Disable caching to avoid any possibility of cache poisoning #658
Conversation
| @@ -90,6 +90,8 @@ jobs: | |||
|
|
|||
| - name: Set up Docker Buildx | |||
| uses: docker/setup-buildx-action@6524bf65af31da8d45b59e8c27de4bd072b392f5 # v3.8.0 | |||
| with: | |||
| cache-binary: false | |||
There was a problem hiding this comment.
Should we be dropping the earlier pull if we are disabling all layer caches?
There was a problem hiding this comment.
That part should be okay since it's not coming from a GitHub Actions cache, but from a docker pull that you key explicitly with a matrix expansion that's 100% under your control 🙂
There was a problem hiding this comment.
I don't think it's needed. The cache poisoning risk here is mostly that we have no visibility into how it bleeds from PR -> push. With the docker pull, we do know that PRs can't impact prod images.
There was a problem hiding this comment.
I think my question is whether it’ll even use those layers with this option enabled, not whether they’re safe
There was a problem hiding this comment.
Yeah, so this setting controls caching of the buildx binary itself, not the docker image.
|
I have no idea what cache binary is actually caching tbh
…On Sun, Jan 5, 2025, 10:30 AM Paul Kehrer ***@***.***> wrote:
***@***.**** commented on this pull request.
------------------------------
In .github/workflows/build-docker-images.yml
<#658 (comment)>:
> @@ -90,6 +90,8 @@ jobs:
- name: Set up Docker Buildx
uses: ***@***.*** # v3.8.0
+ with:
+ cache-binary: false
I think my question is whether it’ll even use those layers with this
option enabled, not whether they’re safe
—
Reply to this email directly, view it on GitHub
<#658 (comment)>, or
unsubscribe
<https://github.com/notifications/unsubscribe-auth/AAAAGBCOHZOZPIYHPM7DWXT2JFFYTAVCNFSM6AAAAABUUD52MWVHI2DSMVQWIX3LMV43YUDVNRWFEZLROVSXG5CSMV3GSZLXHMZDKMZQHEZDCMBTGA>
.
You are receiving this because you authored the thread.Message ID:
***@***.***>
|
No description provided.