Comment on Why use Proxmox over Podman or Docker?
gnuplusmatt@reddthat.com 2 weeks agooci repositories support signing artifacts, container trust policies are a thing. bootc repos are both signed and are distro repos, ostree Fedora and ublue are using it
Just because quay.io or hub.docker can be accessed without signatures or trust doesn’t mean there aren’t repos out there using it.
My point is that they support unsigned packages.
It’s not possible to download a package on apt without signatures, by default. All packages are signed.
We tell people to use Signal, not Telegram, because the later allows unencrypted messaged by default.
I don’t know of any common oci repos that have many signed packages. If you make it your policy to require signatures, there’s almost no images you’ll be able to download because almost none are signed.
Whereas it’s 100% of packages in Debian’s apt that are signed.