Quay image tags overwritten? SHAs purged?

Describe the bug

It looks like public keycloak images get purged when a tag is overwritten. I am pinning my keycloak image refs with SHAs but the images are very soon not retrievable anymore. Main tag I am using: 17.0.1-legacy

My questions:

• why are tags overwritten? Shouldn’t a tag be stable?
• if a tag is overwritten, why is the old SHA not available any more?

Version

17.0.1-legacy

Expected behavior

Images to stay available at Quay.io

Actual behavior

Images get deleted why tags are overwritten.

How to Reproduce?

No response

Anything else?

No response

[stianst]

I fully appreciate the SHA pinning issue, and we should figure out some solution to this issue. The problem here is when we re-spin the images rather than release a new version of Keycloak we end up publishing the updated container with the same tags.

Not quite sure how we should handle the re-spins and automate the tags there. At the moment this is how we set tags:

https://github.com/keycloak/keycloak/blob/0efa4afd493de0cb62501301f8a6828e95ea4982/.github/workflows/release-container.yml#L23-L31

Typically a re-spin would have an incremental number (something like 18.0.1-1, 18.0.1-2, etc.), but that would require checking what the last number is to increment it. Another option may be possible to just add a date based tag (18.0.1-20220501 for example).

It’s not something I can prioritize looking at right now, and we’ve done in this way for quite a long time, but if someone has a clean proposal I’d be more than welcome to review it. If not I’ll take a look at it in a few weeks hopefully.

[maapteh]

@stianst can you maybe help us a little more about this issue maybe? We have the same issue and use SHA from security perspective as well!