tree 4a54fd0555c31b478d1e5c8bc99c694319a92947
parent 6c9a860d06bd0859a8483e67fe200ddb763dda57
author Geoffrey Martin-Noble <gcmn@google.com> 1606952168 -0800
committer GitHub <noreply@github.com> 1606952168 -0800
gpgsig -----BEGIN PGP SIGNATURE-----
 
 wsBcBAABCAAQBQJfyCToCRBK7hj4Ov3rIwAAdHIIAD0K4Y61QKhOlgZBZ1y/O8UN
 fhUJJ40/YCF/U2hHio49WyfvQ+qc61ivyX5Z1ShU6P+DDuvONiBfDtUmxKpHGM5M
 RQOOhc8yy3JQZmRqewSZNM7Xa5iwDDFbB1U1bE/xDL5mWdlKiUHh2F0x52OKnJCG
 ijKe0C5GJjOunY3RY+H3duPEsK4KK+N/GY0TyvEnNaoRLcil6TQsJ89T/7wAjkxu
 SJVIAKVYLGYqOZaWiuXI30HiylcIf2R0Odfll6iTNkouEWrl2CsTDxvNgM0s1liA
 Yv3jmWHvN5stcE1NxBiu97X6dHPZYmTcrWzd36DsJErerdctJldqWihSBfVv/OM=
 =LF/j
 -----END PGP SIGNATURE-----
 

Pin all docker images to digests (#4047)

This dramatically increases the reproducibility of Docker builds and
avoids painful debugging experiences due to inconsistent Docker
caching. Note I was able to delete the entire "Debugging" section. I
was also able to remove basically all the arguments to
`manage_images.py`.

The cost is that using the script now always uploads to GCR which takes
time and requires permissions. Given that this is required to test the
images anyway, this seems not too great a cost. Personally, I've spent
way more time dealing with weird Docker edge cases than pushing images.
People can always fall back to standard Docker commands for local
iteration.