Changing base images to cgr.dev/chainguard/static

[imjasonh]

Changing base images to cgr.dev/chainguard/static

[psschwei]

Other than having to remember to pass --sbom=none (I use Quay as my ko repo), I didn't run into any issues using it as part of my local dev workflow for Serving. Assuming no one has strong objections, I'd be ok with making this change.

[dprotaso]

I'm switching serving over to the chainguard images - my main concern was really GitHub registry stability etc. but with you moving to R2 i'm less concerned now.

/assign @pierDipi for eventing

[mattmoor]

FWIW we've been using these in our hakn repackaging of knative serving without any issues for some time now.

[imjasonh]

cc @knative/technical-oversight-committee for visibility

[dprotaso]

My only concern is the use of the cgr.dev domain. Do you have mirrors of these images on public registries?

[imjasonh]

My only concern is the use of the cgr.dev domain. Do you have mirrors of these images on public registries?

That's understandable.

We don't currently have mirrors onto other registries, but might consider it.

The specific concern would be that if cgr.dev is down, any releases or e2e tests of Knative would be broken until it becomes available again, correct? If so, some of that could be alleviated by having a separate process mirror cgr.dev/chainguard/static into gcr.io/knative-releases/... (and its SBOMs, signatures, etc.), and then basing Knative's images on that copy. That at least gives you a fallback in case cgr.dev is unavailable, at the cost of a bit more automation to handle that mirroring. If that's something you'd like to explore I can help with that too.

In any case, once Knative builds its images the reachability of cgr.dev is moot, since Knative serves all its image contents from gcr.io.

[dprotaso]

The specific concern would be that if cgr.dev is down, any releases or e2e tests of Knative would be broken until it becomes available again, correct?

Yup

If that's something you'd like to explore I can help with that too.

Do you also push to other registries?

[dprotaso]

Following up based on https://www.chainguard.dev/unchained/changes-to-static-git-and-busybox-developer-images-2

The chainguard main images don't support s390x/ppc arch. The recommendation is to use ghcr.io/wolfi-dev/static:alpine

I'll be updating serving repos in response.

Details: https://www.chainguard.dev/unchained/changes-to-static-git-and-busybox-developer-images-2
knative/serving#15407