New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
dockerTools.pullImage: use imageDigest #29505
Conversation
Docker provides the "image digest" which is an immutable image identifier (unlike image name and tag). It now has to be specified to pull an image. Note Docker supports URI such as imageName:imageTag@imageDigest however this is not yet supported by Skopeo: "Docker references with both a tag and digest are currently not supported"
This looks fantastic, thanks! |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Awesome! 🎆
Big fan of digests, so +1 from me. Can you also add a commit to remove the |
+1 also cc @offlinehacker and @matejc |
@aneeshusa oups... commit pushed. Thanks! |
Thanks @nlewo! I just noticed that |
@aneeshusa done. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looking forward to using this, thanks!
Nice, looks good, thanks :) |
Since dockerTools.pull implementation with Skopeo has been reverted from master, this PR is deprecated. |
Docker provides the "image digest" which is an immutable image
identifier (unlike image name and tag).
It now has to be specified to pull an image.
Note Docker supports URI such as imageName:imageTag@imageDigest however
this is not yet supported by Skopeo:
"Docker references with both a tag and digest are currently not supported"
Motivation for this change
This improve reproducibility of docker pullling operations since it now use a immutable Docker image identifier.
Things done
nix-build ./ -A dockerTools.examples.nix && docker load -i result
build-use-sandbox
innix.conf
on non-NixOS)nix-shell -p nox --run "nox-review wip"
./result/bin/
)