Docker Plugin

[verdverm]

Moving docker-library/official-images#6838 here

The general idea is to explore the possibility of writing a Docker CLI Plugin so that container signing can be easier to adopt into existing workflows. Ideally, the UX could be something as minimal as docker plugin install sigstore/cosign-docker-plugin and would support pushing the signature to the same registry the container is going.

@dlorenc, here is a link to get started. I haven't explored it enough to know if this is possible yet.

https://docs.docker.com/engine/extend/

[verdverm]

moby/moby#43044

docker/roadmap#269

[Johannestegner]

Just wanted to leave a note that the /engine/extend link is not docs for CLI-plugins (docs for cli plugins is a pain to find and I can't even find a link for it to leave here).
I've played around a bit with the CLI plugin Go lib by looking at "official" plugins such as buildx and the cli plugin code in the docker repo: https://github.com/docker/cli/tree/master/cli-plugins

Implementing it as a docker cli-plugin could probably be fairly easy (just to have cosign work through some type of docker cosign command), making it work with buildx and such might be a larger job (which likely would have to require some additions to the buildx codebase) though!

Either way it's a great idea and would love to see it implemented! :)

[dlorenc]

Thanks @Johannestegner! That helps a lot. I know CLI plugins exist but couldn't find any docs!

[developer-guy]

Hello, there is some useful information out there about Docker CLI plugins, here are some:

• CLI Plugins Design docker/cli#1534
• https://dille.name/slides/2019-11-13/020_advanced/080_docker_cli_plugins/slides.final/
• https://github.com/lukaszlach/clip

Seems it is all about managing the binary name and directory stuff, then all should work, right @Johannestegner ?

[Johannestegner]

Seems it is all about managing the binary name and directory stuff, then all should work, right @Johannestegner ?

Yes, basically, the plugin is only required to implement a very simple interface.
It have to be able to answer to a meta-data call, other than that, it's just a executable which is named docker-<plugin name>.

Imho, a very simple and elegant way to implement plugins (sure, users will have to trust the author to quite a high degree, but other than that, very helpful for plugin developers).

Personally, I do prefer to build them with Go, as that gives one access to both the interface and api from docker directly, as well as the ease of working with cobra.Command and such, but a plugin can (in theory) be implemented in anything that is executable :)

[dlorenc]

cc @imjasonh who made one!

[imjasonh]

cc @imjasonh who made one!

It's true! https://github.com/imjasonh/cosign-docker-cli-plugins

[haydentherapper]

Closing as unplanned since there's an existing plugin from Jason, feel free to reopen