Docker Containers: Mistake in digest-storage on Quay

[Crow-Control]

Currently there exists this quay registry for the volsync images:
https://quay.io/repository/backube/volsync?tab=tags&tag=latest

However, Quay has a quirk (one could call it a bug): It does NOT preserve older digests when new versions as pushed. Leading to set digests to disappear and become unreachable after a certain amount of time

To prevent this, Backube/Volsync, should push an extra tag on each push based on either the GitHub or container hash as tag. This ensures all digests on quay keep being available.

---

To be clear: this is not standard behavior, GHCR and Dockerhub work fine without this fix. It's purely a Quay.io bug/problem. However, digest retention is crucial for secure deployments of volsync using Quay and digest pinning.

[tesshuflower]

I was starting on a PR for this, but it's been pointed out to me that if we do use unique additional labels, then we don't have any cleanup mechanism, and we'll get a new image saved permanently on every push to main.

I think if you want to pin digests, your safest route is to use a tagged release (such as v0.13.1) as those tags will not move. Tags related to branches such as release-0.13 or latest will move according to the latest commit on the main or release-xy branch.

[Crow-Control]

then we don't have any cleanup mechanism

It's absolutely normal for literally every other container repository (ghcr and dockerhub primarily) to not remove old digests. Thats actually by-design intentional behavior that Quay ignored.

I think if you want to pin digests, your safest route is to use a tagged release

Some systems and downstream automatically digest pin any tag present, because thats the normal and safest way to ensure unmutability.

---

Not implementing this basically throws the best-practice of digest pinning out of the window, which is not acceptable as enterprise-oriented software.

Even worse, barely anyone knows digest pinning on quay is broken (unless the tag-fix is implemented), leading to administrators being surprised by this behavior.

[Crow-Control]

*just to be clear, based on the note about having one digest pinned for every push to main:

You should only do this for release pushes, not for nightlies as those dont really need digest pinning.

[tesshuflower]

I think you can think of tags like latest and release-x.y as nightlies, as these are essentially built on every commit to those branches, and are not releases. The release tags such as 0.13.1 aren't moving, so digests should not be cleaned up for releases.