Sounds great in theory, but there hasn't been much traction on that project, at least from their own website, for over 6 months. Not much in terms of peer review of their method, or practical audits of their technology. Even your own audit is over a year old now, despite constant changes to the codebase.
That said, I do recall now when this was announced originally, and I'm glad that it at least exists. That it has skipped my memory makes me wonder why there has been little to no press about it since then. How broadly adopted has this been? Can we get signed images for, say, Ubuntu from docker hub?
> docker pull NAME@DIGEST
A great feature to have. Can you point me at the digest for the ubuntu repo on docker hub?
> serious refactoring which we have been working on
Good to hear. Also, interesting to note that runc still requires root access to make cgroups; I was not aware of this restriction.
> The Docker core engineering team invests more time on hardening than features.
I find this to be an interesting position to take, considering that a core component of docker has been historically re-written with every other release: registry in 1.6, disk plugins in 1.7, networking in 1.9, runc in 1.11. IIRC, networking was re-written again in 1.12, to support yet another version of clustered networking. That's a lot of churn for less than a year and a half worth of time.
> We hope to see you on the github repo, we value bug reports
That hasn't gone well for me in the past.
devicemapper errors in ubuntu 14.04, prior to dynamic linking: not our problem.
devicemapper dropping mounts sporadically: move to overlayfs.
Low level mutexes being shared between containers: that's nodejs' problem.
It's frankly become easier to create and use workarounds like spam-unmounting orphaned devicemapper mounts, or custom-compiling and distributing docker, or disabling docker-managed networking, and so on.
I feel bad for ragging on Docker like this, especially since I do end up using it frequently; but as a system administrator Docker is a nearly daily headache. Our developers love it, but the rest of us... not so much. I guess it's one of those "technologies everyone complains about" vs "technologies nobody uses" things. It's just really frustrating.