4 ms·

I'm not talking about private hosting of containers, I'm talking about an alternative to today's public registry of container images that is 100% verifiable so

• 6nf 7y ago
  You mean something like posting signed hashes in a public place? So you can verify what you got is what you want?
• icebraining 7y ago
  You can only have 100% verifiable container images if the Dockerfiles uploaded by users are reproducible (in the sense of https://reproducible-builds.org/ https://reproducible-builds.org/). The vast majority probably aren't, and I'm not sure the Hub could reliably detect those that are.
• ericpauley 7y ago
  Do you mean formal verification? Verifying such a vast web service may be nearly impossible, especially since you'd still have to rely on a database server, os, and kernel, the most popular of which are seemingly fundamentally incompatible with verification.
• techntoke 7y ago
  This is what the Notary portion of Harbor does: https://github.com/goharbor/harbor/blob/master/docs/use_notary.md https://github.com/goharbor/harbor/blob/master/docs/use_nota... https://docs.docker.com/notary/getting_started/ https://docs.docker.com/notary/getting_started/