Topic

Container Registries and Artefact Mirroring

Relocating images, Helm charts and OCI artefacts into self-operated registries to remove dependence on external registry policy.

Current stories

productConfirmed3 publishers

Docker Hub account conversions carried personal access tokens to a new owner for 765 days

Docker fixed critical Docker Hub flaw CVE-2026-105445 under four hours after a report, ending a 765-day exposure window. Docker says it found no evidence of exploitation; the open check for teams is whether anyone of theirs was named owner in a conversion.

Publishers:bleepingcomputer.com docker.com scworld.com thehackernews.com

Perspective Coverage

4 publishers

Builder: Builder 34%
Operator: Operator 51%
Investor: Investor 15%

Reality

Evidence68
Adoption: Not scored
Hype gap+8
Incentives50
Confidence72

buildOne report1 publisher

Registry logs show Compose v5.5.1 ignoring pull_policy windows on explicit pulls

Docker Compose v5.5.1 hit the registry on all three explicit pulls in a developer's test, though its v5.5.0 changelog says pull now honors refresh windows. For CI pipelines built around an explicit pull step, the upgrade bought no fewer registry calls in that test.

Publishers:dev.to

Reality

Evidence55
Adoption: Not scored
Hype gap+25
Incentives: Not scored
Confidence50

buildOne report1 publisher

Server-side apply moves ArgoCD's diff into the Kubernetes API server

ArgoCD now hands diff calculation to the API server and accepts OCI registries as first-class sources. The same write-up still calls Git the sole source of truth, so teams pulling charts from Harbor have to decide which system records intent.

Publishers:dev.to

Reality

Evidence24
Adoption30
Hype gap+34
Incentives: Not scored
Confidence35

buildOne report1 publisher

The App Runner exit starts with two IAM roles you write yourself

A dev.to walkthrough says AWS App Runner no longer accepts new services, and the Amazon ECS Express Mode path it demonstrates opens with an execution role, an infrastructure role, and a public container image.

Publishers:dev.to

Reality

Evidence45
Adoption12
Hype gap+25
Incentives22
Confidence48

productOne report1 publisher

Docker puts Verified Publisher behind a signup form, and pull data behind a plan

Verified Publisher applications are now self-serve with two plans, priority search ranking and reports that name the companies pulling your images.

Publishers:docker.com

Reality

Evidence38
Adoption32
Hype gap+28
Incentives88
Confidence56

buildOne report1 publisher

Flux moves GitOps' source of truth into registries you own, and mirroring becomes the prerequisite

Flux Mirror ships as a v2.9 CLI plugin that copies images, charts and desired-state artifacts from a config file. The Bitnami catalogue freeze is the argument for using it.

Publishers:infoq.com

Reality

Evidence42
Adoption15
Hype gap+27
Incentives72
Confidence46