Leverage GitLab metadata to streamline package management

Problem Statement

The GitLab Package and Container Registries do not fully leverage the benefits of GitLab's single application. Users are using GitLab to build, publish and share images and packages, but we do not expose most of the useful metadata to users to about how an image or package was built, by whom or when and where it was last used.

Some initial discussions have taken place in: #30261 (closed)

• Discussion guide
• Opportunity canvas

Reach

This impacts users that are using GitLab's Container and/or Package Registry and pipelines to build packages and images.

• Software Developer
• DevOps Engineer
• Systems Administrator
• Security Analyst

3.0 = Significant reach (~25% to ~50%).

Impact

We know from a recent survey, that users navigate to the Registry UI to accomplish 3 primary tasks:

1. To look up which image or tag I should be using in my environment (32%)
2. To verify my CI pipeline built the image as expected (28%)
3. To ensure my image was uploaded correctly (22%)

By displaying additional metadata, such as which pipeline built an image, we can ensure that when users navigate to the registry, they find the information they are looking for and can help them to remediate problems sooner.

1.0 = Medium impact

Confidence

We know this a problem from a recent survey we conducted and subsequent user interviews.

100% = High confidence

Effort

This is a significant amount of work. The primary challenge is on the backend and figuring out how tie data from the projects API to a given package or image. This will be much more challenging for the Container Registry, because it is not part of GitLab and we have minimal knowledge of what commands are executed by Docker. However, this work will be required for any major improvements to the Container Registry.

• PM .5
• UX 1
• Frontend Engineer: 1
• Backend Engineer: 2

Total: 4.5 (though this is highly speculative as no specific solution has been identified)