Document image SHAs, avoid build duplication

[solsson]

Docker's tagging conventions are hard to use. In particular it's difficult to trace a @sha256: back to the build and thus the source revision. But you do want the checksums because:

• You typically have little control over when your environments pull. For example Kubernetes will by default reuse images, but if you add a node it will pull a fresh one.
• A mistake or attack may re-build the tag with modifications and thereby inflict pain.

In addition, with this repo relying on Docker Hub's automated build feature, each tagged build will be a duplicate of the concurrent :latest (different checksums, identical behavior).

You can get reasonable transparency with for example solsson/kafka:0.11.0.0@sha256:e09d493ae027bbe45d82dc5b9ceaae40adad23efb2936116b233b7dce48136ba but the problem is that such image identification isn't explicitly supported by Docker. If the tag is re-built (which is legit, and even implied in case of tags like 0.11.0) you'll get "manifest verification failed" at next pull. You could be forgiven for thinking that Docker would continue to use the old pull, but for that you have to omit the tag. While solsson/kafka@sha256:e09d493ae027bbe45d82dc5b9ceaae40adad23efb2936116b233b7dce48136ba is stable over time, your colleague has little chance of knowing which Kafka version you intend to run.

[solsson]

Docker's tagging conventions are hard to use. In particular it's difficult to trace a @sha256: back to the build and thus the source revision. But you do want the checksums because:

• You typically have little control over when your environments pull. For example Kubernetes will by default reuse images, but if you add a node it will pull a fresh one.
• A mistake or attack may re-build the tag with modifications and thereby inflict pain.

In addition, with this repo relying on Docker Hub's automated build feature, each tagged build will be a duplicate of the concurrent :latest (different checksums, identical behavior).

You can get reasonable transparency with for example solsson/kafka:0.11.0.0@sha256:e09d493ae027bbe45d82dc5b9ceaae40adad23efb2936116b233b7dce48136ba but the problem is that such image identification isn't explicitly supported by Docker. If the tag is re-built (which is legit, and even implied in case of tags like 0.11.0) you'll get "manifest verification failed" at next pull. You could be forgiven for thinking that Docker would continue to use the old pull, but for that you have to omit the tag. While solsson/kafka@sha256:e09d493ae027bbe45d82dc5b9ceaae40adad23efb2936116b233b7dce48136ba is stable over time, your colleague has little chance of knowing which Kafka version you intend to run.

[solsson]

Docker's tagging conventions are hard to use. In particular it's difficult to trace a @sha256: back to the build and thus the source revision. But you do want the checksums because:

• You typically have little control over when your environments pull. For example Kubernetes will by default reuse images, but if you add a node it will pull a fresh one.
• A mistake or attack may re-build the tag with modifications and thereby inflict pain.

In addition, with this repo relying on Docker Hub's automated build feature, each tagged build will be a duplicate of the concurrent :latest (different checksums, identical behavior).

You can get reasonable transparency with for example solsson/kafka:0.11.0.0@sha256:e09d493ae027bbe45d82dc5b9ceaae40adad23efb2936116b233b7dce48136ba but the problem is that such image identification isn't explicitly supported by Docker. If the tag is re-built (which is legit, and even implied in case of tags like 0.11.0) you'll get "manifest verification failed" at next pull. You could be forgiven for thinking that Docker would continue to use the old pull, but for that you have to omit the tag. While solsson/kafka@sha256:e09d493ae027bbe45d82dc5b9ceaae40adad23efb2936116b233b7dce48136ba is stable over time, your colleague has little chance of knowing which Kafka version you intend to run.

[solsson]

Docker's tagging conventions are hard to use. In particular it's difficult to trace a @sha256: back to the build and thus the source revision. But you do want the checksums because:

• You typically have little control over when your environments pull. For example Kubernetes will by default reuse images, but if you add a node it will pull a fresh one.
• A mistake or attack may re-build the tag with modifications and thereby inflict pain.

In addition, with this repo relying on Docker Hub's automated build feature, each tagged build will be a duplicate of the concurrent :latest (different checksums, identical behavior).

You can get reasonable transparency with for example solsson/kafka:0.11.0.0@sha256:e09d493ae027bbe45d82dc5b9ceaae40adad23efb2936116b233b7dce48136ba but the problem is that such image identification isn't explicitly supported by Docker. If the tag is re-built (which is legit, and even implied in case of tags like 0.11.0) you'll get "manifest verification failed" at next pull. You could be forgiven for thinking that Docker would continue to use the old pull, but for that you have to omit the tag. While solsson/kafka@sha256:e09d493ae027bbe45d82dc5b9ceaae40adad23efb2936116b233b7dce48136ba is stable over time, your colleague has little chance of knowing which Kafka version you intend to run.

