From 07987a15d738d21826ef49f87525bb52a94ed0f9 Mon Sep 17 00:00:00 2001 From: David Karlsson <35727626+dvdksn@users.noreply.github.com> Date: Fri, 5 Apr 2024 13:23:43 +0200 Subject: [PATCH] trusted-content: restructure doi section Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com> --- .../config/vocabularies/Docker/accept.txt | 4 +- content/build/building/base-images.md | 2 +- .../dockerfile_best-practices.md | 2 +- content/develop/security-best-practices.md | 2 +- content/docker-hub/repos/access.md | 2 +- content/security/security-announcements.md | 6 +- .../images/supported_tags.webp | Bin 0 -> 24102 bytes content/trusted-content/official-images.md | 95 ---------------- .../trusted-content/official-images/_index.md | 40 +++++++ .../official-images/contributing.md | 58 ++++++++++ .../trusted-content/official-images/using.md | 103 ++++++++++++++++++ data/toc.yaml | 10 +- 12 files changed, 219 insertions(+), 105 deletions(-) create mode 100644 content/trusted-content/images/supported_tags.webp delete mode 100644 content/trusted-content/official-images.md create mode 100644 content/trusted-content/official-images/_index.md create mode 100644 content/trusted-content/official-images/contributing.md create mode 100644 content/trusted-content/official-images/using.md diff --git a/.github/vale/config/vocabularies/Docker/accept.txt b/.github/vale/config/vocabularies/Docker/accept.txt index 775f1cf3daca..e7c093a619ca 100644 --- a/.github/vale/config/vocabularies/Docker/accept.txt +++ b/.github/vale/config/vocabularies/Docker/accept.txt @@ -114,6 +114,7 @@ Wasm Windows Zsh [Bb]uildx +[Cc]odenames? [Cc]ompose [Dd]istros [Ff]ilepaths? @@ -129,6 +130,7 @@ Zsh [Ss]andbox(ed)? [Ss]wappable [Ss]warm +[Tt]oolchains? [Vv]irtualize [Ww]alkthrough cgroup @@ -138,8 +140,8 @@ deserialization deserialize dockerignore firewalld +g?libc gRPC -glibc inotify iptables kubectl diff --git a/content/build/building/base-images.md b/content/build/building/base-images.md index 752045b2428e..258d1b77a11b 100644 --- a/content/build/building/base-images.md +++ b/content/build/building/base-images.md @@ -111,4 +111,4 @@ There are lots of resources available to help you write your `Dockerfile`. * There's a [complete guide to all the instructions](../../reference/dockerfile.md) available for use in a `Dockerfile` in the reference section. * To help you write a clear, readable, maintainable `Dockerfile`, we've also written a [Dockerfile best practices guide](../../develop/develop-images/dockerfile_best-practices.md). -* If your goal is to create a new Docker Official Image, read [Docker Official Images](../../trusted-content/official-images.md). +* If your goal is to create a new Docker Official Image, read [Docker Official Images](../../trusted-content/official-images/_index.md). diff --git a/content/develop/develop-images/dockerfile_best-practices.md b/content/develop/develop-images/dockerfile_best-practices.md index a4655a1b223e..08cf2f7acda5 100644 --- a/content/develop/develop-images/dockerfile_best-practices.md +++ b/content/develop/develop-images/dockerfile_best-practices.md @@ -48,7 +48,7 @@ deleting files, are written to this writable container layer. * [Dockerfile reference](../../reference/dockerfile.md) * [More about Automated builds](../../docker-hub/builds/index.md) -* [Guidelines for creating Docker Official Images](../../trusted-content/official-images.md) +* [Guidelines for creating Docker Official Images](../../trusted-content/official-images/_index.md) * [Best practices to containerize Node.js web applications with Docker](https://snyk.io/blog/10-best-practices-to-containerize-nodejs-web-applications-with-docker) * [More about base images](../../build/building/base-images.md) * [More on image layers and how Docker builds and stores images](../../storage/storagedriver/index.md). diff --git a/content/develop/security-best-practices.md b/content/develop/security-best-practices.md index 150a6ca2c72c..d6474d408da7 100644 --- a/content/develop/security-best-practices.md +++ b/content/develop/security-best-practices.md @@ -21,7 +21,7 @@ image. When choosing an image, ensure it's built from a trusted source and keep it small. Docker Hub has more than 8.3 million repositories. Some of these images are -[Official Images](../trusted-content/official-images.md), which are published by +[Official Images](../trusted-content/official-images/_index.md), which are published by Docker as a curated set of Docker open source and drop-in solution repositories. Docker also offers images that are published by [Verified Publishers](../trusted-content/dvp-program.md). These high-quality images diff --git a/content/docker-hub/repos/access.md b/content/docker-hub/repos/access.md index 66f0d7b7c953..6622bef9d0cd 100644 --- a/content/docker-hub/repos/access.md +++ b/content/docker-hub/repos/access.md @@ -65,7 +65,7 @@ In the previous example, you can see two example results, `centos` and `ansible/ The second result shows that it comes from the public repository of a user, named `ansible/`, while the first result, `centos`, doesn't explicitly list