Re: [rdf4j-dev] removing old docker images from dockerhub / vulnerabilit

[Håvard Ottestad <hmottestad@xxxxxxxxx>]

Hi Jeen and Bart,

I recommend we keep the older versions around just like how we keep older versions of RDF4J around on maven central. 

Users who want to use an older image can very easily extend it and call the equivalent of apt-get update && apt-get upgrade if the open-ssl vulnerability is important for them to fix.

I think that deleting the images would come as a bit of a surprise for those users who are currently using them. Docker will cache them locally, just like how maven does, but if they try to set up a new computer it will be missing. 

Håvard

On 18 Nov 2022, at 02:07, Jeen Broekstra <jeen@xxxxxxxxxxxx> wrote:



On Fri, 18 Nov 2022, at 11:25, Bart Hanssens (BOSA) via rdf4j-dev wrote:

Hi Jeen,

 

It _might_ be useful to keep some older versions on dockerhub to quickly check if an issue is a regression

(then again, we might just use the SDK for that… so I wouldn’t mind just keeping the latest version and delete the rest)

I'll go with that for now, and just delete all old images. If we find we need them again, we can always re-build.

Going forward, shall we try and make it a habit to delete older images as soon as we have pushed a new release? Not sure there's a cli command that we can use for that to automate, if not we'll have to log in via the website and manually delete them...

 

As for automated scanning, it would be great if Eclipse Foundation would provide e.g. Snyk.io subscription,
but if I recall correctly hub.docker is not considered to be core infrastructure by Eclipse …
(rather an extra service due to popular demand)

True. However Snyk itself has a free tier for open-source, which you can use from the command line (via docker scan), so at the very least I think we can make sure we do a docker scan regularly from the command line.

Jeen

_______________________________________________
rdf4j-dev mailing list
rdf4j-dev@xxxxxxxxxxx
To unsubscribe from this list, visit https://www.eclipse.org/mailman/listinfo/rdf4j-dev