[solsson]

Docker's tagging conventions are hard to use. In particular it's difficult to trace a @sha256: back to the build and thus the source revision. But you do want the checksums because:

• You typically have little control over when your environments pull. For example Kubernetes will by default reuse images, but if you add a node it will pull a fresh one.
• A mistake or attack may re-build the tag with modifications and thereby inflict pain.

In addition, with this repo relying on Docker Hub's automated build feature, each tagged build will be a duplicate of the concurrent :latest (different checksums, identical behavior).

You can get reasonable transparency with for example solsson/kafka:0.11.0.0@sha256:e09d493ae027bbe45d82dc5b9ceaae40adad23efb2936116b233b7dce48136ba but the problem is that such image identification isn't explicitly supported by Docker. If the tag is re-built (which is legit, and even implied in case of tags like 0.11.0) you'll get "manifest verification failed" at next pull. You could be forgiven for thinking that Docker would continue to use the old pull, but for that you have to omit the tag. While solsson/kafka@sha256:e09d493ae027bbe45d82dc5b9ceaae40adad23efb2936116b233b7dce48136ba is stable over time, your colleague has little chance of knowing which Kafka version you intend to run.

[solsson]

Docker's tagging conventions are hard to use. In particular it's difficult to trace a @sha256: back to the build and thus the source revision. But you do want the checksums because:

• You typically have little control over when your environments pull. For example Kubernetes will by default reuse images, but if you add a node it will pull a fresh one.
• A mistake or attack may re-build the tag with modifications and thereby inflict pain.

In addition, with this repo relying on Docker Hub's automated build feature, each tagged build will be a duplicate of the concurrent :latest (different checksums, identical behavior).

You can get reasonable transparency with for example solsson/kafka:0.11.0.0@sha256:e09d493ae027bbe45d82dc5b9ceaae40adad23efb2936116b233b7dce48136ba but the problem is that such image identification isn't explicitly supported by Docker. If the tag is re-built (which is legit, and even implied in case of tags like 0.11.0) you'll get "manifest verification failed" at next pull. You could be forgiven for thinking that Docker would continue to use the old pull, but for that you have to omit the tag. While solsson/kafka@sha256:e09d493ae027bbe45d82dc5b9ceaae40adad23efb2936116b233b7dce48136ba is stable over time, your colleague has little chance of knowing which Kafka version you intend to run.

[solsson]

Docker's tagging conventions are hard to use. In particular it's difficult to trace a @sha256: back to the build and thus the source revision. But you do want the checksums because:

• You typically have little control over when your environments pull. For example Kubernetes will by default reuse images, but if you add a node it will pull a fresh one.
• A mistake or attack may re-build the tag with modifications and thereby inflict pain.

In addition, with this repo relying on Docker Hub's automated build feature, each tagged build will be a duplicate of the concurrent :latest (different checksums, identical behavior).

You can get reasonable transparency with for example solsson/kafka:0.11.0.0@sha256:e09d493ae027bbe45d82dc5b9ceaae40adad23efb2936116b233b7dce48136ba but the problem is that such image identification isn't explicitly supported by Docker. If the tag is re-built (which is legit, and even implied in case of tags like 0.11.0) you'll get "manifest verification failed" at next pull. You could be forgiven for thinking that Docker would continue to use the old pull, but for that you have to omit the tag. While solsson/kafka@sha256:e09d493ae027bbe45d82dc5b9ceaae40adad23efb2936116b233b7dce48136ba is stable over time, your colleague has little chance of knowing which Kafka version you intend to run.

[solsson]

Docker's tagging conventions are hard to use. In particular it's difficult to trace a @sha256: back to the build and thus the source revision. But you do want the checksums because:

• You typically have little control over when your environments pull. For example Kubernetes will by default reuse images, but if you add a node it will pull a fresh one.
• A mistake or attack may re-build the tag with modifications and thereby inflict pain.

In addition, with this repo relying on Docker Hub's automated build feature, each tagged build will be a duplicate of the concurrent :latest (different checksums, identical behavior).

You can get reasonable transparency with for example solsson/kafka:0.11.0.0@sha256:e09d493ae027bbe45d82dc5b9ceaae40adad23efb2936116b233b7dce48136ba but the problem is that such image identification isn't explicitly supported by Docker. If the tag is re-built (which is legit, and even implied in case of tags like 0.11.0) you'll get "manifest verification failed" at next pull. You could be forgiven for thinking that Docker would continue to use the old pull, but for that you have to omit the tag. While solsson/kafka@sha256:e09d493ae027bbe45d82dc5b9ceaae40adad23efb2936116b233b7dce48136ba is stable over time, your colleague has little chance of knowing which Kafka version you intend to run.