4 ms·

What is a solution for the scenarios you have described? Amazon has ECR but it doesn’t support signing and doesn’t function as a proxy so you would miss upstrea

What is a solution for the scenarios you have described? Amazon has ECR but it doesn’t support signing and doesn’t function as a proxy so you would miss upstream changes unless someone pushed them. Anything self hosted that supplies that functionality?

scarface74 6y ago
Pay $5.00 a month. Docker is a business that deserves to get paid if they offer something valuable.
- zxcvbn4038 6y ago
  Well that takes all the fun out of it. Looks like Docker itself has a Dockerhub proxy - https://docs.docker.com/registry/recipes/mirror/ https://docs.docker.com/registry/recipes/mirror/ https://hackernoon.com/mirror-cache-dockerhub-locally-for-speed-f4eebd21a5ca https://hackernoon.com/mirror-cache-dockerhub-locally-for-sp... https://stackoverflow.com/questions/32531048/docker-pull-through-cache-for-private-registry-not-working https://stackoverflow.com/questions/32531048/docker-pull-thr... https://docs.docker.com/registry/configuration/ https://docs.docker.com/registry/configuration/ https://www.google.com/amp/s/ops.tips/amp/gists/aws-s3-private-docker-registry/ https://www.google.com/amp/s/ops.tips/amp/gists/aws-s3-priva... If using Alpine, looks like docker-registry is the needed package and /usr/bin/docker-registry serve /etc/docker-registry/config.yml is the command line. Next to last link has information on the config file.
  - AaronFriel 6y ago
    Per your first link: > What if the content changes on the Hub? > When a pull is attempted with a tag, the Registry checks the remote to ensure if it has the latest version of the requested content. Otherwise, it fetches and caches the latest content. If that causes a manifest pull, it counts as a pull and will be rate limited. Yikes! This could lead to wildly nondeterministic behavior.
    - zxcvbn4038 6y ago
      Yes, it does a pull but caches the response, so subsequent pulls should hit the local cache and not be limited.
      - AaronFriel 6y ago
        I don't think that's what it means. > When a pull is attempted with a tag, the Registry checks the remote Checking the remote is a manifest pull.
        zxcvbn4038 6y ago
        Difference is HEAD request or conditional GET, the server will not send a file if it matches the time and/or tag of the version you have, so you are replying with a few bytes rather then (potentially) dozens or hundreds of megabytes. Same with all CDNs.
        judge2020 6y ago
        This still counts as a manifest pull for rate limiting purposes based on what i'm seeing in this thread.
pbalau 6y ago
Do you really need all your private images to be derived directly from the upstream? Don't you start every image with: FROM foo RUN apt-get upgrade etc ? Then why not have a set of base images, derived directly from upstream that get built every so often and have your private images be derived from that? This will not only relieve the stres on DockerHub and prevent you from having to pay the 5/month, but also give your security people a hook to run their tests and make your private images build faster, since all the system updates won't happen every time you change the code.

scarface74 6y ago

Pay $5.00 a month. Docker is a business that deserves to get paid if they offer something valuable.

zxcvbn4038 6y ago
Well that takes all the fun out of it. Looks like Docker itself has a Dockerhub proxy - https://docs.docker.com/registry/recipes/mirror/ https://docs.docker.com/registry/recipes/mirror/ https://hackernoon.com/mirror-cache-dockerhub-locally-for-speed-f4eebd21a5ca https://hackernoon.com/mirror-cache-dockerhub-locally-for-sp... https://stackoverflow.com/questions/32531048/docker-pull-through-cache-for-private-registry-not-working https://stackoverflow.com/questions/32531048/docker-pull-thr... https://docs.docker.com/registry/configuration/ https://docs.docker.com/registry/configuration/ https://www.google.com/amp/s/ops.tips/amp/gists/aws-s3-private-docker-registry/ https://www.google.com/amp/s/ops.tips/amp/gists/aws-s3-priva... If using Alpine, looks like docker-registry is the needed package and /usr/bin/docker-registry serve /etc/docker-registry/config.yml is the command line. Next to last link has information on the config file.
- AaronFriel 6y ago
  Per your first link: > What if the content changes on the Hub? > When a pull is attempted with a tag, the Registry checks the remote to ensure if it has the latest version of the requested content. Otherwise, it fetches and caches the latest content. If that causes a manifest pull, it counts as a pull and will be rate limited. Yikes! This could lead to wildly nondeterministic behavior.
  - zxcvbn4038 6y ago
    Yes, it does a pull but caches the response, so subsequent pulls should hit the local cache and not be limited.
    - AaronFriel 6y ago
      I don't think that's what it means. > When a pull is attempted with a tag, the Registry checks the remote Checking the remote is a manifest pull.
      - zxcvbn4038 6y ago
        Difference is HEAD request or conditional GET, the server will not send a file if it matches the time and/or tag of the version you have, so you are replying with a few bytes rather then (potentially) dozens or hundreds of megabytes. Same with all CDNs.
        judge2020 6y ago
        This still counts as a manifest pull for rate limiting purposes based on what i'm seeing in this thread.

pbalau 6y ago

Do you really need all your private images to be derived directly from the upstream? Don't you start every image with: FROM foo RUN apt-get upgrade etc ? Then why not have a set of base images, derived directly from upstream that get built every so often and have your private images be derived from that? This will not only relieve the stres on DockerHub and prevent you from having to pay the 5/month, but also give your security people a hook to run their tests and make your private images build faster, since all the system updates won't happen every time you change the code.