What's the difference between this and say:
FROM ubuntu:16.04
Won't that pull the latest official Ubuntu image with that tag?
FROM ubuntu:16.04
Won't that pull the latest official Ubuntu image with that tag?
- If you're running on GCP, pulling images from GCR will likely be much faster than Dockerhub given network locality.
- Content Trust. DockerHub images are maintained by a large team of upstream maintainers and volunteers. These images are fully managed by Google, and you can examine and audit the full supply chain from source to built image.
* Faster fetch - not a big deal IMO (edit: you could just mirror, you don't have to do the patching)
* Content trust - but trust to e.g. Canonical's Ubuntu is required anyway, right? And then, you have to trust Google.
Examples of reasons I would take as good:
* Does Google routinely do audit of original distro images, so that it's less of a risk to use community distro like Debian? It could.
* Is Google "manning" the work on the actual distributed software, accepting users' bugreports and then working with upstream to fix it? It could.
Even-more-downstream-distro is actually not a bad idea.
--- edit add disclosure statement
Disclosure: I work at Microsoft on Azure, previously at Docker on the core engine.
But, there's nothing to say that the upstream distro would accept the changes. Google has more stringent requirements that a general distro, and you're choosing to follow those requirements (at the benefit of Google's automated scanning). It's totally your choice.
Disclosure: I work at Microsoft on Azure.
If upstream didn't accept it, then it shouldn't be masquerading as what upstream is... which is what changing `FROM $image` to point to Google's image does.
> and you're choosing to follow those requirements
From what I gathered from the article, Google is changing the meaning of `FROM $image` to mean Google's build of the image. There is no choice in the matter outside of using Google's services.
Disclosure (and sorry for not mentioning in the original comment, I've updated): I work at Microsoft on Azure, and formerly at Docker on the core engine.
These also happen to be the ones that have been in use by some of our "more serverless" offerings, where users don't get to supply a Dockerfile, for some time now.
I read this perhaps the wrong way, in which case I apologize on that front.
At best such a comment is completely ignorant of the existing ecosystem.