Open pveierland opened 5 months ago
Hi I'm a UT Austin student, and would like to work on this issue if possible!
Thanks for opening this ticket; I'm not sure if this is something that can be implemented in the docker engine itself. The OCI distribution specification (which is used for all registries, including docker hub) allows clients to upload images ("manifests"), but has no concept of "visibility"; https://github.com/opencontainers/distribution-spec/blob/v1.1.0/spec.md#pushing-manifests
Some registries disallow pushing to a repository that does not yet exist (in which case they produce an error), but Docker Hub defaults to creating the repository, using the default visibility settings as configured in the namespace; https://docs.docker.com/docker-hub/repos/create/
Description
docker push
allows pushing a new image to the docker hub. If a repo has not already been created and marked private, the repo will be created with public visibility. When changing configurations this makes it easy to leak repositories that were not intended to be public.Reproduce
docker push <image>
(with image intended to be private)Expected behavior
Docker CLI should support a
--visibility=private/public
flag or similar to prevent images from unintentionally being exposed publicly.docker version
docker info
Additional Info
No response