26 ms·
AWS pre-announces public container image registry
- ralph87 6y ago500GB/mo. presumably per IP address for anonymous pulls. Amazon have absolutely no problem revealing the true cost of egress when it suits them. Also, "500GB/mo.", at launch. Let's not forget those generous free limits can be slashed whenever it suits, and why they might be so generous for launch at all. Don't be mistaken, actually using this for public images is falling for another "data gravity" marketing gimmick. So they attract enough public images that some folk find one or more of their services absolutely must pull from AWS, pushing their corporate NAT address over the 41GB/day limit. Now your "free" hosting has become a reason for that company to start paying ~$45/month to AWS in egress fees just to use your images, and perhaps with a new ticket in the backlog to consider simply moving the cluster to AWS. "But it'll always be like that regardless of provider", not necessarily. The reason that Docker registry consumes a ridiculous amount of bandwidth is largely an architectural issue, both in the software and the design of the client's network. Perhaps a better direction is addressing this immense waste of networking rather than turning it into another free marketing opportunity for a near-monopolistic cloud
- toomuchtodo 6y agoFor commercial use, $45/month is a low enough cost to be noise for many businesses (even though the bandwidth transfer markup is eye watering). If it’s breaking your budget, you can always pull and then push to another registry (it’s just tarballs after all) or build new images from scratch with your Dockerfiles. Open source projects and similar cost sensitive use cases might consider https://github.com/miguelmota/ipdr https://github.com/miguelmota/ipdr Docker Hub is similar to Youtube in the sense that it’s a whole lot of bandwidth and storage used and someone has to pay for it. Could you run your own? Time is expensive. Don’t unless you absolutely have to.
- ralph87 6y ago$45/mo would be the minimum payment, assuming the free limit announced today actually lasted. Let's say they begin crying 12 months from now and knock it down even by 50%, now you're looking at $810 minimum per year per client site. Multiply that up by, say, 1000 sites, and you're starting to look at a "free" service that might completely pay for its own development within a year or two.
- toomuchtodo 6y agoThat has historically not been the direction AWS prices go, but as I mention in my other comment, it’s trivial to move if AWS tries to put you over a barrel. Object storage is a commodity, and Docker images are objects, so shrug. It would be cool if Cloudflare supported container registry primitives backed by user provided Backblaze B2 bucket config info, for example (maybe you can do this with workers?). Properly parameterize your build/CI scripts (in this case, your container registry host and how to auth against it) for portability. Portability is your insurance against poor service provider behavior.
- mariusmarais 6y agoThis sounds more like the Oracle model than AWS. Or exactly what Docker just did if you squint a bit. In which case, just move.
- jamesfe 6y agoSure, but say your engineers cost you $100/hr, and every hour beyond 2,000hrs per year they work, they become more unhappy. I think it's worth spending the 8 hours/yr/site, supposing you have relatively few sites. Plus, your engineers for 1hr/month will never achieve the same SLAs that AMZN will. For smallish numbers of sites, it seems like the AMZN solution is fine. For bigger ones, there is always enterprise pricing :-)
- temp667 6y agoDoes AWS raise prices like this (I know Oracle does - OUCH). I've yet to be hit by one of these price increases and have been on AWS since the beginning. Until I migrated they supported my SimpleDB app FOREVER (I mean, it wasn't even on website at one point but the calls still worked!). A small part of AWS success must be because of this confidence they will stick around, keep a service running.
- tidepod12 6y agoThis entire post is just unnecessary fear-mongering. >Also, "500GB/mo.", at launch. Let's not forget those generous free limits can be slashed whenever it suits, and why they might be so generous for launch at all. AWS has, to my knowledge, never increased the cost of any service after launch. They do, however, have a long history of reducing prices. You also completely neglected to mention this part: >Simply authenticating with an AWS account increases free data bandwidth up to 5 TB each month when pulling images from the internet. And finally, workloads running in AWS will get unlimited data bandwidth from any region when pulling publicly shared images hosted on AWS. So yes, AWS gives some incentive to create an AWS account, and an even further incentive to use AWS services. All I can say to that is... duh?
- ethanwillis 6y agoThe problem is not that they give incentives. It's why they give incentives. Why do they want marketshare? It's simple, they're a business, they want to milk you for money. And like their forebears they understand well that the more they lock you into their solutions the more likely you are to keep paying for money even when you're mad at them for something they inevitably do that you don't agree with.
- tidepod12 6y agoOh the horror of a business that wants to make money off of the services they are offering! Do you work for a company that just gives away all of their services and products for free, or...?
