notary

I build my images for private & professional projects in Gitlab CI and I use the provided free registry. The biggest downside to my set up is that I can't say I have enterprise-level security. Getting it nailed down properly requires the use of tools like TUF/Notary[0] & signed-image aware container repositories like Harbor[1] and a deployment gate mechanism like Portieris[2]. That's a lot of complexity to tack on. Just a note -- Docker already runs containerd underneath via a shim[3] If you're relying on docker-specific features then by all means it makes sense to continue using docker but if you're just looking for a thing to quietly run your containers (or power your kubernetes cluster), containerd should probably be that thing. It's all of the building and none of the extra stuff that docker the company is trying to do/become. [0]: ht

I didn't know ipfs cluster existed -- thanks for the reference. I was more thinking of a harbor[0] like cobbling of these technologies together -- harbor combines a bunch of F/OSS tools into one powerful registry solution. Here are a few: - Distribution for storing images - Notary for signing - Clair for static analysis Based on this I was thinking of was basically Distribution + ipfs cluster + a small management daemon. The daemon is only there to tie the other pieces together and present a unified interface but the bulk of the work can be done with the other pieces. [0]: https://github.com/goharbor/harbor/wiki/Architecture-Overvie... [1]: https://github.com/docker/distribution [2]: https://github.com/theupdateframework/notary [3]: https://github.com/coreos/clair

Yeah that's definitely true -- throwing your server away is no good if the machine image/setup flow you're using is insecure. Nix/Guix + the long list of distros working on it are all going in the right direction to fix this problem -- but I find it hard to believe that instead of just waiting for Debian reproducible builds (or some other vendor provided option) people will all switch to Nix/Guix. Above the VM layer (@ the sandboxed process i.e. container layer), TUF[0] + Notary[1] + compliant image registries + attestation tools are helping to solve this problem which is nice. [0]: https://theupdateframework.github.io/ [1]: https://github.com/theupdateframework/notary