a repository which means that it comes from the top-level namespace for -[Docker Official Images](../../../trusted-content/official-images.md). +[Docker Official Images](../../trusted-content/official-images/_index.md). The `/` character separates a user's repository from the image name. Once you've found the image you want, you can download it with `docker pull `: diff --git a/content/security/security-announcements.md b/content/security/security-announcements.md index 5e4938f5c707..23540af1e536 100644 --- a/content/security/security-announcements.md +++ b/content/security/security-announcements.md @@ -35,7 +35,7 @@ If you are using affected versions of runc, BuildKit, Moby, or Docker Desktop, m If you are unable to update to an unaffected version promptly, follow these best practices to mitigate risk: -* Only use trusted Docker images (such as [Docker Official Images](../trusted-content/official-images.md)). +* Only use trusted Docker images (such as [Docker Official Images](../trusted-content/official-images/_index.md)). * Don’t build Docker images from untrusted sources or untrusted Dockerfiles. * If you are a Docker Business customer using Docker Desktop and unable to update to v4.27.1, make sure to enable [Hardened Docker Desktop](../desktop/hardened-desktop/_index.md) features such as: * [Enhanced Container Isolation](../desktop/hardened-desktop/enhanced-container-isolation/_index.md), which mitigates the impact of CVE-2024-21626 in the case of running containers from malicious images. @@ -116,7 +116,7 @@ the Text4Shell CVE in the vulnerability report. For detailed instructions, see [ ### Docker Official Images impacted by CVE-2022-42889 -A number of [Docker Official Images](../trusted-content/official-images.md) contain the vulnerable versions of +A number of [Docker Official Images](../trusted-content/official-images/_index.md) contain the vulnerable versions of Apache Commons Text. The following lists Docker Official Images that may contain the vulnerable versions of Apache Commons Text: @@ -169,7 +169,7 @@ Log4j 2 CVE in the vulnerability report. For detailed instructions, see [Scan im _Last updated December 2021_ -A number of [Docker Official Images](../trusted-content/official-images.md) contain the vulnerable versions of +A number of [Docker Official Images](../trusted-content/official-images/_index.md) contain the vulnerable versions of Log4j 2 CVE-2021-44228. The following table lists Docker Official Images that may contained the vulnerable versions of Log4j 2. We updated Log4j 2 in these images to the latest version. Some of these images may not be vulnerable for other reasons. We recommend that you also review the guidelines published on the upstream websites. diff --git a/content/trusted-content/images/supported_tags.webp b/content/trusted-content/images/supported_tags.webp new file mode 100644 index 0000000000000000000000000000000000000000..2eff4d3c9d32028a985624a5096d960e2165a8fa GIT binary patch literal 24102 zcmbTdbDZd0kS*G_PTRI^+qP|6r)}G|ZTD&0wr%^KZ}jHgnR)m9UjE6>PEy%PRjpMk zJ5iJn6~)yB08kSVlvkB!$4C6zo`nO-2Bg#ly9eZr7tfU@DWW9IPx1idM}#!9{p3s^ zR2!k_yqi(u34bg)`oYZEXvH18k2}L-_dWX(@s)c5{6YKaTw?p8Q_$3+5Yi+o|^i}{ZabKo#Q*~b@0{s27U?rWNX^F<{SQ& zc;|Y{y~Vrk7UZM(_V}*+SUEJSsC~&zpk(c{vz;Q z`(Ze@JNr58z4P_^jQ#-l{{40ELss8=$Bp+}Y!&+L=M8@S#})pH@BOFY$L*Z#;pX|L zWe3Q2mao^-&5QQy{@DSRN(8`M|Fzbj2TMcy?`Qve=RcPy5Jbh?j1C-M z(zW?odv%fvNlE>;OB(n559WpL8o4(<8gFk$PUMS2ny)54Ns9k{biSF%;NuxktqYfC zWHouoQQVm#5>D71lep&AwDO`$%ZOceNnFP>*tEtf3FN17c6EZfmk0xj**t3HJj*hK z;n?!v%GKe_;&S`1+9uSj3r;L$n-znTNVyEBfZP)M%X5yk`fL)}T%qI}qg8Uzp(nq53x)Ch&K6avOvbYIpFYzS^!1!%z&+88CPSxkUxEbwEXPaJ!X6uX=yLsPK z9APHE7xOqDP)=BD@Y#^@3bz}utoPLCgys8pz`wG?mkp-q8NOUOrdLMuNA54X8c;i5 zV04Nuwuu@hwy@K%!R%eQ5lu><_P%-Xk{?s*5^L>zE$x<)!ZCYxVj_PKYED3tVtdoa zUyipsSGO{WXu02fAHhGsh9g(ZI_37_iTV-sR=vTw}LP~gpQm+U1VCEDixc5Q6quXKzL$w>f39LKXC$kO>|SFtxLkMNH(wrJ#%Ch@?22RZT}Nt%YjYts zs8;~^qaso8%|lGj9>ip{O~ zaZFC0d=Vu_@q()xLwR9WEfZ>I1qJLbz^!*Y{E^FY^*V_DX2o2jB;vFpG?AbegWt8y z@sg+BadXdDeQLK3ND9s4lUqpqTCXAigrD|93Vo@+5Y7@*oZ~F(pi0CBWJjZ>dtl#5du3kDY1k>!7lONGrIGbUnkT=qbJnex zY~rXa=sCjX;kHC8y{pt@(X0OS{t)EBu?3StfCVvgt@LRw@k4Dm;)t*)6=(;jlsv7N zcW!z>EerR2CPY8gMRo(VYcf3$yP{*);AQ3&HpE`%4Ol&K5KiqbE>C?^g{E(RUnYuL z$ju6;j2CsjJAx8aNxY#b>o!ovqTBDMATt332mgd52aAi3AR+$v?tXQ!^&BMgkax`Q zH^{Na9{fvY*4pVmT(CujL?dnvCeKR!Ve*xu!{R?Dq;l;{Us;L)Ft-ZP% zJ(MZ-*jPET!c(buv_32u?8Q#!i(T1@_8(c+vVLEFax=6oQW#W^u5wqa9Pg|QWyo}G z3uF1Z`rx8}o+H;SA6nz8Ry^2U&kPLUWecYKCxrYL+XGthbsn0PSiPNm@KCwFaQ~lS z_#edWC}^`Vb0sDkpEdva5O3EsF`M{U_bW7_W@*O)i5WTxzOy^LGIS4ei)ki@S8n>R z;Qz1iJtv;3D40kL*dXV^nBoOJz3=H^b>NPj?}#1Sj#u1t*!-VCLw4(+aA&!v!_BIet%F9b;y8;O-U}R zbR3Z@kZkc#ET&3!=;xVl^EBN7TSx9XN!(&*gg9vfFO_J$>s`$kkfJiP%m2iyl^u)K zma?l;IL1t48QpwD^;ljQWCquEG~Vw;6S<4`BJd9qSe16nq7_z zgUkL#9q<0ie^24{Z{P;C6E$A=6W6op#&I>f5{>pGvt9)y(xMbJBdG8W>kF165P9A$ zTO*6&7*=?Xt-w(-*f&ci?c}TVp3Dp1Lrg$fB=}Dfd@>d3yI*S3S?`F0 zWV+E2Yp0wi~>(kfFQ;Q}=J%EdL=OtwqYu3L#tY0lG{;4JYvq%29CAMAV zEc4EuR0%BO5e#=x8RKW;&}C)GxQ1~DW}ugL@mADMp#7l%*+Gc~A|sfR2y5#Td-M?e z`(2F3yTjCvFSiLWCDnApQVER~;AQu?SmoXdw&KwE6Z9SoW<$j7Uk<(-zd9QSNC?=k z>j9ikF%Q0IlgfkZ&^AjbECP{H9{zCAf)D22#>VBkNcf?