- ethanwillis 6y agoYou're a funny guy. Nothing is wrong with a business making money. What's wrong with Amazon is that they're going to make extra money through extortionate business practices and you're going to be shit out of luck looking for an alternative after they crush all of their competitors in ways that are not healthy to a functioning market.
- renewiltord 6y agoSwitching Docker registries is kind of really easy so I wouldn't sweat it.
- mcintyre1994 6y agoFor what it’s worth I’m not aware of AWS ever slashing a free tier or increasing pricing, though they do so much that I definitely could have missed something. Does anyone know of any examples particularly of them slashing a free tier later?
- tpetry 6y agoEveryone is beating him for his incorrect predictions about AWS pricing changes. But nobody focuses on the most important point: Somehow AWS can give you a lot of egress traffic for free, something _you_ would pay a lot of money for. This is clearly showing that egress pricing is heavily inflated so every cloud can print a lot of money.
- jfim 6y agoEgress pricing is there for another reason as well. It's meant to make it hard to move out of AWS. If one looks at the pricing for AWS Snowball [0], their bulk data transfer device, there's no per gigabyte cost to get data into AWS, but $0.03/GB to get data out. I'm pretty sure the bits are just as heavy coming into AWS as they are coming out. :-) [0] https://aws.amazon.com/snowball/pricing/ https://aws.amazon.com/snowball/pricing/
- oblio 6y agoI think it's also a convenient way to get rid of piracy and garbage content. You can't host MegaFileShare on AWS because it would cost too much and AWS doesn't have to bother about useless legal discussions since your value to them as a customer is really low for this use case.
- thu2111 6y agoNot necessarily. When bandwidth balances you can get peering agreements, but AWS will be very server heavy. Moving data in would just improve their ratios and help them reduce their own costs, so, it makes sense to make it free.
- moritonal 6y agoIn regards to "But it'll always be like that regardless of provider", it's worth noting that distributed file-systems are situated perfectly to provide a torrent-like way of downloading containers. Self-blog just because it's easily at hand: https://blog.bonner.is/docker-registry-for-ipfs/ https://blog.bonner.is/docker-registry-for-ipfs/
- marcinzm 6y agoUnlike other companies AWS understands how to keep customers and maintain good will. They start with moderate prices and then decrease them as they better understand the market. Never increase them. You won't see the same great initial deals from AWS as other providers (ie: Google Kubernetes) but you can be certain your deal won't go away.
- koolba 6y ago> Within weeks, AWS will deliver a new public container registry that will allow developers to share and deploy container images publicly. This new registry will allow developers to store, manage, share, and deploy container images for anyone to discover and download. > ... > A new website will allow anyone to browse and search for public container images, view developer provided details, and see pull commands — all without needing to sign in to AWS. AWS-provided public images such as the ECS agent, Amazon CloudWatch agent, and AWS Deep Learning Container images will also be available. Vacuums get filled quick.
- parhamn 6y agoPoor Docker. They created an ecosystem and tooling that is now critical to a large majority of software teams. Many cloud providers built large lucrative services on top of it using their existing networks to get market share (e.g EKS/Kube over say Swarm). Now Amazon can simply cut their last few legs (monetizing the registry) under them because it’s just a small cost leader to them. As consumers if we just keep taking the freest lunch without any care or love for the general OSS ecosystem there will be a ton of adverse effects. This is a pretty F’ed up way to do business. This is how you get people to stop doing nice things like writing open software. It’s even more frustrating and reprehensible that they’re doing this under the guise of supporting the community.
- deleted 6y ago[deleted]
- sneak 6y ago> This is how you get people to stop doing nice things like writing open software. Docker stopped making open software before they limited the pulls. Docker Enterprise for Windows (Windows dockerd, basically), Docker Desktop for Mac, and Docker Desktop for Windows are all closed-source and proprietary. Docker-the-company hasn’t cared much for open source in a while.
- nickstinemates 6y agoSad times
- m463 6y agothe thing that annoyed me was the telemetry in the mac installer before you even did an install. Additionally they made it hard to do a personal registries, which is what's going to happen now anyway. I think they tried to keep themselves in the loop too much, because it's valuable for business and monetizing was a long term goal. here's the thread I saw: https://stackoverflow.com/questions/33054369/how-to-change-the-default-docker-registry-from-docker-io-to-my-private-registry https://stackoverflow.com/questions/33054369/how-to-change-t... pointing to this: https://github.com/moby/moby/issues/7203 https://github.com/moby/moby/issues/7203 and also there was this comment: "It turns out this is actually possible, but not using the genuine Docker CE or EE version. You can either use Red Hat's fork of docker with the '--add-registry' flag or you can build docker from source yourself with registry/config.go modified to use your own hard-coded default registry namespace/index."
