Reproducibility and assertion via CI about rules_oci HOT 7 CLOSED

also, strip down created as well as created properties in history within image config. optionally one should be able to set these to BUILD_TIMESTAMP when --stamp has been requested and stamp=True

furthermore, using references with tags (eg debian:latest) in repository rules like container_pull will eventually break one's build we should discourage anyone from doing that.

we should also document that this is okay for development purposes but shall never be accepted and checked into vcs.

from rules_oci.

• strip PAX headers from tar layers.

this might not work if we ever support building Windows containers.

from rules_oci.

It looks like container base images are not treated hermetically at present? If I'm reading it right they're going to get downloaded during the execution phase by crane mutate <base>, so will not be subject to remote caching, Bazel integrity checks, invalidation, etc. Those seems like important aspects for reproducibility.

from rules_oci.

It looks like container base images are not treated hermetically at present? If I'm reading it right they're going to get downloaded during the execution phase by crane mutate <base>, so will not be subject to remote caching, Bazel integrity checks, invalidation, etc. Those seems like important aspects for reproducibility.

You are right. container_pull functionality is basically missing at the moment and #33 will remove the crane mutate behavior. I have been thinking about supporting container_pull which is capable of shallow pulling, remote cacheable via rctx.download, and integrity-checked blobs but don't have the time and resources to implement that yet.

from rules_oci.

We implemented a hermetic oci_pull rule now. Is there more to do for this issue?

from rules_oci.

We implemented a hermetic oci_pull rule now. Is there more to do for this issue?

only thing left from this list is asserting oci_image produces the same output with a clean build.

from rules_oci.

I guess we can just make a golden file test against the digest we produce in our e2e test

from rules_oci.