search

rocky-linux / sig-cloud-instance-images

47 stars 7 forks source link

Unique tag for docker images #3

Closed aminvakil closed 2 years ago

aminvakil commented 3 years ago

It's good to have a unique tag for docker images, so that users can be confident if they use an image as base image or use it in their pipelines, that would be the same no matter what would happen.

Also per discussions in IRC, @NeilHanlon suggests they would probably like to push to 8.4 for example when there is a huge security bug.

So what I propose is have it both ways, 8.4 always points to latest 8.4 image, but users can choose 8.20210621 or something like that if they want to.

indigo423 commented 3 years ago

Just some thoughts here. I totally would love to see unique immutable tags. As a user, I can control the update path and have a deterministic set of container images running in CI/CD or production pipelines. The CI/CD job which creates the tar.xz seems to be a good source defining the tag. The tagging depends also a bit on the version numbering scheme Rocky Linux is aiming for. If it doesn't matter for the users if you have 8.4 or 8.5 then it could make sense to suffix just the major version 8.<yyyymmdd> and follow a similar way as other distros do, .e.g Debian or Ubuntu. I can't really answer this one here but from a users perspective, if there is a need to make me aware of a difference between 8.4 and 8.5, then the minor version number can make sense to take into account as 8.4.<yyyymmdd> and 8.5.<yyyymmdd>.

Thanks a lot for the effort!

andrewmiskell commented 2 years ago

Bitnami implements a pretty good process for this as they rebuild their containers almost daily in order to keep the base OS updated and patched but still allow users to lock to a specific release to ensure they get the same image every time.

https://docs.bitnami.com/tutorials/understand-rolling-tags-containers/

ibaldonl commented 2 years ago

Now if you use the "8" tag then it's updated monthly or when new security issues arise and if you use the "8.5" tag then it's the first released version of it and doesn't change. So I think all use cases are covered now, maybe this issue could be closed?

NeilHanlon commented 2 years ago

Indeed. Thanks everyone for your patience. We'll have some more automation coming for these images in the next few months before Rocky 9 and 8.6 drop