Brandon Mitchell 💙🇺🇦💛

I'm scaling back my Twitter usage. You can find me at: Mastodon: @bmitch" target="_blank" rel="nofollow noopener">fosstodon.org/@bmitch GitHub: github.com/sudo-bmitch

@mattfarina @nunixtech explore.ggcr.dev

@nunixtech @sudo_bmitch Any GUIs ideas? GUIs are needed for the masses

Are there any tools to view labels on #docker container images? Any registries that use them?

Modifying the Immutable: Attaching Artifacts to OCI Images - By Brandon Mitchell @sudo_bmitch youtu.be/_c1OdmP9Ssg via @YouTube

@maxgio92 @OCI_ORG @orasproject When the 1.1 spec is released, registries may self report their conformance conformance.opencontainers.org

@OCI_ORG @orasproject is there a public list of public container registries which are going to implement the OCI 1.1 specs (distribution, artifact and referrers)?

Hi #docker and @atldevops enthusiasts! We are excited to have @sudo_bmitch #dockercaptain from @boxboat and Carlos Traitel from @jfrog as we return to in-person @Docker #Meetups in 2023! RSVP and join us on Weds February 8 at 6PM! and meetup.com/docker-atlanta…

Attaching artifacts to @OCI_ORG images with @sudo_bmitch #CNSCon

I wrote a blog post about the OCI Image Layout, impressed by the talk by @sudo_bmitch, and it was published on the @CDeliveryFdn blog a while ago. The @CDeliveryFdn told me it got over 1K hits on LinkedIn, which is awesome 🥳 cd.foundation/blog/community…

Good beautiful morning, Happy New Year listeners! 🥳We are kicking off #DeveloperStories 2023 with an awesome episode on container security and related topics! My guest is @sudo_bmitch, who is not only a #Docker captain, but an exceptional and kind person. podcasts.apple.com/us/podcast/the…

I'm so thrilled to announce that my second blog post published on the @CDeliveryFdn website about @OCI_ORG Image Layout for reducing the network requests to meet today's pipelines needs 🥳 I'd like to thank @roxannejoncas @fdegir @iximiuz @sudo_bmitch 👋 cd.foundation/blog/community…

@estesp It was an inspiration for some of the stuff I've done, and it see similar inspiration in other tools out there. Thanks for being such an awesome leader in the space.

Thanks to all of you who came along and improved it a little here and there and reported bugs. github.com/estesp/manifes…

In 2016 I wanted to create a simple tool to test out this new "multiple platform" feature of the Docker image spec, called manifest lists, later to become OCI indexes. It wasn't really supposed to be used by anyone and was pretty messy at first. 🧵

To all the Twitter employees, former and present, that made this a great site, thank you.

Like so many others, I've setup a Mastodon account as a plan B. @bmitch@fosstodon.org @bmitch" target="_blank" rel="nofollow noopener">fosstodon.org/@bmitch

A Halloween treat for all the container kids. This is removing Docker Hub's filter on the config media type, so you can push an image manifest that packages OCI v1 artifacts. docker.com/blog/announcin…

@lorenc_dan @LachlanEvenson @colek42c @ImJasonH Pretty much this. OCI can tell you an attestation or SBOM exists, and now we can say that an image has one associated with it. But people want the next level, a way to query the content: "Show me all the images built with older versions of openssl."

@LachlanEvenson @colek42c @ImJasonH I think even with the new changes they're good for first-party use cases where you want to retrieve a few attestations that you already know you can trust, but they don't work for a world where anyone can attest to anything. I'm not aware of anything that does work here.

OCI registries are not an appropriate API for discovering attestation data. I think they do have a role in distributing attestation data.

Gather round my goblins, ghoulies, and gargoyles! It's the end of the month - the Thursday before Halloween! 🐈‍⬛💀🎃👻 and it's time for some fun! Have you noticed that #RSEStories was a bit quiet for a month? We are excited to announce some news brought by winds of change... 🌬️

@ntdvps @ibuildthecloud Here it is, but I can't say that I'm proud of it. gist.github.com/sudo-bmitch/c2…

@sudo_bmitch @ibuildthecloud Oh, sorry I meant to say a script

What do people do to install and manage golang? Personally I just download and extract the tar, anybody doing something fancier?

@ntdvps @ibuildthecloud It's the official golang image. The script itself I can make a gist.

@sudo_bmitch @ibuildthecloud Do you have this dockerfile public somewhere?

Going forward, OCI is looking at deprecating the nondistributable options. That doesn't stop you from using old images, and no OCI police will show up at your door for using it, but I'd avoid building anything new with this. 4/ github.com/opencontainers…

For end users, regctl has the ability to copy those layers and remove the nondistributable flag using: regctl image copy ${upstream} ${local} --include-external regctl image mod ${local} --external-urls-rm --replace 4/ github.com/regclient/regc…

There's a big change happening for Windows images, redistribution of the Microsoft layers is now permitted in WS2019 and WS2022. 1/ techcommunity.microsoft.com/t5/containers/…