notary

thing, but is nowhere near complete. At least Google clearly signals that they are killing something, Docker just lets projects go quiet. I'm now looking at replacing everything I've done for the past 4 months with Podman, Buildah, and Cosign. How long before this project lands up like the rest of them? Coincidentally, we were talking about decoupling our CI from proprietary CI, seeing this was a rollercoaster of emotions. [1]: https://github.com/notaryproject/notary [2]: https://github.com/notaryproject/notation

tps://github.com/theupdateframework/notary [1]: https://github.com/goharbor/harbor [2]: https://github.com/IBM/portieris [3]: https://groups.google.com/forum/#!topic/docker-dev/zaZFlvIx1...

stomization. Sourcegraph development is open source; if you notice any problems, let us know in the issue tracker at https://github.com/sourcegraph/sourcegraph.

there are similar extensions, but this is the one I currently use. > a) still derived from some other upstream Dockerfile (must this file also be validated by Docker to qualify as an "official repo"?) The `FROM` line in the Dockerfile would likely be the first thing to undergo scrutiny, for obvious reasons. Also, all the layers go through security scanning[3], some issues can be fixed[4] and others are tracked upstream (e.g. by Debian in the case of the Ruby image you linked[5]). > you end up with an image that is very bloated due to the way Docker's caching layer functions You can now use `docker build --squash`[6] to combine multiple image layers while still benefiting from layer caching during builds. Also, the final image won't contain files that are added in previous layers and removed in later ones. (And with multi-stage builds recently merged, soon multiple inheritance will be easier.) > Is this "transparency" only the case on "official" images? As far as I can see Docker Hub just stores the pushed binary blob and not the Dockerfile required to build it I would say groups or sole developers that want others to use their images will usually provide documentation and links to the Dockerfiles. Of course, this isn't always possible or desired (e.g. see closed-source projects like Windows Server Core[7], or the countless people using Docker Hub as a free image host.) [0]: https://github.com/docker/notary [1]: https://docs.docker.com/engine/security/trust/trust_key_mng/ [2]: https://octolinker.github.io/ [3]: https://docs.docker.com/docker-hub/official_repos/#how-do-i-... [4]: https://github.com/docker-library/official-images/pulls?utf8... [5]: https://github.com/docker-library/ruby/issues/117 [6]: https://docs.docker.com/engine/reference/commandline/build/#... [7]: https://hub.docker.com/r/microsoft/windowsservercore/

be the right fit for you. Of course we try to make Docker as customizable as possible, to support more a wider spectrum of use cases with plugins. But realistically, no single platform can cover all use cases, and I don't think any platform ever will. Docker is no exception. 4. Philosophy disagreement. Different people have different opinions on how applications should be developed and deployed. Docker tries very hard to be agnostic - to accommodate as many opinions as possible. But we can't please everybody. If Docker does not fit your philosophy of development and deployment, then the natural response is to look for an alternative. 5. Competition. Many Docker competitors started out as extensions or modifications of Docker, and over time are looking to reduce their dependency on Docker. I'm probably missing other reasons, but these are the ones I've been most exposed to. These are all reasonable reasons to not want to use Docker. Our approach is that, if you want to run containers without Docker, we should make it as easy as possible. In practice that means spinning out as many of the underlying components as possible (what we call the "plumbing") so that you can assemble it yourself without being stuck using the entire Docker platform. For example: - containerd [https://github.com/docker/containerd] is our low-level container runtime. - runc [https://runc.io] is a standardized "container executor", which we donated to the Linux Foundation as the reference foundation for the OCI spec. - libnetwork [https://github.com/docker/libnetwork] is the low-level networking implementation (including overlay networking which is a very useful primitive for container clustering) - swarmkit [https://github.com/docker/swarmkit] is a clustering/orchestration implementation - notary [https://github.com/docker/notary] is a cryptographic content verification tool, which you can use to sign and verify container images. - infrakit [https://github.com/docker/infrakit] automates the provisioning of infrastructure capable of running containers. Our opinion is that, even if you don't use Docker, by using these components for your own purposes, you are indirectly contributing to making Docker better. Splitting out these components has also forced us to refactor Docker into a more modular, more robust design. We even send Docker employees to explain how to run containers without Docker :) For example here's a talk we gave at Linuxcon: https://linuxconcontainerconeurope2016.sched.org/event/7oHM/...

h to it. Another possibility is to use the new auth plugin system, although I haven't tried. > Where is Docker not running a daemon as root? Docker runs unprivileged by default, but only on relatively recent kernels with user namespace support (it drops itself to "fake root" so it can still create containers without actually having uid0). On older systems (or if you don't trust user namespaces) I agree we could break up some parts of the daemon (for example push/pull) to drop privileges further. That requires serious refactoring which we have been working on gradually for some time. > How about Docker doing more hardening releases and fewer feature releases? We follow the linux methodology: every release includes many hardening improvements, as well as whatever features have been deemed stable enough to merge. We don't control what pull requests the community sends, but we work hard to maintain a high quality bar and encourage quality-oriented contributions. The Docker core engineering team invests more time on hardening than features. > There's a lot of low hanging, security related fruit which haven't been picked. Why not? I'm sure there are :) Security is a process, we will never be done. The important thing for us is to take it seriously, invest appropriately (Docker core team employs 6 full time security engineers and funds various third-party security efforts), and make sure we are perpetually improving. On top of that, Docker is known for making powerful technology more accessible to more people. We want to use that "superpower" to make security more usable by non-experts. We think that contributes to making everyone more secure. > Process isolation is a fantastic. There just really needs to be more, in my opinion. Docker security is about much, much more than process isolation. Thanks for the feedback. We hope to see you on the github repo, we value bug reports :)