Hacker News Reader

Comment by techthumb | Hacker News Reader

When I want a very specific version if the image, I use the SHA to pull/run

  $ docker pull hello-world@sha256:7d91b69e04a9029b99f3585aaaccae2baa80bcf318f4a5d2165a9898cd2dc0a1

View on HN

Or you could tag a little more optimally.

Tags are mutable, digests aren't.

Why, how often do you change tags after you've built a container and for what reason if so?

Digests cryptographically guarantee that you get the correct content, which prevents both malicious tampering (mitm, stolen credentials, etc) or accidental mutations. This is why "immutable tags" are a bad substitute and an oxymoron.

There are also better caching properties when using content addressable identifiers. For example with kubernetes pull policies, using IfNotPresent and deploying by digest means you don't even have to check with the registry to initialize a pod if the image is already cached, which can improve startup latency.

With a sha you shouldn’t have to change the pull policy. However there isn’t a need for always if you have the sha.

> There are also better caching properties when using content addressable identifiers. For example with kubernetes pull policies, using IfNotPresent and deploying by digest means you don't even have to check with the registry to initialize a pod if the image is already cached, which can improve startup latency.

While agree on the unquoted part, this is true also for human-readable (aka mutable-that-should-be-immutable) tags, when that pull policy is set (which is by default for everything that is not `latest`)

Reply on news.ycombinator.com