>_7Uat4<#>PDMyTy zFSQ%eN303_qE5KY`Te_+kt-^L1M$i%f3Cj91xVEpnqQ^OpB)J>g|9m0{XnCFycYKh z-3=db77K}iKJvB_OuvD`(=~`27LN`%?-oY$FMa%X!4Oh)$?D;UBPYrbyx*)PK35du zTa#?2?obi^9*qh;G@@7Qmwz+zgNziV`I3yAK7QX@;Gf5jVRhqAZzln?J{hc7XjC** z`#+@bvee$crp0o0$jtv!as3}f-hVje0#;+y`uyw(;?rDS7F1Z^Z&>{kX8q*$nDk34 znPNimm!p6CBuD7~jS&C$JCb{FbIMzPo}9ix5jP7)h@pXeN6g^Ag^hnOPe?2o z)E~v3gx~(1Tb1isl5n@=nJd5Ss!kon}EQ_bHx<^7Uh zf%5CSd+E*E%|vBWk-{JzexdaCWwyN?eju;ffv|%iXb00BZ9ZM@*2Zxs+=zW>YpHjoJ(z9&5uj0c|evtGILeP6+98 zj$I5bD;KyXvi5MtG04HA}6qt9o90I(c#iel&YtZC*snjAP6wu>wtk;8hlrgMP zW*r%3yML$6iDIl&9Qt0WZ2rKJE|&2b8eV2Fu6fF~B^t*U zS7TBC0DAO3lf_(8^b@IC70y_G-f)D5BI$=XWiBGWpW5N{V{j6N1ntTU$1{i%_tr)< zgW2+ZJZC|)%gxTZhF4t~ffvkFuSi9}=$`#ej2&%zF!p?CXXFC zTKBLpr7Qy>d;OrG7sw7fl&CHdZ@tuciVI0s0N*YlRgDQFlE8Q3jW;F77L>5#4pG@y z8Qw&RO87N-d{@O#5jb_1{t27<&3QSm_Te*|S%09zObJbbkYHh?U-)m3L{qdmW+j=? zl>@keQu{S)LSp|a&;Ac5`~#`k9>%ZnI941?w1*WogKDx)Te4RCJ?qg(6*1pmBy=5z zj^1RLmhvN&&Kb_Kg!7PXO5j+z*;;JK?}H0Vm|ptHONUJ6zqTIhsJ9*=EQ5$TYcQsX zXxwA0QtJ2L=nH{T zs{cL<{)-^~*K-zc0lp)#&kC>x6ya^d-X~sxI1TPZNBEoIU-iEt4QSiR9f$z{V6^A7 zxqXHJ{&gY9mH(&VxC5cU4?ugOFj+lZHo{G>?uICM0Dp{}Yv8rRw2+)UWMOc2Vlf*f=Yt=spyZ-_yMMP?!dAN03pm7vfJ^sj+1v=TLmhn z@2wM!;5;O)o72R+`Ih!u*JGxhfcQR=nAdvV_s{<5=?Tg+wqVRxGT4idU-mn)_Dpl) zVy`kK)m=T&tJIIFT%6CO3`F1p1ry70{#H5!hiok>kXt?EuFHeO9i~2xnx3K7FBs)421X!?{VYnL z2qByc%G{t@Mlz;{onvEis#0k@Bc2sfjKCRBGYq}V>FaM9h=mR_41FvPu(%QT>YzIL zQ1jy6=9t^bc`rvB%EMxndmDsn6|~E0*?2>2+!X?UVP4{8h}QldU_Fza`m{M;1e(Iu ze$giX&M(Nk-h`R-LasqQA{XgT4;52vD~`|-3_+rD8H-fdQQVQ)z)8g9R{MwP=Nm8W zeklMqUGVi2IMsEzeQaDv^)V`~2{c51a;vR@Lf~v>$vb@hIL$FeIpSu{yNSD8vE&cK0nvpiHk2{vH?Kn~YW7et z0{wC)6>V>POprThR?%WVom#Y^CQrP2oDy6=?`SvB6;| znQdzlJx(~O6!-RMz5<_KBnc6p(DqlIO|5U{(h?AS%TP>U0h~xE6RR48wn-7zaqsQP7h(&~3d5dRDZ|9<-|;g0B^z(+Nr@Cp~*R-=RDCBhetl4E$f zbA+}QTbejpU7rA@UcBVb^~1*dqq6diZ|yH*g8NCR@h!xYSK_^EO1jBKd^l#L|NM)( zEKcNEr;hHENg=*V8HLU!-1=7_je0wEX44Qcp?ZcJxAuZ98RPA!dbk?Nb=zqWt-*^> zlTUs!@UB#@R_4Xo1g1)p(eQ?pZ{tYmQ(bE`QG@XF2I+=RR8o}bN=ntJ%C(?qgxlC3 ztTxxyH2Ur>>~5(2&icN*w=L8H(uY3-m&LJ+LC5lPqK4~LdPZ6$oXUDxL${)HH;@3N zZhKM7BTZo7@gUMlYw41uY5br;w-?Cmq4)-pB4Z&=L-H2^c8VsZTyF7iuS@RyY#|Kg zP~rBVzT@ny^d&BKz+Rx08f8Bq8^jzZww@ZEWbwUC$o`Ic%8+amZ>=R+Jy$T_R<1&h z%gtYU%LBGGl%SYGt}-E(D|sNM01gUirHX8tR@{e0w98))fc5TMVx9I^RfU}Upw?+o zAReFUFlE@eBfd$NV~ruzhhM-tr7C1**Kt2JzK(mPt1Oo(&?#dCu%qiwolP;oR-4r5 zz}LnP3*47`5N7I^nhR+CtEe7z*^8w^I*qq^xgIRDtEq&n{67E^5#$Lp&W1eG>W{bE zCHY0uTC0y(R)Vl<2LEC##b(@+1w0up&pqBYj!TX|ng4RwyDSSrv+43V)cHi_?y{QL zuj&^vm$&N)H{sT1{Tg5X8k*j1%qJm5Vc$Z%+ClTZzUQw!UW0*$R=}RKwo6_C=)0Aj zW#R&1HfBD1|5WcWThyQ{QT`uRQw;a(aIw0MP(hcu750GyUy_hA#Q3p6wR#i+Eh;Rc_cxzzK0|losCW`b?NfGLdSO2^NNZhl{F!+rpaZB&Xhtv@Ddx;j!TUyx3pTwj>Vx3M0yfeCU#sLHCnpFx*CvLvv#ym~1w> zSd=|Nt4xr6FVoGh@KhJ7w~k~`?mn2ZUVn@qW@WNlMe2z6;Xq8#;mCM3CUp1dpdChP zD|4O&YeX!{B~Ix}T!GaR4PEgk($@8V^>omUj2y z`P!-t7xx4+zGVzD?1XfJt!TZiG9r zF_O^}(Crx_)nCAOLnD0Rz=tZq6NRaRzzCjfJn1^)(b1U)OXvV zo1La&nv-eVV0lq!LW@dqVgv&#d>B7HaUd78T3X+A9319&F#1RW6ghCPz9KMQZb2F% zw?^67?mJ%0L3_`fuxK1tZLNepX>l4nwt1vce3h3IBMEYNiw_I=QM2h-TAiI#pwA`W zGo)?FbuP+CHgsy6baocWGl^Z>hGhyF%?R#t!XqSJFJxf^mIu7xY*o*5UOy&|D&WN`2-F?;HFn zGB?KmIXJxAIU1&a_?38EK>$d7`3J_4W2`|tCiTvvZ$dL1k__S7rvX{}sjs|tWbu$K z7N+HV>sN5+S(`O8@8E|ST%mva-SX->fF!}@mCb?3Y&DO4{e|-Hk>+>%Vuue=twSA% z_3TnHbR;~UtU;D_y;(={D$`EdbPx0Rv(!aFO>NFodwI1O^(%q?YDh{>;E#%<`3po+ zzVhdsb@QBigZyWb{gtw8nk>E9B>_9QhhwX-+^^bA*LRyse!6z8xVhBD$O5Dqv&Wg3x&pixl(1#{ zymd*pf)#REeK&LhYALM{zL88fHmnm%AEf4Po1<+brmS|?SwQ3RK6nnuwCz;Pw4N2g z<3A6XBv2;|koz(^)7-Y}hG7PmnHTScsgeX4%1;r9?@7%>b*dC?$e5L*-kDP=I`}fP z6jJL=NHPr25e~3Sx+9FM4&R(qpFqs=DsJFYGALA`OBB*!CKK+)W*bw8?%({^ro;Q; zh@J6Xgv>YD0s!t8)0LA}f2;7j8c4=@IiYx6^yJJlj{sU3;zgU@@W0Vg_*YE2Y)RaU zRfTvx@89D%0b!2^f%k(4H`mtsB! zu6=vcgX9MF!tuc*WN}br8Es}*#>`gLM--vzQsOpsvLJrQA!d#AW{G-vfyfg-DgC|O zo06!zdhwdwyUO4q;>%OlWafkBeEW%F`?&57l!1ZeE@KO}XXLiq6xknMK}C3i)oKW< zrM$#RQS0>*%SS@=fz~w1Z6d^{ZSiBRxerrk(Q(d3qBCkq*Z#A~pvtQC*HwQ|Yy1L2 zz0ovzI8bYQfwQyC%%0kl2gTGn~uToG6q~Amndx7j!%=ssJjbjjz>|)hlR0QO6nrgJQ z-#|=2>)~MM4biF*<#i*#qo87N4j*L0cz%xdkQ6mrBlBwVF$nYQ%Sd(fnmdWR4c3y( zpjj~w_ZiDwwNm!m4|1d+beJ)8@{CU?vrCwmkvc#Vj?%nl~`_@pTgpw5E~9g7V~jqE8bDQ0>|3ft$1!?UA=g zYDCoOm9zu*8wV%&A#eaU1~1iuYy!7%_q-BrlADZU>k^iBP^`G*v|d+WySV~f#7^z> z%710L$Rb4TXw<*S6Cx~)WegcFL}d%{VeVY%Ep*qLkBK8IfC@V;s9lY`Y|Um*nFY?2l$ zt-i#1mRqDi&G2mqUs!zg_eJfV=%e082SO2X;FZGzM~pfpyI6-W1w*6MZw(cjwZJZW#Xip-JbtV;9hRrnXbUnZ zRJSxe>Bl_=1!|`%@03{kIuT_hi<+^QkqK z(U22}LimIa^g=TP`k6M6K$OQ}b=B>r)?xizEkIyEhN9!gn?tu0=EIi~EO}%?htIEA zLl$a3PbODkRZFts__mzJFgIjPMIul#q#9URHWWPr>j5HyJHf7L<1l7$>9O3A{L`|g0QWP=rTwv{fq<+MqZ z>^DVxc`gxR!rZCTGZt!Aqb+2yACuD}Y2D0%NgAXG@SlcRJ@=Y5BqFPm ztSY!