Use image annotations to split public and internal EOL lifecycle annotations

已关闭
  • 哪里不对？
#2,153 0 条评论 0 个 reaction 已指派 1 人 在 GitHub 查看

维护者通常 1 天内回复

@lbussell 已经在做这个了。

开始于 2026年7月13日。

评估

这个 Issue 还没有评估数据。

描述

area-infrastructure
Background
  • Azure container registries are automatically onboarded to vulnerability scanning.
  • Keeping staged and previously-published images around for a short period of time is useful - however, they may go out of date quickly as new vulnerabilities are discovered and images are re-built/updated. This causes vulnerability scanning to provide useless alerts for images that aren't actually supported or sometimes not even published.
  • Vulnerability scanning automatically ignores images with EOL lifecycle annotations.

Previously, we annotated all staged/internal/unsupported images internally with EOL lifecycle annotations so that they would be ignored in secret scanning, leaving only the official and supported images onboarded to scanning, keeping scan results actionable.

However, ImageBuilder now copies all referrer artifacts out of the container registry upon publish. This could cause publicly supported images to be marked as EOL (https://github.com/dotnet/docker-tools/issues/2066). Due to this, EOL annotation generation is temprarily disabled in nearly all repos using ImageBuilder. Thus, vulnerability scan results are now less useful/actionable again.

Background to the background

Container image lifecycle metadata comes in the form of OCI referrer artifacts.

Annotations can be applied to any OCI artifacts. Don't conflate them with referrer artifacts.

In the following example,

  • The artifact is of type application/vnd.microsoft.artifact.lifecycle and it refers to myregistry.azurecr.io/dotnet/runtime@sha256:aaa111
  • The annotation has a key of vnd.microsoft.artifact.lifecycle.end-of-life.date and a value of 2026-01-01T00:00:00Z
oras attach \
  --artifact-type "application/vnd.microsoft.artifact.lifecycle" \
  --annotation "vnd.microsoft.artifact.lifecycle.end-of-life.date=2026-01-01T00:00:00Z" \
  myregistry.azurecr.io/dotnet/runtime@sha256:aaa111
Proposal

There should be two distinct types of lifecycle artifacts managed by ImageBuilder:

  • Those that are applied to public images after they are replaced/re-built.
  • Those that are applied to internal images in our ACR to keep vulnerability scanning accurate/actionable.

We can use a new annotation in order to delineate between the two different types of refrerrer artifacts. I propose vnd.microsoft.dotnet.imagebuilder.internal. Example:

oras attach \
  --artifact-type "application/vnd.microsoft.artifact.lifecycle" \
  --annotation "vnd.microsoft.artifact.lifecycle.end-of-life.date=2026-01-01T00:00:00Z" \
  --annotation "vnd.microsoft.dotnet.imagebuilder.internal=true" \
  myregistry.azurecr.io/dotnet/runtime@sha256:aaa111

When ImageBuilder copies referrer artifacts from internal to public, it should read the annotations and always skip artifacts that have the annotation vnd.microsoft.dotnet.imagebuilder.internal=true. This can apply to any referrer artifacts, not just lifecycle metadata.

This would allow ImageBuilder to blanket annotate all build artifacts/historical images in an ACR as EOL without any concern for those artifacts leaking publicly.

主要语言
C#
星标
181
派生
68
平均合并
3 天 20 小时
30 天内合并 PR
12

环境准备

在 Codespaces 中打开

在浏览器里用你自己的 GitHub 账号启动这个项目的开发容器。

  • 没有 Dockerfile 或 Docker Compose 文件
  • 没有 Pull Request 模板
  • 没有贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

dotnet/docker-tools 的其他 Issue

查看 dotnet/docker-tools 的全部 Issue

相似的 Issue

更多 C# Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。