# Proposal: add the global configuration to force to pull Docker image on every step

**URL:** <https://drone.discourse.group/t/proposal-add-the-global-configuration-to-force-to-pull-docker-image-on-every-step/10812>\
**Category:** Drone Support\
**Created:** [August 2, 2019, 6:44am UTC](https://drone.discourse.group/t/proposal-add-the-global-configuration-to-force-to-pull-docker-image-on-every-step/10812 "2019-08-02T06:44:03Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![suzuki-shunsuke](https://yyz1.discourse-cdn.com/flex003/user_avatar/drone.discourse.group/suzuki-shunsuke/32/4424_2.png) [@suzuki-shunsuke](https://drone.discourse.group/u/suzuki-shunsuke)\
**Post date:** [August 2, 2019, 6:44am UTC](https://drone.discourse.group/t/proposal-add-the-global-configuration-to-force-to-pull-docker-image-on-every-step/10812/1 "2019-08-02T06:44:03Z")

</div>

If the private Docker image is pulled once on a server,  
builds run on the same server can use the private image without authentication.

> <https://github.com/drone/drone-runtime/blob/v1.0.7/engine/docker/docker.go#L122-L134>

But in terms of security, it may be dangerous.  
So I propose to add the configuration to force to pull Docker image on every step, which means every step can’t use the local image on Drone agent.

For example, add the environment variable “DRONE\_IMAGE\_PULL\_ALWAYS”.  
By default the environment variable is “false” but if the environment is “true”, on every step “pull” setting is ignored and Docker image is pulled.

I want to know your opinions about it.

Thank you.

---

<div class="post-metadata">

**Author:** ![suzuki-shunsuke](https://yyz1.discourse-cdn.com/flex003/user_avatar/drone.discourse.group/suzuki-shunsuke/32/4424_2.png) [@suzuki-shunsuke](https://drone.discourse.group/u/suzuki-shunsuke)\
**Post date:** [August 4, 2019, 1:17pm UTC](https://drone.discourse.group/t/proposal-add-the-global-configuration-to-force-to-pull-docker-image-on-every-step/10812/2 "2019-08-04T13:17:26Z")

</div>

I have implemented this feature.  
In the implementation, if the environment variable “DRONE\_IMAGE\_PULL\_ALWAYS” is true  
the pull setting of every step and service are overwritten to “always”.  
It works well.

> <https://github.com/suzuki-shunsuke/drone/commit/a3d5489fab9e8575cea44b4caad0d5a1c9256240>

---

<div class="post-metadata">

**Author:** ![suzuki-shunsuke](https://yyz1.discourse-cdn.com/flex003/user_avatar/drone.discourse.group/suzuki-shunsuke/32/4424_2.png) [@suzuki-shunsuke](https://drone.discourse.group/u/suzuki-shunsuke)\
**Post date:** [August 4, 2019, 1:58pm UTC](https://drone.discourse.group/t/proposal-add-the-global-configuration-to-force-to-pull-docker-image-on-every-step/10812/3 "2019-08-04T13:58:31Z")

</div>

This problem occurs in other platform such as CircleCI and k8s, so I’m interested in how those platform are dealing with this problem.  
It may be useful for Drone too.