+8HOD6N3^^?K~`w7A7El;6uj>PMGp!B!3FVp^oVXAPB^%wWuuLHG^nds@_cF9oK{we@m#lUZE z5JTu-xRm6g!c)(njLZngC%3%7ZRhCJS?D$A1iFusRk?xQ9z%;*rSy8rbhXh_+j3Zt zho&z}%PFdRSLT^>615Z7`iwwJL`EWS+KPA+0#-PUlcEB}qh@BD==^9xQ>N zJ)t>eCgHa*?Ue0<1y&#Xvr{=L=Q$jOg^Av$KKEFyY$n8C_eK*ne1fD=LQSPiLVAKT zogkFHaj?3bRM-7`qIL}ZgaTY=S9sv71TnvRYYjPo2VLVe^0G_jRL2_t#CAw*Ef9oo z(sF*Y+c&w%VTNn_V>}x6giqJ%?U4guR@?o$dn3F&cISySYlqw+&V$ZK{tV-%AhByi z&Y7T5Z-Rabd8WZDf(m*q$-Ps?nX*-1^6wlz6_h&UhJB!UiI_J~%dm)22y8C;`EZJ! zsZvGq%cKl-oaz_;c;2@3>`}$XsHPrp@emUsguUi0EKEsJ!5VltqPLp1BqUZzd`4e} zUD1ZFMTG5^PM#9OsC;Qv*UZdzW@7L+2L`}dhG0jdUWG->Q&>>(2`8|!m#>cH4pJQp z-6VxaNxB`G7{}Lqs0Rl27QrzfI>vAy28ljOH^9u{Yzz0|0^T56LR^yKt?mt z_e)S%Is%FHaFTaPxGlnAk~Pwc2>j?O}V+a+i&cA=U;uPdm)KQ^|B3Jx|qGrzh!!8PR>rt6a*J2u+~ zwwmQl+?zw}T2VKJMeI?Cd<^+RR_#7Um8uVMN9ii90~C}`LlMp0?a~Fp{1hjS`yMb% zxO?n!;AJMw2V*>TK2{Gq*B+DccN!K8qf0-yG3(+e)IAhT{eqABd;}~a($zK(qYB6W znEaVUy0L$v7L__?H)b_VKEp10LB#2LA7~Bnw^6Xv&x{B{PgZ#%K6xNA!n5gC*T||M zc|D@Q4BK&Cqi84f=W*YuaunN0l>@2r=$jroV%SfyM>6E~ZbC;P1`~nNEOO zVZos>S_vLM1`>`6q#d*P&4^8M96)tW8f9riHA0=qr8PtpBr8>BrV-`NFg*}>IAv6e zy76^Pq=*S@yjY-ydK}bRZH`|BEEQ{fVbIj`?bdScVlT}%6GZF-Ll;JY<$2j7!HaxP&lL|-xe4GuId6iZ$- zR@G!@XCBM-b{Ll8QIehRtWg$$!p0G81i3EoF5{OWryPdlSLlz^ZnAG+ir@$tX{b~% zTWODY4`U$AfIzrg;8a9*K~C6b?PI>N@uIQ0d@`ps3!C@29p(KTb>40ra}mD3NXlV% zcYnpKNEam~-c-W7sxnp3a(x;g#$1#_Tp96ez)`HU8034JW|60rxftM55qJFJP9D@W z^ssf%uU)#;iyn07yEcH@?ns7yp1fT{)vp;x*v#aY8-fXbw|Rzb0FEy{;^^Q81|ijr z^X^$cuX!WlKdXmD02rrCP~2x+K`d9weVp-(Rj82L(f}ACXD~lFW3OpBsxN(y!)_0e z0&+)1u)F>vQilqlX0*`hbEyCypWs5_E)~KZ^qBvGiU4ZB~SCUylEu<{b0Cb^KkO^j@l}z+-_k zMDKbDf@7$9+0i39W2m?l#FZAwg)!I+FvDh=$gGC0uhVY0wQ*tBefmbO`6*d~)9yPa zy+IM=C^WK~U>wIge7xOY_sG)_SJ(T~s9d*-dJDiUv*S&TF5VrCr~kRW-|_>^mUsBIyoA6xjn*QY}}5@&_3$6VIM#T3OBF@u zTckxojyveWP7TI`kQ=K?+X}@l?y09l0rPkxlnYo^iH}rsG0A4C+ z=@Cv}h5x4+)-`v2;$<;MYLep1*PF7qM8R#zRmpvFE`Kr{E>^8-hA805yqt=M>$$zG zi9kmo-^gl1(5~mClHv5VlWeHq?&5szZ6K$u(+=ZJWH+(aH{Y~D_6c|w?n{RCNONaK zqxe=mnr1%D-iIl`GQ5KI*=;~rHbrVBm+CxLOao^m38CiP`hv%76Vwu4(1Ww9VG^** zs^151BOj#pP!Fh{ja|n%Yf{E;jKS6k4`RoP@J5w*9PEIWD5E`xCi)w-Gw<^Y0!^k{ za+Io>C=HBvYf7%RDchAv+-8JBo^F~#xE_qc_cKa;>V|zHO14{)e*8Ww`9_CyWY7~2 zHYDg2Ux4IfP5%Widi?`udHhI~QBG2YImafyHTHLA)Ak5R4XdTNbe_f2v+h$E30r4i z&Ek;a$PI)l$%#FG*j$am7OoA(3`8FzYeN*mNJ%@YI(t1|gEk*Q@B_C=5e^`_%5@l- zeWY6Vpeq*B))(8k9YBKaYXds-W!_2b{S-6-x^`CGEO^g8O90=483tN=BO(-m92c6~ zZEt-X;R2gZkd#_gq{xxvflo>^Zc12_>eL~X9hhofV|QM3Qt-wCIvZ+#A8ObKw0NEf zMo=^fZ##Eh)&(JE|BUzZSvkN0g;QEUlRlq%N%Z=lv$iQ*K0C)cW^12(qB=ArW}qoD z+b?Cm86>s00?RxlsCFG3jF+&3(btke)^#mG zb3do_bgB@*RwNZ@{-CIx>AS%2`KN6J*lZ~4E-B7+s}|dtvmLs3w#SS!P=`?#vNG1w(4s~Ye!%`0OTQsi%>jX%{@4lk zZ8p6Za%8AbGmNl|>3lb7CYf!e{;gcMH_bA;BPS5_Y8JcP@5;PERjPiFuEatu6qNAPm`{2BQ9Dk2Y&|+*;MPE^+fOF@Q{y4RSx* zhxrLX%uvYqFDNo(mH?WIM5uPDmqrqc_JYnnk3fN>jyK1*X}MZmvFeVbe2M|r-cY1w z^@uCj2xqm}cF&Kagk$pak6@+o?OqfAKQ2x!K^qb?%=Z^Y?oh7Z^*y?2(;+@90uZg9DMjHYfsnmc^fi`PG7m3;Hjy|& zp3cGZ<}VMazcShZlJvg(;5xPOQpC*68XDLe<{}kybpUO}HbGU+RaLm_(XDSOS6A4P z@QUmcr}!XeuYDEh;`%r$3RhNLhE=}q+pc-4a4RF@=}?W8!OjyCM+7>3(;$Om4(Fb@ zIWWJDyEXA+$2Wb&6SPoS#0mn(5M|ABw>D(9YW!<=jEz>)QXoN|sr(!wkO83Zi}W%b z^?D4Of8zMGlmcgPDE1Qpy4MR)n-zm=i+$A=?qCgP4rf?YI!A)pj` za*c=;`D+C^@O{Vh1uhebbyY3?04kQG;hj$WL9J-@Koi{jZ6ZO(po*Nd^@rVPz9eZW z7kYgRgq2F=x-*q~M)!jQvw^@g;rU`(qGeN=pBwvn5j#jSkf5=R^3Mj*09(4Z<`y@x ziINm&Uc?L>+HQ_J5tVEbl5i4dH^964N(DOVgj39fB8^rro7$#?uE>d#o!X}5J z4^JtBWSWXzqH>WriUz6wTp&6H{gh&O|e<+eXmysD8ipSxkXgX z(mdjul#NbhCd|lg928Vi85i*~*v}Ajwz6V^hz8lEkYA@BcR*VZTAU*_Y=yGO?wOf6 zv;E?Rc)uKlU85D}n%c2G8wD{mH;jpjxSRM1%G7TH=-yhv)V`;Uw^-T}!K*gX|tc5IJJcR1%*eP1mfyXf?EL9-m*2i@aQEWyHv7M)AGhc2Ohf1AL2zil4 z-wmgSkletn@;CpQ%R2Ma;2**M1yB)4=cFW(@Ec5kClO=yVtIJ9)_Ps#9ck37n1uT; zJpx1_0m9A@SibNJ-pY3JvUCj1c>pxtdlE%0OODxSNixB60o6opfjZZDLO9SZ1R!?_ zh-}YS2f6uzBc%VyhU#BM`V)78pA8hBMGC)UizMxS_-67AEaUg8@O5QOCz2SeX*8+# zqhTe$;R40~Yus>2GYH`}H}!((v4KBb#(7jQe|HQeGtr0IYeBxUa{j<|dk*?7S>+i> z#Dzzs{!eP$57?K2t{?04hZs*Q)hi~}k)mH3`>IneV=i&`4Bfm%nJT;=wLrp-@2olV zfJztQmsUzJ01ST2YR!W9#K7@*Byny^()&s0Z<$hEOY1lZsert7@^yZ6L)P#Tk@?Sa z2?mZ&*z^WaP>a~Pfit0SwhLd(Xu|k$jl2tpHk>cH_~cN@zJ*Iqb(IBr+>eB)caeq} z%}YSXblhIikvIK!n>#KsYr`T#(tMWns#F*=5PrN&B)+7d7$IwWs|})1XoHLSYNbyI zU~6I6`2d^BnBAcmL@*>uNf3V;5nNs8n#~MpMN9=2^VfJka6q&JewSSXQ=IKy5lX@O z#gVGl%dE!nq;dw@D841hdXSErigCdJ4p#E~wS<{5)oH9`&;WQ-c5@e}dLR>4iQ!sL zJ%F3)i4uW@#dq^QLg>KLWcTw%2U#s7XYEUuR02f$Vg;;Q>OgGepy~#vB8J;{?g!C@ zaU{*IuAtTCoPIh}qwJudwZ=3`r>fQ8pghHOfVVGo93LWtbSQ<+C^K*i@xWuFB^#F+ zQ*@L+@CP(MpibUEjUihz3e+Y3%eJa!9mVGNEKhS@Se{gQK3Sc;dsKiA)Ula}|Ppm7i=I?wklbebd+9z_kb6-Lf3yiA**1 zsYzWUZihNQ`~C*_zb#x+yBrg{V2g2J->-kWsJh~$o=^jy-*J@(7t7A1?|A_WHGSN} zVX5oxcRz}0&c$P@`Zhpa@PIRwa(<_VkjBQ{HR!X9^FL3eG-a|ThbgoJ%%Z!D@74Ik zy31J{#yN;Gzi9Tq;qG474Jhm^Ci}HYpgjM5Z!y9PTBr+1as#!`rRwcMKOlYK2292GX#@xE>LRw4pvwpsD^j#&X_X^NZ&i_E> zlut)rUi;iZKg9U5;3Gd>F=lCXEHAT&Vnc6Yx$MVf>=}t9NwgViqosL)YyBk0J83?H zy^pf-&^&9dKdr6_utS%cfLQuP%rwG3xCI8`Jm1omvu|y=p`F8&U0utW@xfZXyK4K3 zHUeK7lLAu$*||B2Edla?=mBWBReU6b*1gI!Dp=J;0Nj%d%KVlgDB7d6hWAbep6{{2 zhDXNbDVPINt~W4@&sONwffKcF5S}r(xqD=Q{g>5?T{|;w793CLJy_bk<+SBkW*XBr zmEPU~drKvJ_!^EEG?`J>6U!Ya8$s*x)f&|38w0;@ObNQ`vlzS<8$=P?E>Ay$U!0;z zv*$$Q*!pCroFC`4(uSl!Q=2VuBLrdGNDi*zN%8A$)8r`wu5|LK`O}#ZADEJv39`9i zUp;~$`D=R9)eA7c-x1wd9(w4#ItGZPfx3vuV$a7;;#=j%zOQY0w?K)3lHQfGL4;!2 zk)jI>iA;e%H4O)y@*I|w9f{_Vxna$#!Q1h-h|R9Kiu@hJz?$0t0vR=5-;97^Jc zvOiZ{@zR?FM5q!;5oJyNe9Hr@wz$7rOQ8?(^i8J49=Qr{G+?7ZDQueg>2OJ z<U0HwXK^E^_tZ{Bofx9UKuqW$)V8iu_0k^k>L$_JQO z4%Iq~Y^ciGvSHj&003MwXsw?UL!G2yvN7vl-rq5$#@pPl;7D_>*s@)UL7QF+83!74 zWm!{S`22Nf%hJ@Rd2*UThzM;^ZkBwI@KWa{6chPYKG50J)5fZWi5=pW2IV`pCcS2n z_Ihh(M#!Dd>IfdK7zKgQ`AH7m(g22s)aaZbS2`)qV$(2&tgSN`Y4@xfd+XSJqQYr578nAS_#ytI$LxfyDmK zfA1#j$pfqNNL-wrngqiVg+sS~4N5ZdfVEA>tw=~#HuQI%Bj7Kpo-9Cp4mY)4Iv!P< zBR^_L?^lf{rOadA8B0HA%xHyapJC!