is sufficient._ MONTH YEAR