Use of FQIN in Dockerfile FROM instructions

[gitouche-sur-osm]

Subject of the issue

This is a request for the use of Fully Qualified Image Names (FQIN) in Dockerfile FROM instructions.
e.g. FROM alpine -> FROM docker.io/library/alpine

The use of short names is ambiguous as the registry it pulls from might depend on docker (or alternative build system) configuration. This is better explained in containers-registries.conf man page.

Docker uses hardcoded configuration in order to search for short names on docker.io registry :

echo $(docker info | grep -oP "(?<=Registry: ).*")
https://index.docker.io/v1/

But this behaviour might be different if registry-mirrors is set in docker daemon.json.

This would also improve support for docker alternatives as well (e.g. buildah, where the docker.io registry might not be the default registry), while staying 100% docker compatible.

File that needs changes : docker/Dockerfile.j2

See the changes in my fork : main...gitouche-sur-osm:vaultwarden:main#diff-4331345734d1b2a2578682b272eae8952289a0cffb0b5b6dd118f40802a4d055

Would you consider a PR for this?
Thank you for considering this request.

[BlackDex]

Well, what if someone wants to use a different registry as it's default? Then they need to either configure that it overrules there config? Or modify the Dockerfile?

Im not sure this would be a good change. But i haven't looked at it that well

[gitouche-sur-osm]

Well, what if someone wants to use a different registry as it's default? Then they need to either configure that it overrules there config? Or modify the Dockerfile?

Im not sure this would be a good change. But i haven't looked at it that well

Thank you for taking the time to review this.

I have some corporate docker configuration where docker.io is not the default registry (corporate registry is used instead), and short names in Dockerfile cannot be computed correctly. It needs to know "alpine" is in fact at "docker.io/library/alpine", the only way to do that is to explicity use the fully qualified image name.

This makes building the image both safer (better explained in containers-registries.conf man page ) and more reliable, as it will work regardless of the local docker registry configuration.

PS : this is not about the registry where the image is pushed once built.

[BlackDex]

That seems logical. Thanks for the extra information and bringing this to our attention.

[BlackDex]

@gitouche-sur-osm If you rebase your changes on the current main, and create a PR, I'm going to approve that.

[BlackDex]

Resolved via #3505