Drone

Proposal: add the global configuration to force to pull Docker image on every step

If the private Docker image is pulled once on a server,
builds run on the same server can use the private image without authentication.

But in terms of security, it may be dangerous.
So I propose to add the configuration to force to pull Docker image on every step, which means every step can’t use the local image on Drone agent.

For example, add the environment variable “DRONE_IMAGE_PULL_ALWAYS”.
By default the environment variable is “false” but if the environment is “true”, on every step “pull” setting is ignored and Docker image is pulled.

I want to know your opinions about it.

Thank you.

I have implemented this feature.
In the implementation, if the environment variable “DRONE_IMAGE_PULL_ALWAYS” is true
the pull setting of every step and service are overwritten to “always”.
It works well.

This problem occurs in other platform such as CircleCI and k8s, so I’m interested in how those platform are dealing with this problem.
It may be useful for Drone too.