Curious about docker tags

[Lee Trout]

Hey folks,

Docker build and deploy was manually initiated by thc202 around 4am EDT today.

The 2.17.0 tag in docker hub was subsequently re-used (this seems common based on the action history).

Should we always rely on the date-based tags to control slow upgrades?

Are there any plans to bump patch numbers instead of stomping on tags?

Thanks,

Lee

[psiinon]

Hiya Lee,

Looks like we cant win - if we dont update our images then people complain they are out of date :D

FYI this process is documented here: https://www.zaproxy.org/docs/docker/about/#stable

Feel free to suggest alternative naming/tagging stategies...

Cheers,

Simon

[Lee Trout]

Apologies for not seeing and comprehending those notes in the docs and thank you for the link. That all makes sense, and yes, I know the frustration with containers and keeping up to date with base images.

I've noticed other projects suffer from another problem where they have hundreds of tags and it's hard to understand which to use. 

Thanks for taking time to reply. I noodle on some alternatives if you truly are interested in supporting some other tags / releases.

Lee

We're being especially cautious given the recent supply chain attacks and this broke our cool-off period since we saw the same tag version with a recently modified timestamp.

--
ZAP by Checkmarx: https://www.zaproxy.org/
---
You received this message because you are subscribed to a topic in the Google Groups "ZAP Developer Group" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/zaproxy-develop/zaKXf9S-8v0/unsubscribe.
To unsubscribe from this group and all its topics, send an email to zaproxy-devel...@googlegroups.com.
To view this discussion, visit https://groups.google.com/d/msgid/zaproxy-develop/2f6c2521-b946-4395-bb4e-a9039f8a13dfn%40googlegroups.com.

[Petya Tsarnelova]

unsubscribe 

Mit freundlichen Grüßen
Petya Tsarnelova
📍 Schwanthalerstr. 79, 80336 München
📞 +49 176 72656886
📧 petya.ts...@gmail.com

You received this message because you are subscribed to the Google Groups "ZAP Developer Group" group.
To unsubscribe from this group and stop receiving emails from it, send an email to zaproxy-devel...@googlegroups.com.
To view this discussion, visit https://groups.google.com/d/msgid/zaproxy-develop/CADQ%2BAH1tutLBmVpSXwX1urBaj0QuBBhfXW_CU7NhoScyo3KL8w%40mail.gmail.com.

[psiinon]

Hi Lee,

No problem, and I completely understand - supply chain attacks are becoming much more prevalent :(

We do want to do our best to both provide up to date packages while giving our everyone options to update ZAP how and when you want.

Right now the date based tags will allow you to stick on a specific stable release. But we do clear those out from time to time.

Suggestions for better alternatives definitely appreciated :)

Cheers,

Simon