15 ms·

Poor Docker. They created an ecosystem and tooling that is now critical to a large majority of software teams. Many cloud providers built large lucrative servic

Poor Docker. They created an ecosystem and tooling that is now critical to a large majority of software teams. Many cloud providers built large lucrative services on top of it using their existing networks to get market share (e.g EKS/Kube over say Swarm). Now Amazon can simply cut their last few legs (monetizing the registry) under them because it’s just a small cost leader to them. As consumers if we just keep taking the freest lunch without any care or love for the general OSS ecosystem there will be a ton of adverse effects. This is a pretty F’ed up way to do business. This is how you get people to stop doing nice things like writing open software. It’s even more frustrating and reprehensible that they’re doing this under the guise of supporting the community.

deleted 6y ago
[deleted]
sneak 6y ago
> This is how you get people to stop doing nice things like writing open software. Docker stopped making open software before they limited the pulls. Docker Enterprise for Windows (Windows dockerd, basically), Docker Desktop for Mac, and Docker Desktop for Windows are all closed-source and proprietary. Docker-the-company hasn’t cared much for open source in a while.
- nickstinemates 6y ago
  Sad times
- m463 6y ago
  the thing that annoyed me was the telemetry in the mac installer before you even did an install. Additionally they made it hard to do a personal registries, which is what's going to happen now anyway. I think they tried to keep themselves in the loop too much, because it's valuable for business and monetizing was a long term goal. here's the thread I saw: https://stackoverflow.com/questions/33054369/how-to-change-the-default-docker-registry-from-docker-io-to-my-private-registry https://stackoverflow.com/questions/33054369/how-to-change-t... pointing to this: https://github.com/moby/moby/issues/7203 https://github.com/moby/moby/issues/7203 and also there was this comment: "It turns out this is actually possible, but not using the genuine Docker CE or EE version. You can either use Red Hat's fork of docker with the '--add-registry' flag or you can build docker from source yourself with registry/config.go modified to use your own hard-coded default registry namespace/index."
  - sneak 6y ago
    Docker Desktop is terrible spyware. I managed to crash it a few times recently and intercepted the reports before they were sent off; it collects a ton of sensitive information about your computer in the crash report it sends, including pcap logs(!). I’ll never run code from them I didn’t build myself. That company is super shady now.
  - djrobstep 6y ago
    What's the hard aspect of doing personal registries? I found it easy enough, although only set up something very basic.
    - curryst 6y ago
      It's not hard, it's just clunky. You have to put the full URL of your Docker registry every time you reference the image. There's no way to say "just always use this registry instead". I haven't found it terribly difficult to set up either, just annoying.
- bdcravens 6y ago
  I'm not sure they ever followed through completely, but that was part of the idea between Docker/moby
- zapita 6y ago
  Didn’t they just stop launching new OSS projects, and focused on maintaining what they already have launched? They’ve been criticized a lot over the years (correctly, I think) for lacking focus. Are we now criticizing them for narrowing down their focus?
BurritoAlPastor 6y ago
“Software might stop being free unless we start paying for it” has a certain circular irony.
- parhamn 6y ago
  Only if you squint at and reduce the actual matter enough so you can make a cute point.
  - fiddlerwoaroof 6y ago
    Yeah, this is the ambiguity GNU/FSF people go on and on about. “Free” in the interesting sense means “available to modify and use as you like, as long as you don’t prevent other people from doing the same”
- paulryanrogers 6y ago
  It's not ironic if you consider the intent is that software paid for by other companies or volunteers may no longer be if huge companies take all the upside.
deanCommie 6y ago
Before Netflix and iTunes/Spotify, people were convinced that nobody would ever pay for movies and music on computers ever again. Turns out a product more convenient than piracy was worth people paying money for. Now there are 18 streaming services and piracy rates are climbing again. Ebbs and flows. Open source software is amazing but infrastructure development is a substantial part of any businesses development costs. AWS offers higher level abstractions - for a fee. In our industry people always take that option, until the cloud providers value proposition becomes no longer attractive, and open source innovation flourishes again. AWS makes really good stuff, there is value in that.
