dotnet / sdk-container-builds

Libraries and build tooling to create container images from .NET projects using MSBuild
https://learn.microsoft.com/en-us/dotnet/core/docker/publish-as-container
MIT License
179 stars 37 forks source link

Provide a way to force pulling manifests and layers even if they are already cached #114

Open baronfel opened 2 years ago

baronfel commented 2 years ago

docker build has a --pull flag that forces reacquisition of manifests and layers - we should enable this behavior as well. The content store is fine for the default case but sometimes you really need a clean analogue.

My initial thoughts are twofold:

and document both of these.

Cellivar commented 2 years ago

Some additional food for thought on forcing a pull.

My company is dealing with some regulatory and security requirements around ensuring our software is patched. Part of this includes ensuring our Docker images are built on images that contain the latest patches.

We've found there are situations where tags like latest or 6.0 can be interpreted by various caching layers differently, and builds that should be up to date end up with an older cached version. Apparently this is not an easy problem to solve, and most solutions tend to rely on cooperating cache layers. We have hundreds of docker-based services running in production. Fully automating the cycle of ensuring they're all running relatively recent images is mandatory.

Having a way to ensure (I use this word deliberately) the image layers we're getting are the up-to-date ones we expect, possibly by comparing against another MSBuild value, would be beneficial to our workflows.

This seemed like the most relevant issue to raise this in though it's drifting a bit from just cache busting, if there's a better place to write this up let me know 😊