Hacker News Reader

From the original article

> This brings up an interesting side point, in that Docker Hub and most other registries allow mutable tags by default. So nginx:1.21.6 might not be the same image today as it was yesterday. In reality, you probably need a mechanism to enforce tag immutability: e.g., your own registry mirror, or referring to images by SHA)

View on HN

yeah, well, i stopped reading when i saw that "GOOD" example. it's not. and that isn't a "side point", that's the most critical point for preserving security and reproducibility of builds.

It's literally the line that follows that example. Why do you think it's useful to comment when you haven't even read the topic of discussion. You're like a person not reading the book at a voluntary book club. If you don't want to read it, just don't show up.

i suggest you to read my comment again, because so far what you've said applies to you more than to me.

Well then you'd vendor your docker images anyway and not pull them from the internet, right?

Sure, and many do that, but you don't have to if you refer by digest of image's contents.

Reply on news.ycombinator.com