[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Removal of docker.io from jessie

The security team has concerns that docker.io cannot be maintained in

I asked upstream about the Go version commitment (we cannot rebase to
Go 1.4 or later in jessie because it could break user code):


(Not sure if this link will work, it obviously requires Javascript.
It should point to the docker-dev thread, “Go version requirement”,
started on 2015-03-15.)

I think the Go version issue has been adequately addressed, but other
parts of the thread show that there is no clear plan how to rebase
docker.io to a new upstream version once this becomes necessary.
Hence our concerns about maintainability.

(The rebase question is not entirely theoretical.  Upstream has
previously acknowledged that “the v1 registry has a flawed design”:


The v1 registry protocol is what is implemented in docker.io 1.3.3.
Debian does not run its own trusted registry, so our users are fully
exposed to these design issues.)

Reply to: