Better Docker image tags about oauth2-proxy HOT 5 CLOSED

@JoelSpeed Ping.

from oauth2-proxy.

Hey @lubo,

I'm not sure how I feel about these kinds of tags and have been trying to work out what I'd like to do about this going forward.

This style of tag can be great for large and firmly rooted software projects that have lots of maintainers and thorough release processes and very strict semver coherence. For a small project like this, where we have just taken over the ownership and are not entirely sure what the state of the project is, I don't know if we have enough investment from people to be this strict at present.

I know there are some breaking changes that have been raised in issues already and I'm sure there will be more as the project gains more momentum again. For now I am tempted to create minor tags that move but with the proviso that we aren't strictly sticking to semver and are unlikely to be backporting fixes, we simply don't have capacity for this much work.

On a different note, I personally wouldn't want to use a tag like this for a security themed project, for something like the OAuth2 Proxy that, when broken, would block access to many other services, this is the kind of thing where I would want to vet each release in a staging environment before promoting to production! Does that make sense?

@syscll Do you have anything to add?

from oauth2-proxy.

Hi, @JoelSpeed. Yes, it makes perfect sense. If the project doesn't strictly follow semantic versioning, then it's not very useful. But if it did, using minor tags in production shouldn't be a problem if the project publisher is trusted and the app is tested thoroughly, and it'd allow the operators to have more self-maintained infrastructure. Other tags, i.e. major and latest, are pretty much just a development convenience.

from oauth2-proxy.

This issue has been inactive for 60 days. If the issue is still relevant please comment to re-activate the issue. If no action is taken within 7 days, the issue will be marked closed.

from oauth2-proxy.

Closing as this is quite stale. Feel free to reopen if you have any other thoughts.

from oauth2-proxy.