Update Dockerfile section of README

[tetsuo-cpp]

Signed-off-by: Alex Cameron asc@tetsuo.sh

Summary

Update the Dockerfile section of the README.

Release Note

NONE.

[developer-guy]

LGTM

[lukehinds]

I am not following what this change is achieving, why is the extra FROM needed and why are we introducing another registry?

[tetsuo-cpp]

I am not following what this change is achieving, why is the extra FROM needed and why are we introducing another registry?

My understanding is that the second FROM is the base image for this Dockerfile. It's a minimal container that has just enough to run the Cosign binary.

As for why I've changed the registry, the infrastructure has been moved from distroless to chainguard-images. If you click through to the distroless GitHub org, there is some advice in the README that says:

Distroless images have moved to the Chainguard Images repo.

Please update any image references to use the cgr.dev/chainguard registry i.e. docker pull distroless.dev/static is now docker pull cgr.dev/chainguard/static.

[lukehinds]

It was at ghcr.io before though?

[tetsuo-cpp]

It was at ghcr.io before though?

Ah right. Perhaps the images are pushed to both registries? In any case, cgr.dev is the one listed in the README of the image repo.

[lukehinds]

My two cents is we should dog food here, build code on gh, push to ghcr, and recommend users pull from ghcr. I don't see a lot of value of introducing another layer of infra.

Ah right. Perhaps the images are pushed to both registries? In any case, cgr.dev is the one listed in the README of the image repo.

Not sure I am following why that's relevant? Its listed there, as that is for chainguard images.

[lukehinds]

Ok, I got it, distroless has been shift and lifted over to chainguard. T.I.L.