@TT$;=su+$dsXyyov#|T~5niG2l4+@tEXqW# z2YZOn5ZRQns5fmIY{P2yS?45QE1dx>LF61vRc4uprbzLJ@v@!8nrK=*8TOz8J$~W! z^g2Ud_{X`Wydrk+S>!DzD<7Ilp-QxW&9p6{l^S$BY5S!U+l>4vT2E*^RT~lzD-xv7 z07>*evYt(P z&wOgYFSAI3L^tdIg;r z1+o2d6T`MTyyeu~g~l-~7naYSyK|-od!nEY0iumv5Y{;CWjJHcta{yMK7iZ1>Ex!x zO>!XXtNf{aqH!ZC@LyoBN711dIa_0GumC`0VXa)}s05O5p@r4El4{bZ|xE@^A4CGJ9 z!$;w{wQ)59#yHUVlqm|j+GzD2*&A=RSl2=xp_tuSaZD zYR1bji5(~C_)CEbP9FJV;m2qIgNj)xlE(;Y4EcXi*8-67la4!*_fa_{uA*Kv+z-hJ zCbnR&n0rZz{2h^DBUG=BKa=qxHe$_&zWi%y^W>4LnoK- z^QqIFW=X{X!+tBp28jp9tO$w`P3^k27YmOnYQD5KL=srI2IHJjTjSB??}zBNY9M&- zj5|^?G05;tDR}_*HX`%0LiR6kELsN^rac8d8;YrZhW8eTv|z~tI?-Q}><2gZIF3N2 zOw?e{$qkSheq}&3h|-00J%(27XLyJ}vW(E_2Blyv1Jr-gZ6Rs0p=EKmiW1}2QIN;1 z>8xrWiF8(l2~;;C?qGiY2nJ)v^WY&W_usqDqjfFfPuz`=Hw%W5aQi&mGKAMNDJGBd znd-(g{R*t=?|QoInLrsc@^>kQ43X&%hs8!k#gE4BTD zgPP1KwvnXLY9lUe$Z5ll2FHtCIVi86`x4dA__oXN7ti6$@A_m^!Wo`WmG3keZh6fn zjR?fs6viC6m1inP`*j@#m^XJLuT9?E4<5HdJ!SKKc?4sa7?|2$wvUq@2@C}NCQv-Y zYaO>hyUQa8n*6^t!U}_Ad7&|Vn!aLxm5D}lt>NRZiMn%eFy#Nr*E{mLfNpJd%hi`G zx_4%L`p6Y_i--8+Vj#Lcf2=D$CDOLxo^9xiQArQ!+fdem7Bx)8t@+MZQjLDK;*IqD z33$@DaaHSM1YCs9Hy?jl+>(qxS>fcC@YFFO({0?dP-VO*5WUYPc>_0%5jAA357GH5 zvF?lJ_ka~(k>aee(GYqTkZ9{}KZ9c0uaQi2&&vtwN}=#Dcalc!i0AV~u7b9DY|tjT zHa1Yf=LUgbnn6%G1&_u_t<37ba(^Dt+8~qg3W2%Td!fwXXu&+B`%$Vnvj{VUP8ED( zVSl@km;%oCLIk`{AYEMa=uv6pzXoFU;l+5UCXN_F`@nFQjZb7ALw>#6;uEjQq(bq&&VppAbfr{|o0Ks}R8I5yJL&vEveAAnC_8z_R`)RICt9Hx# zE^Qa?}W*O=G0fu?#+bp^#nb@@AEIeAwm z1?vMt61@2%lL{KX>SY)K>Wo0}S2*946lEVF-|Ej<%nx3LL~Z)K|My?jsc+^_{u{9~&^&Y*7{hS3DF0ZQBPET0{Uv!1c{_ zg6#CrZYySPH2XJKc(t!$RNB%tg@b#su4kHuL)V$%wycTl)3WI35*I?}2^i*+qvr*i zpi9aS70igV3HU?TgOB!d z-Q9mp{;^qbcy&Y_$iZABX)?Gbgg+)>2^^ZP2+Q*7O@5Vl#d6P5Tn1qT!MnF%1#1-d zEWO4i-svD+5&`qZlE%GL5RS&HD8_{cgG67Yovo?o=#XSRuH>)3_ezfTKnkY&X5*!W zpe0n934Fvs(|qNMix?xiGGU9jkCQm5D5e;@eduhmaWJ1jf?5?{ZJbsfnOu|)mJu4? z-0K?DiCk~v*Nge9#4yZM{Gd`|ekUg;xAwaqX{QnewBOVLRUQ>@`c3GCexC*6=%@GD z;R_Mir0@k`nl5nxtTWW;^?&QvNjqF`^C!Zn!s%FpJx=nSGBCgDz*} zrS{R-g-Bn}Ur+FOa*n83p7V)@F+Pe4j&eSsemhTRo1rGf_D7s)gG)DKtvh~0eQ>GD zR{(5HK8M^6vG0f*t!Rz;ne=veb@tyx&1Yn$TW=rjSPH{ptp@|f_w}kYle(j&9Eco{c)V^4&-y7sSYZ)NnboTnPKL^hjx;@W4l7_ z8eqD~#|5LJUibF7EsV;EQ{ygtV{W$t$%$Gzt6cV5vbh|4&bm65_ki>jJQtCCpi9v8 zgc@Mf07vK~T?Cz_L1<_skJ=jU318Ki_`<0Ka^#;e70!qpLqDh1k`GU57EsTr=umA1 z6>2NcT5bARa%`}EUrfRa-FYEJ$#9ppF-Y&u5pXkY@U6_%scJZj>~Ol2*gE>bTj^v? z8N=S%RobIb9OqX`8J~ntcpK^bcQaqWj(QXk2f1mKRNmDYQ??_L~G=Q8L z#pFrl^eO2ql?1nNdYukKp%x%Fl84>oiieZ3<+rj6zSU_>#9clOz|9_sP3|?B&stc+UI# zZs<=@FkJ*O+EdkbyVK~%(gg0au0_7yVl^z_T>2_ats;Da3CUqB#Dy4tU}{=0Rl|^2 zvSWs0R-R2-nUof33B$%~Es=2Mge1i(jvPwUQzg~JKb4H|F2-E&oc+YssEFYf0p245 zF?IS)ua12Ly@s|g`sVAnQq|d}$1Il5s+(Fi(-oXRNqe+nwCp(p574vlL+apNdpcA@ z*q5Ys1b${42tQe_WM%zUA7xU;1>>}Y5iGO%EDJ$C|M#dgrw(dK#v?Bbf+sigc$p3n zpQTdtcq;0MmUeW;OL? zKgg-VLF>lKW{YWH$%uO(-YZ$dH`wbi zD|m%5E`p#O6E9L;%*aB1U1WZSNm9#?b@sg9QYquu?mJnDa2!S=|e9QwEh=xbJ)&)rjSWM2fC~=Mf zK2*$e)i@LP>UGSjo43jwK7$cW^iX|@Hb0#iEY{@58YZrJX|2-e42nun)V}$ z1(f_i$8}q(f1@F%(_hxsj)<4ra!~wRC5d0@(q5@H>nI@o-oxMDO%wV_2=|UtTG-=6aH~;YqtT`}6JZtR9TO~lEgqxgP5vU-AJ(y!%iflWa5Nns@tE*IuJ24a zdZ8(KS?o%C?O;%;k371 z_bF_?TI$J-Kq(tkeVG6+2N-gmF8VD%Wk1BZ8rS(8B=K2e#v^UvwsJgh$d^rOr2anW zSKSejXtUl7FR3PY6RTcyURBAk1I8HJ!QJ1!v!cGCUJHxcD@9O2mRJI=9*6YiLfVRNRO_+gmsz}URh)8>Nw>@ zE-+Ks!YrS8G+FSFw7&d#DXCfSZt;l6_2ocT1znY(8@@6fOELu8v;$B4yZ#QV~Glb>R$K*e0_O|o+bB3ZHV{a*F(_*)GlegohyP)GacZduVYPpu);H;gO-WSQ9|A;NMSt(TKT=N}T z>`H~(ddwo}k1+Q^6KwL(kH(zyR^50(P?$g}xb_5;tp2HU*ssMv0CS3`d5*pfNRi5l>KR_E$^nyu-9c!(#F|;XR_jCd4OX0_K4ifABS({vfF47iigQ}oGl;tw$!-VHEd@5 zy-+gHZr(%7J#oHv6_iK`!lqk$!4^sG-t&32zHH!ZmT?C3Hp^k;Fot{zGa-GB| zM$ld_C;}TyfN8SWHgGLMPUAeuTpyC`G$6Mj-6^9Sx7K{!-XYOoJcc@jmH zhQ!x^DE|HwgN}Bs<*xN2s%O_u%Foik^N-H~-lYK%q430HGn`7cR%6ASYlFa5?mTIr z>D8RSQr+F+2#yiBfaK0lf`t{1a^P2dKY@=&I5LRH2l%E#FbmpVEmf?Y8 zOk~~1uyabD5rCaf@WXBmFdU?Nswy<=tL&o0RyC^8K&5&LEZsjj-W|@u$Brr;W6ghE=gQRcK^=FhLkRpNfoHrGAvB&Rt98F)nH$ zrWbCHvB+K5jR-&fGI=O2J}-E;N6UG?1T^T^Tu(f@xDNHRnF^A+gQZfm>>1c*Z?V;_i}MKk9y#68t>*qr6Xj8~l(PkNAJq=?Qr&p5!@zp)y!_S&tEBf0Z&kgQ>8u z8HzMJv~YMMIUoR!{d^EulJ3!uK%b-N(mnn7gf)!)M$eo#cM`h~dmVYwaM+6KB~9}Y z5vW6g(`1tddxD3X{mD48F1P)AKzUb&oF4}Ba3iN72yJ;tOXfdwuc98Y@B?h1L~`Bs z5mszuPe*z|4MIS-B3zfeuB!0PWkYxcG!RHil)h?&Mvh`T* z3TCACGtZA-58anB#1|0x_kLk^Y^1mQ8fl)RCyTWM2>8k&wv?2YFg$(y$HsIUehpmX zEiBLmPXS$|6kjtFE%(L_|C70Zy?!zz2T=16%?#GiTj%MIl%aRe9?3Yq(K(0E3)BGC zs;je@ND-=O&6;+LFBQ3aFI~62j(A{BS9JIsVvD-VlovyRnu9$AV#nh+&70driVLlpNsa(Dv zg*{YYiD;)ta#K|`xc+qqGgGCLQzgo?%k zu5cnz)L@F<9#_|(VDT^NGG?Jo6xxnme_*eI2)8N&<8$p+KTsm~(v%C@powMnNY_=x zi<=49Gkogi_(}Pje&tBg$rb2^gBVLg9F=C8Cot-@$HbxbjW-T5BTz_6N+MDh@?@cc zgX{T*GZ`ib1p-5YTgML{2)#v&C9~5m~04lQuDM=h2|MrS|?ti_dD0Gs9jV zghIOlSmjdw_07gQ<642q4~JI7>=|x3FUg4Y_*jz3=obt|T}lJgaROR*6$$rNmebEe zI4=U*@5f}Ha`4*fyN?x!j4O6>$X>!=fvDhudcv(dp)Ok_!NzVJ~=5QXHA z{b$hmmze>{hf_ICAReIG`9R!+q1*rf0000000<<20000000000000u7*;9W+sW8Z& zxE$w*kkZQ!E)TjD?_KUa6>owTWdhPl+SPPAPDc_t8~Q2pFB<`~ zV7So6F9~J0A210v8UNy+{jQ8LPb>R=3&GS`0PM>tO~(}t!BDKNjW`2o^Ax?}lFuY= zH^PNYwMty!d9e%Pja}MRp!aS01Kg=oCYB9>j%g-%+_B&~0e#5Z@z$AWmrdk|>dXP; zo2$ZIFICBc-{?xNs__eM>QX}Nxiw@WL%Z%ko~GKP&|^7pi_$LADm;Kk*IkS)BbEpT znS`q9uMoEH27wHx@)brFFPwvnp40=Y3GQm2|8K!