Feature to pin docker images to docker.io

[vitoyucepi]

Hello.

I didn't find feature to pin docker registry images

• docker:stable to docker.io/library/docker:stable
• renovate/renovate:slim to docker.io/renovate/renovate:slim

[viceice]

This is not supported and also not planned

[rarkins]

What it means changing the dependency name, not the dependency version. We don't support changing the dependency name in any scenario yet

[vitoyucepi]

Should I create a feature request?

I haven't seen it anywhere in best practices.
Anyway I've already encountered this kind of issue when I tried to use podman.
By default podman tries to get image from localhost.

[rarkins]

Essentially it's #5535, or at least completely dependent on it.

[vitoyucepi]

Also this feature can be used to mitigate supply chain attacks.

[rarkins]

Using a SHA digest in each image my preferred choice