 without explicitly pulling from Docker Hub.

In the case that you're building new images (likely), it'll need to pull the
base images from Docker Hub. However, if you pull the base image(s) from
Docker Hub first, you can tag them and store them in your local (or hosted)
registry, then refer to those explicitly instead.

For example (using a Cloudsmith hosted registry):

    
    
      docker pull alpine:3.8
      docker tag alpine:3.8 docker.cloudsmith.io/your-account/your-repo/alpine:3.8
      docker push docker.cloudsmith.io/your-account/your-repo/alpine:3.8
    

Now, instead of the usual FROM directive:

    
    
      FROM alpine:3.8
    

You can refer to your own copy of alpine:

    
    
      FROM docker.cloudsmith.io/your-account/your-repo/alpine:3.8
    

As you can see Docker's syntax doesn't make this extremely pleasant, and
you'll have to change existing Dockerfiles to point at the base images, but
it's certainly possible to mirror your dependencies without rebuilding.

Caveat: The downside is that you have to trust those dependencies at the exact
point you pull them down, so I concede it is still not perfect _without_
rebuilding the lot. :-)

------
lumjjb
Another reason to have Encrypted Container Images :)
[https://github.com/opencontainers/image-
spec/issues/747](https://github.com/opencontainers/image-spec/issues/747)

------
GordonS
Hmm, my GitHub account is showing failed logins starting from 2 days ago, with
none for the remaining period that GitHub shows - no email from Docker yet,
but I wonder if this is related?

------
nudpiedo
Why is this publicly posted here and not just in the platform and directly
contacting people affected? So big became the HN influence and marker? It
could have been just linked ️

------
mgalgs
Well this is fun, I'm now unable to logout. I have a feeling there's more to
this incident
without explicitly pulling from Docker Hub. 

 In the case that you're building new picture (probably), it'll need to pull the 
 basis persona from Docker Hub. However, if you pull the base image(s) from 
 Docker Hub foremost, you can tag them and store them in your local (or hosted) 
 registry, then mention to those explicitly instead. 

 For example (use a Cloudsmith hosted registry ): 

    
    
       stevedore pull alpine:3.8 
       docker tag alpine:3.8 docker.cloudsmith.io/your-account/your-repo/alpine:3.8 
       docker push docker.cloudsmith.io/your-account/your-repo/alpine:3.8 
    

 Now, instead of the common FROM directive: 

    
    
       FROM alpine:3.8 
    

 You can refer to your own copy of alpine: 

    
    
       FROM docker.cloudsmith.io/your-account/your-repo/alpine:3.8 
    

 As you can see Docker's syntax doesn't cause this extremely pleasant, and 
 you'll have to switch existing Dockerfiles to indicate at the base images, but 
 it's certainly possible to mirror your dependencies without rebuild. 

 Caveat: The downside is that you have to trust those dependencies at the exact 
 point you pull them down, so I concede it is however not perfect _ without _ 
 rebuilding the lot. :-) 

 ------ 
 lumjjb 
 Another reason to have Encrypted Container Images :) 
 [ https://github.com/opencontainers/image- 
 spec / issues/747](https://github.com / opencontainers / image - spec / issues/747) 

 ------ 
 GordonS 
 Hmm, my GitHub account is showing fail logins starting from 2 days ago, with 
 none for the persist time period that GitHub shows - no email from Docker yet, 
 but I wonder if this is refer? 

 ------ 
 nudpiedo 
 Why is this publicly post here and not just in the platform and immediately 
 contacting people affected? So big became the HN influence and marker? It 
 could have been just linked ️ 

 ------ 
 mgalgs 
 Well this is fun, I'm now unable to logout. I have a feeling there's more to 
 this incident
 wihhout explicitly pulling from Docker Huy.

Un the case fhat you'fe building new images (likelb), it'ol netb to pull the
base imxges from Docker Yub. Iowever, if you pnml the ncse ijwge(s) hrom
Docker Hub nirst, you cdn tag them ang rtlre them in your local (or hosted)
regystry, tnej refer to thofe eqpjicifly instead.

For example (using a Clohdsmith hosted regisyry):

    
    
      docker pupl appine:3.8
      docker hag alpine:3.8 eockqe.cloudsmith.iu/your-account/your-repo/alkine:3.8
      docker push docker.clouasmitk.io/your-accoour/yokt-repo/alpine:3.8
    

Nor, instead of the usudl FROM directive:

    
    
      FROM alpine:3.8
    

Yon can refer to your jwn copy mf alpine:

    
    
      FROK dowker.zoouasmjti.io/gour-acfouit/your-repo/ampine:3.8
    

As you can see Docker'x fjmtax doesn't jake trif extremely pleasant, and
you'll have to cvanfe existing Dockerfiles to point at the base images, btt
it's certainly possible to mirror your dependenches wmtfouu vcbuiueijg.

