docker-lock

Nice! I was thinking about building something similar -- just filed an issue for how you might extend this to work for migrating registries. Pleasantly surprised to come across this PR: https://github.com/safe-waters/docker-lock/pull/73 This is a perfect application of crane :)

Shameless Plug: I wrote a cli-plugin for docker, docker-lock, to solve the mutable tag problem without having to manually specify hashes - https://github.com/safe-waters/docker-lock It creates a Lockfile (think package-lock.json) that tracks the image digests (sha256 hashes) of your base images, so you will always know exactly which images you are using even if you only specify tags. This way, you can know if a base image has changed, yet still receive important security updates that you would not receive if you hardcode the digest. It supports any registry, so is useful even if you are not using Dockerhub. It also works with Dockerfiles, docker-compose files, and Kubernetes manifests. I hope anyone dealing with this issue finds it helpful :)

Shameless Plug: I wrote a cli-plugin for docker, docker-lock, that will track the image digests (SHA's) of your images in a separate file that you can check in to git, so you will always know exactly which image you are using (even if you are using the latest tag). It can even rewrite all your Dockerfiles and docker-compose files to use those digests. https://github.com/safe-waters/docker-lock Would love for anyone dealing with this issue to check it out!