Automated Docker images with sha256 tags

[sminot]

Expected Behavior

The ideal source for reproducible Docker images is a docker server that allows you to request images by sha256 hash. Quay provides that service with automated integration with GitHub.

Current Behavior

The only issue with the Docker image currently hosted on dockerhub is that users cannot pull based on sha256 hash, and so you cannot achieve the guaranteed reproducibility by knowing that two versions pulled down are 100% identical.

Solution

It is rather easy to set up a repository on Quay that automatically builds from a Dockerfile within a GitHub repo on each commit (or release). If you were to set that up once, then users could pull down a single canonical Docker image for each release of Plass. See the docs for more details.

[milot-mirdita]

I am not sure I understand what you mean with hash. You want to be able pull the docker image based on the git commit hash? We can also add that tag to Docker Hub. I am not sure I understand what Quay does better. I am a bit apprehensive about adding even more external services, since we already depend on quite a few (Travis, Codeship, Docker Hub, Appveyor for MMseqs2).

[sminot]

Tagging the docker image on the git commit hash should be perfect, actually. Thanks very much!

---

Samuel Minot, PhD Microbiome Research Initiative Fred Hutchinson Cancer Research Center sminot@fredhutch.orgmailto:sminot@fredhutch.org 206-667-2884 https://minot.bio

On Feb 11, 2019, at 2:03 AM, Milot Mirdita notifications@github.com<mailto:notifications@github.com> wrote:

I am not sure I understand what you mean with hash. You want to be able pull the docker image based on the git commit hash? We can also add that tag to Docker Hub. I am not sure I understand what Quay does better. I am a bit apprehensive about adding even more external services, since we already depend on quite a few (Travis, Codeship, Docker Hub, Appveyor for MMseqs2).

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHubhttps://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_soedinglab_plass_issues_7-23issuecomment-2D462272749&d=DwMFaQ&c=eRAMFD45gAfqt84VtBcfhQ&r=43yq3NlvxZAkeuLlWR4RGR24qPDLFwQzc_wHlXeny0I&m=4i6Unr0fi0GMH5myoUYgY2aU-72YHrzhDPXN8iMfKm4&s=qU3VCc_cBU0KBG-vf5dTfHtpgBdA55RbZKKLj65Hvfk&e=, or mute the threadhttps://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_notifications_unsubscribe-2Dauth_AE-2DVSAP2-5F3-5FlDeJ2x44ZatPEV4BWNZmhks5vMT-5FqgaJpZM4amVSP&d=DwMFaQ&c=eRAMFD45gAfqt84VtBcfhQ&r=43yq3NlvxZAkeuLlWR4RGR24qPDLFwQzc_wHlXeny0I&m=4i6Unr0fi0GMH5myoUYgY2aU-72YHrzhDPXN8iMfKm4&s=WwdD0LdX5ofIq3DP3i6X6kDgpdx1hgG6uf7pH_gt4NM&e=.

[milot-mirdita]

So I just checked, Docker Hub does not allow you to use the Git Hash for build tagging. I don't really want to migrate to another service. Our version string (and thus docker-tag) format is {incrementing number}.{first few characters of git hash}. Is that enough for your requirements?

[sminot]

I think that's more than enough, thanks!