Moving docker image default registry

With some recent ci work in the stacks-core repo, we’ve made a decision to move the default docker image registry from docker.io (i.e. docker hub) to ghcr.io (github container registry).

There were a few reasons that led to this decision, but the main one that matters is security - by not using any external dependencies, we can further protect against potential supply-side attacks if that external key were ever leaked.

There will also be a future announcement when the work has been merged - this post serves as a notification that it will be happening in the near future and to keep an eye out for when that change is made.

However, we also ack that simply running docker pull blockstack/stacks-core:3.3.0.0.4 etc is easy and changing that may break downstream automation. So, we’re also preparing a mirroring option that will copy any images published to ghcr over to docker hub so that same docker pull ... command will still work. The caveat is there will be a slight delay between when the official images are published and when they are published to blockstack/stacks-core - Docker Image and blockstack/stacks-signer - Docker Image.

2 Likes