You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: config.md
+6-5Lines changed: 6 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -50,19 +50,20 @@ For this, we define the binary `|` operation to be the result of applying the ri
50
50
For example, given base layer `A` and a changeset `B`, we refer to the result of applying `B` to `A` as `A|B`.
51
51
52
52
Above, we define the `ChainID` for a single layer (`L₀`) as equivalent to the `DiffID` for that layer.
53
-
Otherwise, the `ChainID` for `L₀|...|Lₙ₋₁|Lₙ` is defined as recursion `Digest(ChainID(L₀|...|Lₙ₋₁) + " " + DiffID(Lₙ))`.
53
+
Otherwise, the `ChainID` for a set of applied layers (`L₀|...|Lₙ₋₁|Lₙ`) is defined as the recursion `Digest(ChainID(L₀|...|Lₙ₋₁) + " " + DiffID(Lₙ))`.
54
54
55
55
#### Explanation
56
56
57
57
Let's say we have layers A, B, C, ordered from bottom to top, where A is the base and C is the top.
58
58
Defining `|` as a binary application operator, the root filesystem may be `A|B|C`.
59
59
While it is implied that `C` is only useful when applied to `A|B`, the identifier `C` is insufficient to identify this result, as we'd have the equality `C = A|B|C`, which isn't true.
60
60
61
-
The main issue is when we have two definitions of `C`, `C = C` and `C = A|B|C`. If this is true (with some handwaving), `C = x|C` where `x = any application` must be true.
61
+
The main issue is when we have two definitions of `C`, `C = C` and `C = A|B|C`.
62
+
If this is true (with some handwaving), `C = x|C` where `x = any application` must be true.
62
63
This means that if an attacker can define `x`, relying on `C` provides no guarantee that the layers were applied in any order.
63
64
64
65
The `ChainID` addresses this problem by being defined as a compound hash.
65
-
__We differentiate the changeset `C`, from the orderdependent application `A|B|C` by saying that the resulting rootfs is identified by ChainID(A|B|C), which can be calculated by `ImageConfig.rootfs`.__
66
+
__We differentiate the changeset `C`, from the order-dependent application `A|B|C` by saying that the resulting rootfs is identified by ChainID(A|B|C), which can be calculated by `ImageConfig.rootfs`.__
66
67
67
68
Let's expand the definition of `ChainID(A|B|C)` to explore its internal structure:
@@ -85,7 +86,7 @@ Most importantly, we can easily see that `ChainID(C) != ChainID(A|B|C)`, otherwi
85
86
86
87
Each image's ID is given by the SHA256 hash of its [configuration JSON](#image-json).
87
88
It is represented as a hexadecimal encoding of 256 bits, e.g., `sha256:a9561eb1b190625c9adb5a9513e72c4dedafc1cb2d4c5236c9a6957ec7dfd5a9`.
88
-
Since the [configuration JSON](#image-json) that gets hashed references hashes of each layer in the image, this formulation of the ImageID makes images content-addresable.
89
+
Since the [configuration JSON](#image-json) that gets hashed references hashes of each layer in the image, this formulation of the ImageID makes images content-addressable.
0 commit comments