- bg24 6y agoWho gets hurt? Docker Hub?
- peterwwillis 6y agoI don't see how. They only lose money on public anonymous pulls. Docker's eventually going away and distros will replace it with a home grown alternative (or systemd). I predict that in 10 years distros will finally move toward a container native model (different from what we have now, but still based on containerization) and host their own registries for officially packaged containers. The same people that mirror their packages will host the registries. You'll add trusted registries the same way you add trusted package repos. In theory, this might actually reduce their overall bandwidth use.
- bdcravens 6y agoMindshare as THE go-to solution? They wanted to become Github for their space. While you can use private package registries, I suspect that's a 1% use case right now.
- myroon5 6y agoSomething like IAM seems necessary to authorize fork PRs to pull from but not push to registries: https://github.com/GoogleContainerTools/skaffold/issues/4432 https://github.com/GoogleContainerTools/skaffold/issues/4432 in order to rate limit unauthenticated pulls: https://docs.docker.com/docker-hub/download-rate-limit/ https://docs.docker.com/docker-hub/download-rate-limit/
- momokoko 6y agoDoes this in some way end up in an anti-trust vertical integration situation? Dockerhub runs on AWS infrastructure to begin with. Is this similar enough to the railroad company undercutting the freight company that uses their railroad tracks?
- threeseed 6y agoa) Nobody cares about container registries. b) There are dozens of alternatives so AWS isn't going to be a monopoly nor impede competition.
- bdcravens 6y agoExcept other competing services also run on AWS, and have for years (some depend solely on AWS, like Heroku; others are multi-cloud, like MongoDB Atlas)
- _alex_ 6y agoThere are TONS of companies running on AWS that face competition from AWS. Snowflake just IPO’d. They run on AWS and sell a data warehouse service. AWS also has its own data warehouse called redshift
- EugeneOZ 6y agoWell... If someone is making money using free or anonymous plans of Docker Hub, than simplest solution would be just switching to a paid plan. No AWS ”solutions” needed.
- mcintyre1994 6y agoI think the real benefit/monopoly pull of this is free unlimited bandwidth from inside the AWS cloud. If you’re making money and switch to a docker hub paid plan, your paying customers using AWS might ask you to host on AWS too so they get trivial and free pulls. And it’ll probably be cheaper for you too. The AWS solution might not be needed but it’ll be hard to avoid if your paying customers are already on AWS and you want to offer them the best experience you can.
- ithkuil 6y agoWhy is it so hard to have effective mirrors of images? Images are basically content addressed, it should be easy to create an ecosystem where when you first use an image you pin a copy on a private cache, instead of shuffling hundreds of GB around to each leaf node of your clusters. This way cloud providers could still sell you a managed service that implements such a cache, but it would be used transparently instead of having to change your manifests and/or FROM stanzas. Netflix iirc has implemented a registry that uses IPFS. But talking to the right registry still requires that the image name includes the hostname of the registry. The docker daemon has a registry-mirrors option; you can already use that to point to https://mirror.gcr.io https://mirror.gcr.io . But you can use it only to cache the special "docker hub" images. This seems to be a self-inflicted problem. Docker the company possibly wanted to be in the critical path
- ryan29 6y agoAFAIK, the FQDN is used for connecting to the registry, but it's not passed to the registry. So when you pull `ecr.example.com/namespace/project` the daemon connects to `ecr.example.com`, but the registry only sees `namespace/project`. There was an old proposal [1] to pass the FQDN to the registry. That would allow for an auto-magical pull through cache / mirror combo along the lines of what you're asking about. For now I use a Nexus as a pull through cache, so `hub.example.com/library/image` is an image from Docker Hub where I want it to come through the cache. Anything that's important enough to have a local copy gets pulled/pushed into my private registry. I actually find the distinction between the cache (volatile) and the registry (non-volatile) to be useful. If I had to take a guess as to why Docker stubbornly clung to the current system it's that it's adhesive. Once you start using an alternate registry for base images, etc. it becomes really tough to swap to another one. The big mistake there is that instead of being the go to destination for public images, everyone is wholesale switching to the registry from their preferred cloud provider. 1. https://github.com/docker/distribution/issues/1620 https://github.com/docker/distribution/issues/1620
- lgbr 6y agoArtifactory does precisely this. It's particularly useful since large organizations want to minimize their risk of, for example, a Docker Hub outage preventing an emergency hotfix. In Artifactory you can setup 'remote repositories' which are then overlayed on top of your own repository within Artifactory. Docker provides the `registry-mirrors` setting which then will automatically redirect all pulls to Artifactory rather than Docker hub. There's no need to change your manifests and/or FROM stanzas.