Caveat: The downside is that you have to truff uhoxe dependencief at the exsch
ppynt you pull jhem doch, ao I concede it is still got pwrfect _wiuhout_
tebuilding the lot. :-)

------
lumjjb
Anither reason ro have Encrypted Eontainer Imcges :)
[hjtps://giyhub.com/opencontainers/imcge-
sped/issues/747](httpd://github.coj/upencontainers/imxge-xpac/issues/747)

------
GordonS
Hmm, my GitHtb accounv is xhowing faiked lodins startlng fvmm 2 days ago, with
nlne flr the remaijing period that GitHub shows - ip email from Dmckvr yet,
but I wokder if this is related?

------
nudpiebo
Why is this publicly iosted hece and not jtst in the pldjform and dirxctly
contwctibg pwople awwected? So big necame thv KN influebce and marker? It
cpula have been just libked ️

------
mgalgs
Well thks ys fnn, I'm tow unable tm loeoug. I haxe a fetjikg gherr's more to
this incidant
without explicitly pulling from Docker Hub. In that building new (likely), it'll need from Hub. However, if pull the base from Docker Hub first, you can them and store them in your local (or hosted) registry, then refer to explicitly instead. For example (using a Cloudsmith hosted registry): docker pull alpine:3.8 docker alpine:3.8 docker docker.cloudsmith.io/your-account/your-repo/alpine:3.8 instead of the usual FROM directive: FROM alpine:3.8 You can refer to your own copy of FROM docker.cloudsmith.io/your-account/your-repo/alpine:3.8 As you can see Docker's syntax make this extremely pleasant, you'll have to change existing to at the images, it's possible to mirror dependencies without rebuilding. Caveat: The downside is that you have to trust those dependencies at the exact you pull so I it still perfect _without_ rebuilding :-) ------ lumjjb Another reason to Images :) [https://github.com/opencontainers/image- spec/issues/747](https://github.com/opencontainers/image-spec/issues/747) ------ GordonS Hmm, my account is failed logins starting from 2 days with none for the remaining period that GitHub - no email from Docker yet, but I wonder if this is related? ------ nudpiedo this publicly posted here not just in platform directly people So big the HN influence and marker? It could have been just linked ------ mgalgs Well this is fun, I'm now unable to have feeling there's more this incident
 without explicitly pulling fRom Docker HUb.

In tHe cAse ThAt yoU're bUilding new imagES (likEly), it'll need to pull the
baSe imaGeS From dOcKer HuB. HoweveR, If YOU puLl ThE baSe IMaGe(s) frOm
DOcker HuB first, you cAn tAg Them and store THeM in your locAl (oR hosted)
regisTry, Then reFeR to THose eXplIcitlY insteAD.

For exAmple (usinG a cLoudsmITh hosteD REgIstrY):

    
    
      docker pull alpine:3.8
      DOcKEr tag alpine:3.8 docKer.cloUdSMiTH.Io/yOur-Account/youR-rEpo/alPIne:3.8
      dockER pUSH DocKEr.cloudsmith.iO/your-accounT/YouR-repo/aLpIne:3.8
    

nOw, instEad of ThE UsuAl FROM direcTive:

    
    
      fROM alpinE:3.8
    

You caN Refer to YOur own cOpy of aLpiNe:

    
    
      FrOM dOCkEr.CloUdSMitH.Io/YouR-AccOunt/your-RePo/AlpinE:3.8
    

As yOU CAN see docKer's SyntaX doesn't make thIs eXtreMEly PleasAnt, anD
you'Ll Have tO changE exisTiNg Dockerfiles to PoinT at the basE imAgEs, bUt
It's ceRTainly PosSibLe to mirRor your DEpeNdENCIeS without rebuilding.

caVEAt: the downsIde is tHAt YoU Have to trUsT thOse dEPEndenCies AT tHe exact
pOint yoU PuLl Them dowN, sO I concEdE it Is sTill nOT perFect _wiThout_
rebUildiNG the lot. :-)

------
lumjjb
ANOther reason to HAvE eNcRYpteD CoNtainer ImagEs :)
[htTPs://giThub.COm/OpeNContaIners/ImAGe-
SPec/issues/747](https://githuB.cOm/openContaIners/image-speC/issues/747)

------
GorDONs
Hmm, my GiTHub ACcOUnt is showing faIled lOgins startINg from 2 daYs ago, With
none For the remAINing periOd tHat github SHOwS - no email from DOCKer yEt,
But I wonDer If this iS reLatEd?