- paulryanrogers 6y ago
  AWS also takes good stuff, giving little or nothing back, and supplants solutions that fund the original. Hence the move to AGPL and similar licenses.
jen20 6y ago
> critical to a large majority of software teams. Do you have a reference for that?
- steve_adams_86 6y ago
  I personally haven’t worked on a software team not using containers in around 8 years. One place was kind of an exception - containerization was on the road map, but not in use in production yet. They’re everywhere. I’ve deployed 3 containerized services in the last 6 weeks - 2 using Go and 1 using Node. They’re kind of the default these days, especially when deploying to AWS/GC. I assume it must be similar to some degree for a lot of developers here.
- renewiltord 6y ago
  Out of curiosity, what sort of reference were you expecting? (I promise I didn't vote on your comment and I'm just curious)
  - jen20 6y ago
    Some kind of white paper (even vendor supported) indicating that a majority, or even close to it, is using containers. As far as I can tell, the state of the art for enterprises, which still make up the bulk of software development, is ASP.NET and J2EE, deployed to bare metal or VMWare VMs. The hacker news bubble may be stronger than realised on this topic.
    - renewiltord 6y ago
      I see. Thank you.
- bdcravens 6y ago
  Pretty much 100% of the Docker tutorials and references out there tell you to pull core images (ie "FROM ruby" or "FROM ubuntu").
systemvoltage 6y ago
Docker should have just remained free for personal use and small companies, say less than 50 employees and charge a lot more for enterprises. Why aren't more licenses like this? What are the downsides? Traction? I am thinking how Adobe has made it easy to crack Photoshop so that students once they graduate demand Photoshop and Adobe Suite for their workflow. Docker should have been smarter.
- viraptor 6y ago
  If the containers caught on, someone would write a replacement. I mean podman exists. For the majority of use cases, you need only a tiny amount of docker's features.
- INTPenis 6y ago
  > Docker should have just remained free for personal use and small companies, say less than 50 employees and charge a lot more for enterprises. It sort of is, in a way. We have an on-prem k8s cluster that is small enough to fly under the 100pulls/6hrs limit. I believe even our Gitlab CI/CD runners could manage. Even so, we have setup our own internal repo mirror.
- donmcronald 6y ago
  > Why aren't more licenses like this? I wonder this too. I started using drone.io for CI early this year and part of the reason was because of their no BS license where anyone making under $1 million could just use it. Unfortunately they got bought by Harness who's already slicing it into tiers [1] so it'll turn into the same feature roulette crap (like GitLab) that I was trying to avoid. If I had input on the business model of some of these companies I'd say that every effort should be made to give individuals and small developers a competitive advantage if they choose to use your product and a big part of that is getting rid of tiers for technical features. A really good example of how not to do it is GitLab IMO. Look at the way they reserve container scanning [2] for their top tier. Remind me why only large enterprises need security. The implementation of that feature isn't even good IMO. Scanning an image at build time is the wrong time to do it. It should be more like Harbor [3] where it's a scheduled scan by the registry and everyone should have access to it. The feature tiering could be done via the deployment, traceability, and monitoring of the containers. As a small developer I can do those things by hand because I know everything that's going on and what's currently deployed. I can track it in a spreadsheet if needed. Large developers need a way for (ex:) a director to log in and get a report for all the vulnerable images running in production. As is, it's a checkbox feature, so I can see why it makes sense to have it in an enterprise tier. At a certain level it's about checking the box and covering your ass, so if / how it works doesn't even matter at that point. As long as you can claim due diligence that's all that matters, right? I mean GitLab is making $0 from me right now, so why not just give away everything until a company has 5 developers or $1 million in revenue or something. Make it so appealing that it would be stupid for small developers to use anything besides GitLab because it would be impossible to compete in terms of productivity. As it is, I hate dealing with the feature tiers so much that I gave up and switched to Gitea with other self hosted solutions for CI, Registry, etc.. I want to spend my time writing code, not trying to figure out what features I can use with my current plan. 1. https://harness.io/pricing/ https://harness.io/pricing/ 2. https://docs.gitlab.com/ee/user/application_security/container_scanning/ https://docs.gitlab.com/ee/user/application_security/contain... 3. https://goharbor.io/docs/2.1.0/administration/vulnerability-scanning/schedule-scans/ https://goharbor.io/docs/2.1.0/administration/vulnerability-...