- politelemon 6y agoI think it'll be confusing having two container registry solutions in an AWS account.
- jordan_7 6y agoThis is exciting! On a different note, recently I was looking to learn AWS concepts through online courses. After so much of research I finally found this e-book on Gumroad which is written by Daniel Vassallo who has worked in AWS team for 10+ years. I found this e-book very helpful as a beginner. This book covers most of the topics that you need to learn to get started: If someone is interested, here is the link :) https://gumroad.com/a/238777459/MsVlG https://gumroad.com/a/238777459/MsVlG
- Havoc 6y agoStill trying to wrap my head around who is actually hitting those docker limits
- kkapelon 6y agoAll people that don't have a private registry mirror setup. Especially in CI pipelines that like to rebuild images from scratch.
- Havoc 6y ago>Especially in CI pipelines that like to rebuild images from scratch. If people are doing that at scale on free accounts then I can see why dockerhub feels the need to impose limits on their free offering. Also...this is why we can't have nice things.
- Aeolun 6y agoMy CI/CD workers that run a few hundred jobs per hour?
- Havoc 6y agoAnd they're configured to redownload it every single time? No local caching whatsoever?
- moduspol 6y agoI expected our offices would hit them if our devs weren't working from home. That'd be all the devs at a given site pulling images from the same public IP address. Although in case it's what you're asking: we haven't actually hit the limits yet. They're being progressively enforced. We're just taking steps to avoid being impacted when they do start affecting us.
- Corrado 6y agoWe hit them with our CI processes. Actually, I was a bit surprised that it happened because we only do 10-15 builds a day which shouldn't have triggered the throttle. Maybe there are some background checks that are happening in CircleCI that we don't know about or something.
- ing33k 6y agoI tried their private registry. it works , but authentication is a pain.
- jopsen 6y agoI recall the early days, the docker registry API was designed in a way that made serving from S3 impossible. It always boggled my mind, because it must have made hosting docker hub super expensive. In hindsight, the registry should have had a better API, been more suited for third-party mirrors, etc. then docker might still own the central registry... Now it seems like eventually they won't even own that.
- temp667 6y agoI had the same thought. There should have been a play where you were the trusted metadata layer (across clouds even), but allowed actual images to come from S3, GCP, Azure directly (ie, serve metadata + hashes / signatures). Obviously AWS and everyone would spin up their own mirrors, lots of bandwidth would be saved (by Docker too) and they would still have a role in the center.
- ilaksh 6y agoIt seems to me that Docker created something so absolutely amazing that everyone decided it was essential. Then it became an assumption. And then everyone started taking it for granted. To the point where Docker doesn't even get credit for what it does. Personally I believe that what society rewards is quite pervese and often random. Anyway before you jump on this AWS registry at least compare the pricing with Docker Hub.
- thu2111 6y agoLook at it another way. Docker is a complete PITA with many severe flaws as a piece of software, but it won because it raised investor money and spent it on stuff that was then given away for free. Basically it funnelled investor money into everyone else's budgets, which is a pretty sweet deal. If they hadn't done that, and if they'd worked on scaling their business in line with revenues, then quite possibly they'd have (A) more competitors and (B) better software. But it's hard to compete with free.
- easton 6y agoIf I were Microsoft I’d let Docker Hub just have free or extremely cheap bandwidth on Azure. Get good PR, help make sure that people can still easily move their applications to Azure (whether as a container or as part of a big k8s setup). They need it to stick around to make sure people that get going in AWS can move their stuff easier.
- fnord77 6y agoI can't put my finger on it, but there's something that feels predatory and maybe zero-sum-ish about this. AWS wins, docker loses. I guess this is considered a "shrewd" business move. I don't like it.
- flowerlad 6y agoAWS has a lot of catching up to do when it comes to Docker support. It is so easy to use Docker in Azure. You can create a web app (App Service) directly off of a Docker image. When you make code changes just push the new image and the web site automatically updates. Even more interesting is Azure Container Instances where you run a docker image briefly and pay only for the brief time you run it. I use AWS lightsail, which is awesome, but would be even more awesome if it supported Docker images out of the box.
- damm 6y agoI was thinking about using Github to replace the Docker Image registry. I'm sure Github would be against that kind of load but maybe not?
- manuel_w 6y agoIs there an alternative alternative containerization platform which has a more structured and consistent CLI? I found the CLI always a bit hard to grasp at the beginning, and still dislike it somewhat. The general structure is `docker image pull` to pull an image from some registry or `docker image build` create one from a Dockerfile, `docker container create` to turn the image into a container, and `docker container start` to start the container. But then there are a few other commands which essentially seem to be combinations of these, or accomplish these as a side-effect.