2026-09-05 10:27:11 +00:00
1 changed files with 8 additions and 1 deletions
@@ -113,7 +113,14 @@ apply time. A tag moves; a digest does not, and reproducibility comes from pinni
 a thing rather than carrying its bytes.

 The assumption that a machine might have no network came from the lab and was wrong: a machine
-being adopted has one, and the sealed case is the lab, which places images itself.
+being adopted has one, and the sealed case is the lab.
+
+**The lab places images by raising a registry inside the scenario**, which is what a real node
+pulls from anyway — so it tests the real path rather than a stand-in for it. The digests that
+registry serves are its own, and that satisfies this rule: what is required is a reference that
+is **exact and cannot move**, and one it assigned is both. Assuming an upstream digest had to be
+preserved is what made this look impossible for a while
+([04-ISSUES/009](../04-ISSUES/009-a-digest-pinned-image-cannot-be-placed-in-the-lab/00-report.md)).

 **Its contents are per operating system** even though its mechanism is not — package names, unit
 names and service names all differ, so an Arch host embeds an Arch bundle.