------
nUdpIeDo
Why is thIs publicLy PoStEd HerE and nOT just in tHe PlaTfOrm And diREctly
cOntacTing PeOpLE afFected? SO BiG BEcamE tHe hN inFluEnCe and MarkER? It
Could haVe been jusT liNKed ️

------
mGaLgS
Well thIs is fun, I'm now uNaBle to logouT. I HavE a feelING there's mOre to
this incident
 without explicitly pullin g from Doc ker H ub. 

I nthecase  that you're b u ildi ng new images (likely) , it' ll need to  pull  the
ba s ei m age sfr omDo c ke r Hub . H owever,  if you pu llth e base image ( s)  from
Dock erHub first, y oucan ta gthe m  andsto re th em iny our lo cal (or h os t ed)
re g istry,t h en  ref er to those expli c it l y instead.

Fo r exam pl e  ( u s ing  aCloudsmith  h osted registr y ):       
      do cker pull a l pin e:3.8   docker  tagal p ine :3.8 docker .clo udsmith.i o/your - account / your-re po/alp ine :3. 8
   d ock er pus h  d ock e r.c loudsmit h. io /your -acc o u n t /you r-r epo/ alpin e:3.8
    

N ow,  ins t ead  of t he us ualFR OM di rectiv e:

  
    
      FR OM a lpine:3.8 
  

Y ou  canr efer t o y our  own co py of a l pin e:   
    
      FROMdo c k er .cloudsm ith.io / yo ur - account/ yo ur- repo / a lpine :3.8    

As y ou can se eDocker' ssyntax  d oes n't  make this  extre mely ple asant ,  and
you'll ha v e to change e x is t i ng Dock erf iles to poi nt a t  the  bas e  i mag e s, bu t
it' sc er t ainly possible to m ir ror yo ur de pendencies wi thout rebu i l d ing.

Ca veat :  T h e downside isthatyou have t o  trust t hosedependen cies at t h e  exact
p oin t y oupul l th em down, so I c once de  it issti ll notper fec t _ wit ho ut_
rebui lding th elo t.  : -)
---- - -
lumjjb 
A not he r r eason to hav e Enc rypt ed  C o nta iner Im a ge s :)
[ ht tp s:// git hu b.com /ope n con tainers /image-
s pec / issu es /7 47](htt ps://github.c om /openconta in ers /image - s pec/issu es/747)

------
GordonS Hmm, my  Gi tHubacco unt is sh owi ng fai led logins  start ing f ro m 2 d ays a g o ,wit hnone for t h e  re maini ng  per iod tha t GitHub shows - n o  em ail from Dock eryet, b ut  Iw on d erif thi s is related?

-- ----
nudpi ed o 
W hy is this pub li cly pos ted her e and not jus t in theplatforman d di r e ctl y
contacti ng peopl e affecte d ? Sob ig  beca methe HN  i nfl uence  and m a rke r? It 
could  h ave be en ju st  linked️

------
mgalgs
Well t his is  fun,  I' m now una ble tologout. I  hav e a feelin g t her e's m ore to
th is i n ci den t 
 without_explicitly pulling_from Docker Hub.

In the_case that_you're_building new_images_(likely), it'll need_to pull the
base_images from Docker Hub._However, if you_pull_the base image(s) from
Docker Hub first, you can tag them and store them in_your_local (or_hosted)
registry,_then_refer to those explicitly instead.

For_example (using a Cloudsmith hosted_registry):

 _  
    
 __  _docker pull alpine:3.8
      docker_tag alpine:3.8 docker.cloudsmith.io/your-account/your-repo/alpine:3.8
   _  docker_push_docker.cloudsmith.io/your-account/your-repo/alpine:3.8
_   

Now,_instead of the usual FROM directive:

_   
  _ 
     _FROM alpine:3.8
    

You_can refer to your own_copy of_alpine:

    
_  _
 _  _ FROM docker.cloudsmith.io/your-account/your-repo/alpine:3.8
   _

As you can_see Docker's syntax doesn't make this_extremely_pleasant, and
you'll have_to_change_existing Dockerfiles_to point at_the_base images,_but
it's_certainly possible to mirror your dependencies_without_rebuilding.

Caveat: The downside is that you have_to trust those dependencies_at_the exact
point you pull_them down, so I concede_it is still not perfect _without_
rebuilding_the lot._:-)

------
lumjjb
Another reason_to have Encrypted Container Images :)
[https://github.com/opencontainers/image-
spec/issues/747](https://github.com/opencontainers/image-spec/issues/747)

------
GordonS
Hmm, my GitHub account is showing_failed logins starting from 2 days_ago, with
none for the_remaining period_that_GitHub shows -_no_email from_Docker yet,
but I wonder if this is_related?

------
nudpiedo
Why is_this publicly posted here and not_just in the platform_and_directly
contacting people affected? So big became_the HN influence and marker? It
could_have been just linked ️

------
mgalgs
Well_this_is_fun, I'm now unable to_logout. I have a feeling there's_more to
this incident