Presentation by Krish Garimella, Sr. Director of Engineering, Docker and Mario Ponticello, Product Manager, Docker Learn more about Official Repositories and the process behind securing and maintaining images in collaboration with upstream partners. We will also introduce Project Nautilus.

1. Docker Content
Official Repos, Project Nautilus, and the content ecosystem
Krish Garimella
& Mario Ponticello

2. Docker adoption is driven by
great content!

3. 1+ billion
pulls

4. 1+ billion
pulls
Library
bountylabskubernetes
schibstedpaym
ent
gilderlabs
barchart
deis
progrium
m
esos

5. 1+ billion
pulls
Library
bountylabskubernetes
schibstedpaym
ent
gilderlabs
barchart
deis
progrium
m
esos
Docker
Official Repos

6. Why are Official Repos so
successful?

7. …and security!
Made with love and care…

8. …by our partners

10. Maintaining the Jenkins Official Repo
Nicolas De Loof, Jenkins
@ndeloof, nicolas.deloof@gmail.com

11. Why yet another Jenkins image?

12. • We wanted to make Jenkins a first-class Docker
citizen
• We wanted to get the Docker community involved
• We wanted to learn!
• We planned to use Docker for our own product
Because…

13. • How to set users, permissions, volumes, entrypoint…
• We disagreed with some of them…
• Argued…
• Read the docs…
• Had to adapt to get the image approved…
• And now, we admit that the best practices are good!
Embracing best practices

14. • We learned a great deal:
• Usages
• Best practices
• User misunderstanding
• Extensibility
• Docker itself!
• Possible improvements to
Jenkins to make it more
Docker-friendly
Getting feedback/contributions

15. For example…

16. • Human-based review
• https://github.com/docker-library/official-images/
pulls
• Fairly fast for minor changes
• They want to limit the number of tags
• Not my initial use-case
• As a support engineer, I wanted all versions on Hub
Limitations

17. • Release early and often
• PR review is faster (~24h) if you don’t introduce
big-bang changes
• Mix official with classic
• Jenkins weekly releases are published as
jenkinsci/jenkins based on the exact same
Dockerfile (sed)
Workarounds

18. Jenkins job
Jenkins job
Dockerfile jenkins
PR to « official » library
jenkinsci/
jenkins
cloudbees/
jenkins-
enterprise
sed s/LTS/weekly Dockerfile
Dockerfilesed s/OSS/cloudbees
Publication workflow

19. Thank you!
Nicolas De Loof, Jenkins
@ndeloof, nicolas.deloof@gmail.com

20. What are users saying?

21. We want more great content!
The President of
Docker Users

22. …and secure images!

23. …and optimized images!

24. Amazing
apps
Community
Images
Curated
Images
Content curation today

25. Amazing
apps
Community
Images
Curated Images
What we need

26. 1. Scale up the security posture assessment
2. Notify users of new vulnerabilities in existing code
proactively
3. Provide visibility to end-users on the security
posture of images
Project Nautilus goals

27. • Project Nautilus is an image-scanning service that makes it easier to
build and consume high-integrity content
• Steps through a sequence of tests, including:
• Image security
• Component inventory/license management
• Image optimization
• Basic functional testing
• Functions as a source of truth for certification metadata
• Has an extensible backend; may support 3rd-party plugins
Project Nautilus details

28. Docker scans
derived images
Docker works
with partners to
fix OS images
Publisher
resubmits
image
Publisher
calibrates
dependencies
Docker and
publisher
release clean
image
Project Nautilus process

29. API
Docker
Image
Scanning
CVE Scanning
Security
Scan
SW Inventory
and License
Image
Optimization
Plugins
Validation
Microservices
HUB
End Users
Publishers
Notifications
…
Registry
…
Project Nautilus architecture

41. • To submit an Official Repo, visit https://
docs.docker.com/docker-hub/official_repos/
• To learn more about Nautilus, email us at
content@docker.com
Get involved