this post was submitted on 11 Jul 2023
6 points (100.0% liked)
Lemmy Support
4660 readers
25 users here now
Support / questions about Lemmy.
founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
I really do trust both of these projects and the community mindedness of their owners. Does someone know how you'd go about verifying a 3rd party image hasn't diverged from the official project image?
You read the Dockerfile https://hub.docker.com/layers/masquernya/lemmy/0.18.2-linux-arm64/images/sha256-f1501bab2574cf371673d0926fdecd5b61e00d77e637ebc4f43a31ecbc029270?context=explore
To me the first line is pretty opaque
Maybe that hash lines up with a version of Lemmy, otherwise it's just a hash of a mystery block of files that could contain anything.
Here's an example dockerfile I wrote (for a different project) that's a little more transparent