You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+17-17Lines changed: 17 additions & 17 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,5 +1,10 @@
1
1
# Tape is for packaging applications
2
2
3
+
## Disclaimer
4
+
5
+
This project is an archived experiment that was done as part of Docker Labs and is no longer worked on.
6
+
It's been made available by Docker Labs team under the Apache license as it's deemed of potential interest to the community, however, it's no longer in active development.
7
+
3
8
## What is Tape?
4
9
5
10
Tape is a tool that can package an entire application as a self-contained (taped) OCI image that can be deployed to a
@@ -37,7 +42,7 @@ provide a logical supply chain entry point and location for storing metadata.
37
42
38
43
The best analogy is flatpack furniture. Presently, deployment of an application is as if flatpack hasn't been invented, so
39
44
when someone orders a wooden cabinet, all that arrives in a box is just the pieces of wood, they have to shop for nuts,
40
-
bolts, and tools. Of course, that might be desirable for some, as they have a wellstocked workshop with the best tools and
45
+
bolts, and tools. Of course, that might be desirable for some, as they have a well-stocked workshop with the best tools and
41
46
a decent selection of nuts and bolts. But did the box even include assembly instructions with the list of nuts and bolts
42
47
one has to buy?
43
48
That model doesn't scale to the consumer market. Of course, some consumers might have a toolbox, but very few will be able
@@ -53,10 +58,6 @@ source. The attestations are attached to the resulting OCI image, so it helps wi
53
58
54
59
## How does Tape work?
55
60
56
-
> NB: This describes the current implementation that is very minimal and doesn't achieve all of the ambitious goals
57
-
> as described above. Namely it works only with plain YAML and JSON manifests and doesn't yet have key integrations,
58
-
> e.g. with Helm or other tools.
59
-
60
61
Tape can parse a directory with Kubernetes configuration and find all canonical references to application images.
61
62
If an image reference contains a digest, Tape will use it, otherwise it resolves it by making a registry API call.
62
63
For each of the images, Tape searches of all well-known related tags, such as external signatures, attestations and
@@ -68,7 +69,7 @@ Copying of all application images and referencing by digest is performed to ensu
68
69
are tightly coupled together to provide a single link in the supply chain as well as a single point of distribution
69
70
and access control for the whole application.
70
71
71
-
Tape also checks the VCS provenance of manifests, so if any manifest files are checked in to Git, Tape will attest to what
72
+
Tape also checks the VCS provenance of manifests, so if any manifest files are checked in Git, Tape will attest to what
72
73
Git repository each file came from, all of the revision metadata, and whether it's been modified or not.
73
74
Additionally, Tape attests to all key steps that it performs, e.g. original image references it detects and manifest
74
75
checksums. It stores the attestations using in-toto format in an OCI artifact.
@@ -78,8 +79,8 @@ checksums. It stores the attestations using in-toto format in an OCI artifact.
78
79
Tape has the following commands:
79
80
80
81
-`tape images` - examine images referenced by a given set of manifests before packaging them
81
-
-`tape package` - package an artifcat and push it to a registry
82
-
-`tape pull` – downlowad and extract contents and attestations from an existing artifact
82
+
-`tape package` - package an artifact and push it to a registry
83
+
-`tape pull` – download and extract contents and attestations from an existing artifact
0 commit comments