3

Elastic Container Registry (ECR) for example supports Tag Immutability (TI). TI implies that docker tags cannot be overwritten if they exist in a docker-registry.

The settings of the organization and the ones from a repository were inspected, but no TI setting was found.

Questions

  • Does quay support TI?
  • If true, how to enable it
  • If false, how do you or does your organization prevent that tag overwrite takes place?
Improve this question

1 Answer 1

Reset to default
3

At first glance, it seems that tag immutability is not a feature provided by Quay. You can enable "Trust and Signing" in the "settings" of the repo:

Please note that this will not prevent users from overwriting signed tags without updating signatures. This means that:

  • Any tag operations in the UI or client can cause inconsistency
  • Builds should not push to signed tags

We recommend you maintain a strict separation between signed and unsigned tags to avoid any issues with garbage collection.

So, you can sign tags, but you can't prevent them from being updated.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.