black_puppydog 6y ago
The problem (okay, "a" problem) here is that it is indeed OSS, and not FOSS, that is being used. It might be worth re-visiting "Post-Open Source" by Melody Horn (boringcactus) [1] on this. You might want to copy/paste that link instead of clicking. :) It has been discussed here before [2] and (unsurprisingly, IMHO) gotten quite a bit of blow-back from the HN crowd. The General Intellect Unit podcast recently had an episode on the piece [3] and I think they made the point clearer (well... also they roll the piece out to 1h 40min) by more openly posing it in a class struggle context. (Side note: please don't post replies attacking this as communist. The podcast has "marxists" in the name, you wouldn't be insulting them, and I'm merely engaging with their content, so if you're gonna try to attack their/my positions, please do the same and don't just throw scary words.) The bottom-line is that Open Source Software has nothing to do with the freedoms of the developers. It is... * a corporate entrenchment scheme: enlarging your hiring pool by establishing your in-house solution as the industry standard, giving you full hiring pipelines and stronger negotiation position against current and prospective employees. * a capitalist commons: by tending to one industry standard, the companies (not their devs, who will still have full work days) save on duplication of effort. At the same time FOSS (which does focus on the freedoms of the devs to read, modify, learn...) kind of misses the point by being... * too obvious a trap, and thus ineffective. No sane capitalist company will go anywhere near AGPL code (and we just had an example on HN of someone trying. it wasn't pretty) * ultimately not even clear on how this will make anyone's lives materially better, even if it were effective. It's not gonna raise your salary, nor give you more paid vacation, health insurance. As a dev, you'll still be producing surplus value (okay, in a hopefully less alienated way) that will then not be paid to you (that's the definition of profit) so from this perspective the "F" in FOSS doesn't really bring much to the table. The GIU podcast concludes that yeah, working in IT was nice for a while, because it posed some fundamental problems to capital and as a dev you were in a much better negotiation position. However, those times are over. Capital has found a way to make IT labour just as fungible as manual labor, at least to the extent that we should expect those "rock star" benefits to dwindle soon. Up to us to realize that and take action. Again: relaying analysis here. Not sure I buy all of it. But even if, please keep your replies centered on the content, not the vocabulary it's presented with. [1]: https://www.boringcactus.com/2020/08/13/post-open-source.html https://www.boringcactus.com/2020/08/13/post-open-source.htm... [2]: https://news.ycombinator.com/item?id=24397552 https://news.ycombinator.com/item?id=24397552 [3]: http://generalintellectunit.net/e/066-post-open-source/ http://generalintellectunit.net/e/066-post-open-source/
hebrox 6y ago
It was an interesting business decision to begin with, trying to build a company around a simple spec and an LXC wrapper.
hannob 6y ago
> This is how you get people to stop doing nice things like writing open software. I mean... it doesn't look like people show any sign of stopping to write open software. There's more active FOSS than ever before, in large parts of the industry it's the norm. I agree these are issues to talk about, though "OSS is in trouble" is a pretty weak argument. It's obviously not.
brown9-2 6y ago
Perhaps not all open source projects make for great businesses.
