Stephen Day

@alimoeeny Further research shows that the 30ms connection overhead isn't the biggest bottleneck when making round trips to s3. I'm not sure if it changes this ticket but it does...

@thaJeztah This might be as simple as preserving the tag in the digest-qualified reference. For example, something like this: ``` foo:latest@sha256:aabbff11 ``` @nishanttotla Is this an easy fix?

@aaronlehmann Understood. Could we populate this field in `docker ps` with the value from the actual running container or whatever preserves the reference?

@aluzzardi The `/metrics` endpoint is a read only API. Exporting the docker API is not granular enough, in practice, to allow prometheus to only hit the metrics endpoint while avoiding...

@aluzzardi I think the right solution is to retain the `--metrics-addr` flag but also bind `/metrics` to the "docker API" by default (not actually part of the API but bound...

> Well, after thinking a bit, adding a port seems like a copout for the lack of AuthN/Z. Not really. Separating metrics and main API is a time honored technique....

> 2 - Provide people with a one-line container/service that only exposes /metrics on another port? If we make this too hard, people will opt for exposing the entire docker...

> I genuinely believe that solving this problem for /*insert-api-here* is of more value to the security of our users than solving the specific case for /metrics Yes, but when...

@aluzzardi Fair enough, but I think a lot of users will just bind the docker API directly to the main port unless we make this clear. This also costs an...

@aluzzardi How about we just do both?