~I*ZFnc1iEWN)QATUG_iktB&FS zJ$XTI!Hs>5(3+I38aEa|QYxv4+H_`^Iq)pveg8|7_#NU**F#b@0;|f+aTfIT9}dRk ze&<|hl&27vR34TX+>-O=aMn^=E}>5NfBzgVW_Iy<5E9;Hm8pz$it?ozZM5XAJ$*-Z zB^`6;|NaoNQ*qZLRkT^j?7T;#w;nx#7Ao#d`ynKy^*w$2j^4PnL-#`4U&O+1%tcq~ zHcH?Pr_56KiWz^Ha8Oo;Yo$Tf9QGl6P!3Dfb#{;|ULZ1x(L!y|>*ogGR#36vIstvi z+wsL##t(7!f76vO=n1!BEkrL3)K`& zN5}aET-7QAveF9P=NNWtZgn~cv7iQ>;$v(*p(%=tdUZsI{Nd@4j4W~5p$Eap`}!p? zmp6s(SCC0rJjM_uu4(VOagb+NHKu3>VOZjTf}8B>QHU_eY#`+yg}e;Vh0m7|@@{6x zJwr8rWqo_nkMSmw*C>vA+E-0_fQ5No$J{AojPS_hhu#s%9LodT1MEu#uvvg)Lf;0L zn%ARrVwVg2!=n-1-#YX@X*nkrU@B$Jc+`sr7s6;sgM?aws0nX8Z)B0n=diJD2?E#D z1NU2&$U1c7hi|lz7H~(AU)Q$!wLAER&ALb?H-XEJG(vv2MxZ(w26)5{=EZh9<01Ry z@YDZSH(df&#ZN^4zX;5fe?EWt>yo)RaCZd?RS{nA^$*jCPe=hPrGNRk9H1TVYmo3KvP zN*O)m1N;l3rcp9iws>a0`PAp#SgYCwV(J^bd56tPWE=()Cosm!BTzHKG_t3EOVn{5 zsdc?WvnM3@Y!;$eqXp8O?FHc52g)h-6N-G$U_*V8nmtwLo`k}IhMgjj%Amc0t{wKO zmNfIZXZG8or0^uh8GJb*l=|n7qF0Hs{nhx;DVOH$cc`ixSy1G=_>{K!}mW+E20>-_sdgq&Hgrx^kHt?sO0#m&_$tA=Tc%f zwG2BcID&8abI-(^`cVCYp~ov4)n=_{Rdxm?n)VSyP?h;($c+t&C%7|oo`C$S-?OQN zX~lmzd^wc9PSo;2bWe$iZYQgB~$fY;1KU=W!-q5bQefh<1@T# zVs6kpi51MyupR#wV6cb1!BT+SYE+lJMBypBM{Hnlz$CxIBLC89dXG0D_MO8b%VVro zhNuBu*XPBs0j55TN?qRRX7iQ_ave`iUF11wCVaRGhVI*=SEtx8)-n(vnFbD%2!5F| z9DAORM1RQ}Z7C?VL|420Qw$@JmTUKr%Cxe;X3Kp>>N%mHsK-(UzWh@p-8+dHNIX9m z`O3FY{Cpa?W{xN#taRMZuII)W|Cyt&gOn7tY_8Jdw6HQG8OKtTyaN@4&bs@BmDoWD zQ0`m|CT;Br3w3^m<95eh{Ai-$pDrg8u*G`nYLdQC@rGcL?8>V-xyyvjn;~9daNzn>a1h05)gc)6$ zplN%ekGEeKy(7T`Pw+F3?Fq_QCuxOlyfV$%ltAF`fc|BZ7-cNERs1tf&5`>H)}Sp- z0^NhZ$8JTjXH=^CxHT{($7{2ikC2M#0RXeH(KcUO4E|_@KN@U51AU zw)0X=jq<(aY%j>LO<}|ir|Q}FM!tl=yNb9_>+J-41_C@qyy}5viPH5uJ&stRlu?cX zL2BexV7D-R#Ocs+FuCm{I|FBIQew=u7ekAeV_!D-zBz3GW|zteI-V!~o#cF$>=s3{ zuHGjQYLRMkrRn;+`^DtS!6Y>7Oxy;IN}8j%;TSsw5Lf=<>~jD#8LKAs2<|*agevm4 zI8@1sOn{AlQ~GI=mq;h)EE~=J^mGr#24A5yUx8AE0f66$ap>3r_bxv;Xgz`yCPWEVU?e0zeIH^?mf3z3b*2a+x50-Jy z!EfzL*AP0$!Sxwa-P=hEB?)Qb9c3R%C*)MXY8h)Bz}xlcmnt^Dp=H=CrYE_Hzc?aLopI4PcSX zV}79S&vr+J8E4_q49*(X(YFQGNBt#9XCIyZG1CY)8?vVB%`}uY;toCysVK=jG7GP4 zt^4}K%_X&QZj=t$ z`>K2EBun@?_5db>-U0-&Yh&qzk=$slYHwqyaq&&-qbOom{{<)Koe+a3tYkJkv)d3D z<}6x*uwunN$t1X60=W!%3!eLT_4T_OqIO=WnnRVg(Mj~Fu}i?#OMn0XBXXo)P~EK{ zRM<`Zu~}1n>RV{Lm310YJj_XZe3%lXZ6;cKI78P+#+?HJQ-c5D0@{RS3}j&a8?h(` zm@wdTKH70UIgWV02zwr}(J7~n-D?`L8~|aN6cfZujAj5(a2aWnnH3#BU)X$MgaG^j zMyI>i$CVj+REF9Z%2KmD3yiWwRE2`X-vyT@Lq9=zWM_B96Ca_E1r4jWXhjHxah!>y7w8!q@o7tar_PVd;0WO%ozTiL)K$Zkd8Y2fY=9VxQgbdKOgA z&_D~0H$Cu>g6Wi4ol)~q%Y<&w6(HIR$c9EsMw0qtz_wRlOuA$B#v)SM@B=Luig(?;y``&prt8JdgV5l~k`?h>HIZ z*51{X1>u%46G=?M0bXQRl}->ERDSS<9A34}YcM|R8z8%VL(hZOH%FW%ZGB$tw-0$| zf>$|$G3pT*jb0vmD}+q?k-}s*3x9Et($irCPP)ukQnTeTpL3faq{}qZ>!;kH-YEhx zC|gH1W@T8U4IV4umGG **Note** -> -> Docker Official Images are an intellectual property of Docker. - -### Creating a Docker Official Image - -From a high level, an Official Image starts out as a proposal in the form -of a set of GitHub pull requests. The following GitHub repositories detail the proposal requirements: - -- [docker-library/official-images](https://github.com/docker-library/official-images) -- [docker-library/docs](https://github.com/docker-library/docs) - -The Docker Official Images team, with help from community contributors, formally -review each proposal and provide feedback to the author. This initial review -process may require a bit of back-and-forth before the proposal is accepted. - -There are subjective considerations during the review process. These -subjective concerns boil down to the basic question: "is this image generally -useful?" For example, the [Python](https://hub.docker.com/_/python/) -Docker Official Image is "generally useful" to the larger Python developer -community, whereas an obscure text adventure game written in Python last week is -not. - -Once a new proposal is accepted, the author is responsible for keeping -their images up-to-date and responding to user feedback. The Official -Repositories team becomes responsible for publishing the images and -documentation on Docker Hub. Updates to the Docker Official Image follow the same pull request process, though with less review. The Docker Official Images team ultimately acts as a gatekeeper for all changes, which helps mitigate the risk of quality and security issues from being introduced. diff --git a/content/trusted-content/official-images/_index.md b/content/trusted-content/official-images/_index.md new file mode 100644 index 000000000000..06d7ba5c57aa --- /dev/null +++ b/content/trusted-content/official-images/_index.md @@ -0,0 +1,40 @@ +--- +description: Guidelines for Official Images on Docker Hub +keywords: Docker, docker, registry, accounts, plans, Dockerfile, Docker Hub, docs, + official,image, documentation +title: Docker Official Images +aliases: +- /docker-hub/official_repos/ +- /docker-hub/official_images/ +--- + +The [Docker Official Images](https://hub.docker.com/search?q=&type=image&image_filter=official) +are a curated set of Docker repositories hosted on Docker Hub. + +These images provide essential base repositories that serve as the starting +point for the majority of users. + +These include operating systems such as +[Ubuntu](https://hub.docker.com/_/ubuntu/) and +[Alpine](https://hub.docker.com/_/alpine/), programming languages such as +[Python](https://hub.docker.com/_/python) and +[Node](https://hub.docker.com/_/node), and other essential tools such as +[memcached](https://hub.docker.com/_/memcached) and +[MySQL](https://hub.docker.com/_/mysql). + +The images are some of the [most secure images](https://www.docker.com/blog/enhancing-security-and-transparency-with-docker-official-images/) +on Docker Hub. This is particularly important as Docker Official Images are +some of the most popular on Docker Hub. Typically, Docker Official images have +few or no vulnerabilities. + +The images exemplify [`Dockerfile` best practices](../../develop/develop-images/dockerfile_best-practices.md) +and provide clear documentation to serve as a reference for other `Dockerfile` authors. + +Images that are part of this program have a special badge on Docker Hub making +it easier for you to identify projects that are official Docker images. + +![Docker official image badge](../images/official-image-badge-iso.png) + +## In this section + +{{% sectionlinks %}} diff --git a/content/trusted-content/official-images/contributing.md b/content/trusted-content/official-images/contributing.md new file mode 100644 index 000000000000..32745419f93d --- /dev/null +++ b/content/trusted-content/official-images/contributing.md @@ -0,0 +1,58 @@ +--- +title: Contributing to Docker Official Images +description: | + This article describes how Docker Official Images are created, + and how you can contribute or leave feedback. +keywords: docker official images, doi, contributing, upstream, open source +--- + +Docker, Inc. sponsors a dedicated team that's responsible for reviewing and +publishing all content in Docker Official Images. This team works in +collaboration with upstream software maintainers, security experts, and the +broader Docker community. + +While it's preferable to have upstream software authors maintaining their +Docker Official Images, this isn't a strict requirement. Creating +and maintaining images for Docker Official Images is a collaborative process. +It takes place [openly on GitHub](https://github.com/docker-library/official-images) +where participation is encouraged. Anyone can provide feedback, contribute +code, suggest process changes, or even propose a new Official Image. + +> **Note** +> +> Docker Official Images are the intellectual property of Docker. + +## Creating a Docker Official Image + +From a high level, an Official Image starts out as a proposal in the form +of a set of GitHub pull requests. The following GitHub repositories detail the proposal requirements: + +- [Docker Official Images repository on GitHub](https://github.com/docker-library/official-images#readme) +- [Documentation for Docker Official Images](https://github.com/docker-library/docs#readme) + +The Docker Official Images team, with help from community contributors, formally +review each proposal and provide feedback to the author. This initial review +process may require a bit of back-and-forth before the proposal is accepted. + +There are subjective considerations during the review process. These +subjective concerns boil down to the basic question: "is this image generally +useful?" For example, the [Python](https://hub.docker.com/_/python/) +Docker Official Image is "generally useful" to the larger Python developer +community, whereas an obscure text adventure game written in Python last week is +not. + +Once a new proposal is accepted, the author is responsible for keeping their +images and documentation up-to-date and responding to user feedback. Docker is +responsible for building and publishing the images on Docker Hub. Updates to +Docker Official Images follow the same pull request process as for new images, +although review process for updates is more streamlined. The Docker Official +Images team ultimately acts as a gatekeeper for all changes, which helps +ensures consistency, quality, and security. + +## Submitting feedback for Docker Official Images + +All Docker Official Images contain a **User Feedback** section in their +documentation which covers the details for that specific repository. In most +cases, the GitHub repository which contains the Dockerfiles for an Official +Repository also has an active issue tracker. General feedback and support +questions should be directed to `#docker-library` on [Libera.Chat IRC](https://libera.chat). diff --git a/content/trusted-content/official-images/using.md b/content/trusted-content/official-images/using.md new file mode 100644 index 000000000000..35fae8bc7217 --- /dev/null +++ b/content/trusted-content/official-images/using.md @@ -0,0 +1,103 @@ +--- +title: Using Docker Official Images +description: | + Learn about building applications with Docker Official images + and how to interpret the tag names they use. +keywords: docker official images, doi, tags, slim, feedback, troubleshooting +weight: 10 +--- + +Docker recommends you use the Docker Official Images in your projects. +These images have clear documentation, promote best practices, and are regularly updated. +Docker Official Images support most common use cases, making them perfect for new