- travisjungroth 6y ago
  There’s certainly some threshold, but maybe past that you have to adjust your definition of “great”. I think the technology of Docker just doesn’t line up with a venture scale business. So it’s not an execution failure, but just wrong from the start. If they had been successful at a huge scale, I think it would have almost been a pivot level change and using Docker as a springboard. Like offering container hosting or something. I wonder how they would have done if they just stayed a 50 person company.
  - thu2111 6y ago
    Even 50 person seems like a lot. I think people tend to forget that there's a lot of room at the bottom. If you want to give your product away for free you need to accept that there'll be less revenue, unless you can pull off the neat trick of segmenting your market almost perfectly e.g. the only people who use the free version are people who wouldn't have paid you anyway and your marginal cost is zero. Could Docker as a developer tools business managed with 10-15 people? Quite possibly. Especially if it didn't try to become a generic VM on other platforms.
indymike 6y ago
Open source is a trade-off. In many cases, it's rocket fuel for early and mid-stage growth in exchange for reduced barriers to entry for competitors. It also points out a real weakness in infrastructure: why is provisioning, configuring and deploying code so difficult and expensive? Shouldn't we have OS level tools that make this trivial at this point? It's pretty amazing that we're taking patterns like load balancer + Shared Cache + Database + Libraries + App Code + config files and assets and making it so difficult to configure them and deploy them. Reducing deployment complexity is still a huge opportunity...
- donmcronald 6y ago
  > Reducing deployment complexity is still a huge opportunity... I agree with that. There's probably even room for another CI system that's highly opinionated and focused on building images. Most of the existing ones kind of suck at building images.
  - jonfw 6y ago
    We use Tekton where I work- which is really great in a K8s context.
    - devthane 6y ago
      Agreed, we use it as well, it’s shaping up nicely, though its a good bit more user complicated than other solutions. But hey, this is Kubernetes.
- xnx 6y ago
  Deploying apps is truly ridiculously complex. This is the problem I really see "no code" addressing. To me, writing the logic of an application is easy compared to the ridiculousness of publishing the code somewhere.
akerl_ 6y ago
I moved off of Docker Hub because of the number of unfixed bugs and lack of features. Builds sporadically failed for years, they took forever to add any kind of MFA at all. Docker also has been a business since day 1. They didn’t write open source software because it was a “nice thing”, they saw a market for an open source container solution. I’m thus not worried that using non-Docker-operated registries will impact the future prospects of open source.
013a 6y ago
> As consumers if we just keep taking the freest lunch without any care or love for the general OSS ecosystem there will be a ton of adverse effects. This is a pretty F’ed up way to do business. Open source doesn't care about the way you (/we) do business. I know its easy to get this defeatist view about OSS, like, "the linux desktop is losing the war" or "iOS is killing open computing" or whatever, but even if that were what was happening here (its not), open source persists. There is no war. Its just people writing code to help other people. In fifty years AWS, Apple, Google, whoever, might be dead, but code will still be here. In this specific case, here's how I view this situation. Docker provides an indispensable public service via Docker Hub. They have had six plus years to monetize it, but it turns out, monetizing public services is nearly impossible. AWS has the scale to step in and take over some of the load, and they already have a monetization strategy. Good on AWS for this; Docker couldn't handle it, so AWS will.
- jtdev 6y ago
  I agree, this is a good thing; market efficiencies simply cannot be stopped in a free market.
- jjoonathan 6y ago
  > Open source doesn't care about the way you (/we) do business. Open source doesn't write code. People write code. People who see their code get commercialized by competitors. They update their priors and next time they are in a position to choose whether or not to open source something, they do so keeping in mind what they have learned.
