[question] Base images on snapshots.ros.org?

[mikaelarguedas]

There are now snapshots repositories providing ROS packages for every new sync (discourse announcement).

Characteristics of the snapshots repositories:

• snapshots are kept for at least 6 months during the lifetime of the distribution
• when a ROS distribution goes end of life, its packages are removed from packages.ros.org and moved to a final snapshot on snapshots.ros.org
• snapshots of the final sync of a distribution will be kept at least 6 months after the distro is EOL

Docker images for EOL ROS distributions will be built once using the final snapshot and then be removed from the docker hub build farm.

This proposal is to evaluate the value of using those in the docker images of active ROS distributions:

Changes in the docker images if using the new repositories

• After each sync, the Dockerfiles will be updated to point to the URL specific to that ROS sync (e.g. http://snapshots.ros.org/melodic/2019-07-30/) (should fix [ros] Provide exact version numbers to ensure rebuilds #112)
• This URL is architecture independent, this means that the same dockerfile can still be used for e.g. Ubuntu Bionic amd64/armhf and arm64
• Need to extend the automatic image generation to produce new dockerfiles at each sync to be PR'd to the official docker library (similar to Release hash script and update hashes #230)
• Additional aliases will be added with the sync timestamp in it

Pros:

• builds of the images will be reproducible as the packages in a given snapshot repository will never change
• images will be up to date as the URL change will cause a cache burst
• users will be able to pull images of a past sync (Preserve snapshot version of images? #197)

Cons:

• people using a ROS image after 6+ months without pulling a new version / updating the URL will not be able to install ROS packages (as the apt repo will not exist anymore)

@nuclearsandwich @tfoote is this description accurate?

---

@yosifkit @tianon Is this a pattern that has been seen / is acceptable for official docker images?

[nuclearsandwich]

* people using a ROS image after 6+ months without pulling a new version / updating the URL will not be able to install ROS packages (as the apt repo will not exist anymore)

We haven't done any removal of old snapshots yet. The six-month commitment is there to set a minimum bar while we try out hosting snapshots and gives us an out if hosting them becomes prohibitively expensive. I feel like a case could be made for extending the guarantee window from 6 to 12 months if that lessens this concern.

I think a more serious trade-off is that images based on snapshot repositories will not receive any package updates unless the repository configuration is updated. Now depending on your image build pipeline getting updates might not be nearly as important as getting a consistent and reproducible repository state but any team who is nursing a constructed base image rather than regenerating one periodically is going to be locked out of sync updates unless they know to update the snapshot repository.