Skip to content

Commit 5bcb16e

Browse files
Update readme
1 parent 01c2866 commit 5bcb16e

File tree

1 file changed

+17
-17
lines changed

1 file changed

+17
-17
lines changed

README.md

Lines changed: 17 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,10 @@
11
# Tape is for packaging applications
22

3+
## Disclaimer
4+
5+
This project is an archived experiment that was done as part of Docker Labs and is no longer worked on.
6+
It's been made available by Docker Labs team under the Apache license as it's deemed of potential interest to the community, however, it's no longer in active development.
7+
38
## What is Tape?
49

510
Tape is a tool that can package an entire application as a self-contained (taped) OCI image that can be deployed to a
@@ -37,7 +42,7 @@ provide a logical supply chain entry point and location for storing metadata.
3742

3843
The best analogy is flatpack furniture. Presently, deployment of an application is as if flatpack hasn't been invented, so
3944
when someone orders a wooden cabinet, all that arrives in a box is just the pieces of wood, they have to shop for nuts,
40-
bolts, and tools. Of course, that might be desirable for some, as they have a well stocked workshop with the best tools and
45+
bolts, and tools. Of course, that might be desirable for some, as they have a well-stocked workshop with the best tools and
4146
a decent selection of nuts and bolts. But did the box even include assembly instructions with the list of nuts and bolts
4247
one has to buy?
4348
That model doesn't scale to the consumer market. Of course, some consumers might have a toolbox, but very few will be able
@@ -53,10 +58,6 @@ source. The attestations are attached to the resulting OCI image, so it helps wi
5358

5459
## How does Tape work?
5560

56-
> NB: This describes the current implementation that is very minimal and doesn't achieve all of the ambitious goals
57-
> as described above. Namely it works only with plain YAML and JSON manifests and doesn't yet have key integrations,
58-
> e.g. with Helm or other tools.
59-
6061
Tape can parse a directory with Kubernetes configuration and find all canonical references to application images.
6162
If an image reference contains a digest, Tape will use it, otherwise it resolves it by making a registry API call.
6263
For each of the images, Tape searches of all well-known related tags, such as external signatures, attestations and
@@ -68,7 +69,7 @@ Copying of all application images and referencing by digest is performed to ensu
6869
are tightly coupled together to provide a single link in the supply chain as well as a single point of distribution
6970
and access control for the whole application.
7071

71-
Tape also checks the VCS provenance of manifests, so if any manifest files are checked in to Git, Tape will attest to what
72+
Tape also checks the VCS provenance of manifests, so if any manifest files are checked in Git, Tape will attest to what
7273
Git repository each file came from, all of the revision metadata, and whether it's been modified or not.
7374
Additionally, Tape attests to all key steps that it performs, e.g. original image references it detects and manifest
7475
checksums. It stores the attestations using in-toto format in an OCI artifact.
@@ -78,8 +79,8 @@ checksums. It stores the attestations using in-toto format in an OCI artifact.
7879
Tape has the following commands:
7980

8081
- `tape images` - examine images referenced by a given set of manifests before packaging them
81-
- `tape package` - package an artifcat and push it to a registry
82-
- `tape pull`downlowad and extract contents and attestations from an existing artifact
82+
- `tape package` - package an artifact and push it to a registry
83+
- `tape pull`download and extract contents and attestations from an existing artifact
8384
- `tape view` – inspect an existing artifact
8485

8586
### Example
@@ -430,14 +431,13 @@ $ crane blob ${podinfo_image}@${tape_attest_digest} | gunzip | jq .
430431
$
431432
```
432433

433-
## Roadmap & FAQ
434+
## FAQ
434435

435436
### What configuration formats does Tape support, does it support any kind of templating?
436437

437-
Presently, it supports plain JSON and YAML manifest. In the future, the goal is to accommodate a variety of popular
438-
templating options, e.g. CUE, Helm, and scripting languages, so that environment-specific parameters can be specified.
439-
It may also support basic runtime overrides with or without templating e.g. for namespaces and labels.
440-
It should also offer flexibility around templating at buildtime, runtime, or done partially buildtime/runtime.
438+
Tape supports plain JSON and YAML manifest, which was the scope of the original experiment.
439+
If the project was to continue, it could accommodate a variety of popular templating options,
440+
e.g. CUE, Helm, and scripting languages, paving a way for a universal artifact format.
441441

442442
### How does Tape relate to existing tools?
443443

@@ -451,20 +451,20 @@ support OCI artifacts and there could be different ways of building the artifact
451451

452452
### What kind of applications can Tape package?
453453

454-
Tape doesn't infer an opinion of how the application is structured, what it consists of or doesn't consist of. It doesn't
454+
Tape doesn't infer an opinion of how the application is structured, or what it consists of or doesn't consist of. It doesn't
455455
present any application definition format, it operates on plain Kubernetes manifests found in a directory.
456456

457457
### Does Tape provide SBOMs?
458458

459-
It doesn't create new SBOMs at the moment, but it may cater to this use case in the future.
459+
Tape doesn't explicitly generate or process SBOMs, but fundamentally it could provide functionality around that.
460460

461461
## Acknowledgments & Prior Art
462462

463463
What Tape does is very much in the spirit of Docker images, but it extends the idea by shifting the perspective to configuration
464464
as an entry point to a map of dependencies, as opposed to the forced separation of app images and configuration.
465465

466-
It's not a novelty to package configuration in OCI, there exist many examples of this practice, but there is no interoperability.
467-
Tape's ambition is to commoditise the model and abstract configuration tooling so that end-users don't need to think about whether
466+
It's not a novelty to package configuration in OCI, there are many examples of this, yet that in itself doesn't provide for interoperability.
467+
One could imagine something like Tape as a model that abstracts configuration tooling so that end-users don't need to think about whether
468468
a particular app needs to be deployed with Helm, Kustomize, or something else.
469469

470470
Tape was directly inspired by [flux push artifact](https://fluxcd.io/flux/cheatsheets/oci-artifacts/). Incidentally, it also resembles

0 commit comments

Comments
 (0)