Moving docker image default registry

With some recent ci work in the stacks-core repo, we’ve made a decision to move the default docker image registry from docker.io (i.e. docker hub) to ghcr.io (github container registry).

There were a few reasons that led to this decision, but the main one that matters is security - by not using any external dependencies, we can further protect against potential supply-side attacks if that external key were ever leaked.

There will also be a future announcement when the work has been merged - this post serves as a notification that it will be happening in the near future and to keep an eye out for when that change is made.

However, we also ack that simply running docker pull blockstack/stacks-core:3.3.0.0.4 etc is easy and changing that may break downstream automation. So, we’re also preparing a mirroring option that will copy any images published to ghcr over to docker hub so that same docker pull ... command will still work. The caveat is there will be a slight delay between when the official images are published and when they are published to blockstack/stacks-core - Docker Image and blockstack/stacks-signer - Docker Image.

2 Likes

As of 3.3.0.0.6, ghcr is now the default for release images and the legacy dockerhub location will remain as a mirror.

One thing to note: we chose to not publish the legacy docker hub naming of blockstack/stacks-blockchain, preferring the naming used after the github repository was renamed to stacks-core a few years back.

If you’re still using this legacy image naming blockstack/stacks-blockchain, simply update to blockstack/stacks-core, or let me know here if there’s a requirement where the legacy image name is still needed.

1 Like