[actual-server] Why not use the official image? about docker-templates

[hofq]

The Official image was not available on the release of my Template.
i can't follow you on how you think it's concerning, since you can see every step of the Build Process in Github.
I will switch it if i have checked the Official Image & Build, probably in the next days.

[PartyLich]

While the build process is visible, my concern is that it is building a fork of the actual repo. At present that fork matches upstream, as I noted. The central issue is extending trust to an additional party. The lesser issue is providing support for users who are not running the main repo's code. It is worth noting that, initially, you've been a great help to those users on unraid making use of your template. Thank you for that!

If a vulnerability/CVE/etc is patched upstream but your personal engagements prevent pulling those changes into the fork in a timely manner, anyone relying on the unraid image is exposed. If you wake up tomorrow and decide you have some nefarious intent, you can modify that fork accordingly. It's happened with npm packages (edit to add: or log4j if you're looking for recency and size). It's happened with browser plugins. I have zero reason to think that's likely with you specifically, but there is precedent.

A downstream user of the unraid CA now has to assign as much trust to you as they have to Actual's maintainer and contributors. If you're not intending any modification, maintaining a fork presents extra work without any benefit. I'm not sure what one would see as advantageous about that, but please share any advantages you see if you're willing to do so.

In terms of supporting a user, I have the option of a) directing them to you, as they arent running main repo or b) comparing your fork each time to see that it still reflects upstream before providing any answer. I'm just a random contributor, I have no official connection to Actual, and thus no obligation to provide help at all; but I'd argue the community works a little better when those that can help decide to do so.

[hofq]

Hi,
i compared both images and i see no difference.
Thank you for the Notice that an Official Docker Image is now avalible, i should have looked at the official Project more often.

Since Persistent Data was not stored in a separate folder before, i will change the image in a week to prevent data loss

[hofq]

And, if you have any Unraid-Related Issues, just ping me on Discord in the Conversation. I am Happy to help!

Johannes Walther#4343

[hofq]

Merged!

[hofq]

#16

[PartyLich]

Thank you! ⁣-- Sent from a mobile device; please excuse my brevity and typos.​

…

On Jul 29, 2022, 16:32, at 16:32, hofq ***@***.***> wrote: Merged! -- Reply to this email directly or view it on GitHub: #15 (comment) You are receiving this because you authored the thread. Message ID: ***@***.***>