I noticed that the plugin integration tests install plugins from the Hub:

pName             = "tiborvass/sample-volume-plugin"
pTag              = "latest"
pNameWithTag      = pName + ":" + pTag

...

func (s *DockerSuite) TestPluginBasicOps(c *check.C) {
        testRequires(c, DaemonIsLinux, IsAmd64, Network)
        _, _, err := dockerCmdWithError("plugin", "install", "--grant-all-permissions", pNameWithTag)
        c.Assert(err, checker.IsNil)
...

I see a few problems with this:

• Use of the Hub means a service outage or transient network issue will make the test appear flaky. We've had this problem with some pull tests before, and have tried to use a local registry instead wherever possible.
• If the plugin is updated on Hub to an incompatible version, it will break integration tests for older versions of Docker.
• The plugin is installed with full privileges, so a compromise of this Hub account can lead to root access on any machine that runs the integration tests.
• It's a waste of bandwidth to pull the plugins from the internet every time a test which uses them runs.

I think it would be a lot better to bake the plugins into the Docker image and serve them from a local registry.

cc @tiborvass @tonistiigi @vdemeester @anusha-ragunathan