Docker users. +Advanced users can benefit from more specialized image variants as well as review Docker Official Images as part of your `Dockerfile` learning process. + +## Tags + +The repository description for each Docker Official Image contains a +**Supported tags and respective Dockerfile links** section that lists all the +current tags with links to the Dockerfiles that created the image with those +tags. The purpose of this section is to show what image variants are available. + +![Example: supported tags for Ubuntu](../images/supported_tags.webp) + +Tags listed on the same line all refer to the same underlying image. Multiple +tags can point to the same image. For example, in the previous screenshot taken +from the `ubuntu` Docker Official Images repository, the tags `24.04`, +`noble-20240225`, `noble`, and `devel` all refer to the same image. + +The `latest` tag for a Docker Official Image is often optimized for ease of use +and includes a wide variety of useful software, such as developer and build tools. +Because of their ease of use and wide applicability, `latest` images are often +used in getting-started guides, but they're typically not optimized for production use. + +## Slim images + +A number of operating system and language stacks such as +[Debian](https://hub.docker.com/_/debian/), +[Node.js](https://hub.docker.com/_/node/), +[Python](https://hub.docker.com/_/python/), and +[Ruby](https://hub.docker.com/_/ruby/) have `slim` tag variants +designed to provide a lightweight, production-ready base image +with fewer packages. + +A typical consumption pattern for `slim` +images is as the base image for the final stage of a +[multi-staged build](https://docs.docker.com/build/building/multi-stage/). +For example, you build your application in the first stage of the build +using the `latest` variant and then copy your application into the final +stage based upon the `slim` variant. Here is an example `Dockerfile`. + +```dockerfile +FROM node:latest AS build +WORKDIR /app +COPY package.json package-lock.json ./ +RUN npm ci +COPY . ./ +FROM node:slim +WORKDIR /app +COPY --from=build /app /app +CMD ["node", "app.js"] +``` + +## Alpine + +Many Docker Official Images repositories also offer `alpine` variants. These +images are built on top of the [Alpine Linux](https://www.alpinelinux.org/) +distribution rather than Debian or Ubuntu. Alpine Linux is focused on providing +a small, simple, and secure base for container images, and Docker Official +Images `alpine` variants typically aim to install only necessary packages. As a +result, Docker Official Images `alpine` variants are typically even smaller +than `slim` variants. + +It's worth keeping in mind that Alpine Linux is based on musl libc, as opposed +to glibc, which is used by most other Linux distributions. This difference in C +implementations may influence how your program runs, depending on the type of +application you're building. With Alpine Linux, your program can't use +dynamically linked glibc objects, as those aren't available on musl. To run +your programs on Alpine Linux, you can: + +- Compile your program against musl libc +- Statically link glibc libraries into your program +- Avoid C dependencies altogether (for example, build Go programs without CGO) +- Install a glibc compatibility layer manually, alongside musl + +## Codenames + +Tags with words that look like Toy Story characters (for example, `bookworm`, +`bullseye`, and `trixie`) or adjectives (such as `focal`, `jammy`, and +`noble`), indicate the codename of the Linux distribution they use as a base +image. Debian release codenames are [based on Toy Story characters](https://en.wikipedia.org/wiki/Debian_version_history#Naming_convention), +and Ubuntu's take the form of "Adjective Animal". For example, the +codename for Ubuntu 24.04 is "Noble Numbat". + +Linux distribution indicators are helpful because many Docker Official Images +provide variants built upon multiple underlying distribution versions (for +example, `postgres:bookworm` and `postgres:bullseye`). + +Docker Official Images tags may contain other hints to the purpose of +their image variant in addition to those described here. Often these +tag variants are explained in the Docker Official Images repository +documentation. Reading through the “How to use this image” and +“Image Variants” sections will help you to understand how to use these +variants. diff --git a/data/toc.yaml b/data/toc.yaml index df85a750fe7c..7c0743df455d 100644 --- a/data/toc.yaml +++ b/data/toc.yaml @@ -2208,8 +2208,14 @@ Manuals: section: - path: /trusted-content/ title: Overview - - path: /trusted-content/official-images/ - title: Docker Official images + - sectiontitle: Docker Official Images + section: + - path: /trusted-content/official-images/ + title: Overview + - path: /trusted-content/official-images/using/ + title: Using official images + - path: /trusted-content/official-images/contributing/ + title: Contributing - path: /trusted-content/dvp-program/ title: Docker Verified Publisher Program - path: /trusted-content/dsos-program/