  - 013a 6y ago
    Are the Postgres developers mad that AWS makes money via RDS? Are the (unaffiliated) Linux developers mad that DigitalOcean makes money via a compute offering? Are the (unaffiliated) Kubernetes developers mad that Microsoft sells their product on Azure? Unaffiliated being a critical part there, because of course Microsoft, AWS, etc contribute back to these projects. But, many, many of the developers on these projects are unaffiliated, often working at smaller companies/consultancies with no affiliation to the megacorps that make billions on the software. Yet, I've not once noticed a single instance of aforementioned drama. What makes Docker, MongoDB, etc different? They're open source products developed and monetized by singular corporations, not communities or non-profit cross-functional organizations like The Linux Foundation. Its a big corporation slighting a smaller corporation. This may reveal a bias in online discourse, especially on HN; we revere corporations, not people. We want to protect venture-backed Docker, but the individual developers working on, say, Postgres? Less deserving. Peter Eisentraut, Bruce Momjian, and Dave Page are core maintainers of Postgres, all working at a company named EnterpriseDB, who sell managed Postgres offerings. Why doesn't anyone complain about AWS screwing over Postgres? Well, there's something bigger at play: Its actually, totally alright if megacorps use Linux, Postgres, whatever in this way. Developers enter these projects knowing it'll happen, and these projects are healthier than ever. That's a beautiful relationship right there! No drama. No one slighted. If these companies give open source back, that's great, but I don't expect them to (exempting GPL requirements of course), just like no one expects me to contribute every bit of code I write just because I coded it on Ubuntu using vim and linux and gnome and docker and such. With Docker (and similar corporations), someone is slighted; its the company that was also trying to make money on it. And I think that's just mismanaged expectations at every level; the company believing they could build an OSS community of users and builders while still extracting profit, the leaders for accepting venture capital, and the users believing a company could solely develop and distribute something as complex as core application containerization or a database. To be clear: I have a lot of respect for Docker continuing to run Hub for free as long as they did. They're an awesome company. No qualifications around that; I hope they find success in the market. I just don't believe that success will come at the scale and valuation they expect, because they aren't selling what customers want to pay for. AWS is.
iamsb 6y ago
Registry is not a really something that can be monetised easily. Java ecosystem has had plenty of open and free registries, such as mvnrepository, mvncentral, jcenter etc, for a while for example. In fact, I would argue that if they let go of their registry, then focus more efforts on possibly monetisable products/features. Even there k8s ecosystem is miles ahead of docker swarm.
- curryst 6y ago
  That's because they're generally extremely easy to replicate. "Repository" generally implies that all of the intelligence is baked into the client, and the server is just some minor variation on an FTP or HTTP server (as Linux repos tend to be, PyPI afaik is largely the same way, I don't think NPM does anything super clever server side). The flip side of that is something closer to a CDN, where clients are dumb and the server/network is smart. Those are monetizable because the servers have to be featureful, so you can win on features and charge money for those features. I struggle to think of any really great value add features for a repository. There's vulnerability scanning, but the successes with that seem largely meh, and there are dozens of competitors in that space already. I think they were hoping to ride on the "enterprise" crew, because no one gets fired for buying the canonical implementation. But then RedHat acquired Quay and that was basically the end of the end, since RedHat is enterprise and already has about a half dozen products in the ops space.
awinder 6y ago
The tale of Docker is the tale of a non-success business, and unfortunately in those stories, a lot of problems created a lot of bad fallout. So depending on the lens you come and view it through, you can find villains all over the place. IMO, one of the biggest problems was that the Docker moat was primarily about mindshare. The core tech popularized containers, but it was thin enough that there's now the OCI, many other competing container runtimes, and docker plays completely no role in many large container usage scenarios (large public cloud operators). Kubernetes and really a lot of other clustering solutions always seemed to outweigh docker swarm, which was unfortunate too because that was probably one of the better monetizable vectors for the company. If you compare all of this to a company like hashicorp, which in my opinion is just expertly run from the top, it's just a night-and-day tale. You can build great developer businesses, but you have to be careful, and probably still a little lucky. Docker had poor luck but I think they also had a lot of problems with not fully ideating the business of the product.
WhyNotHugo 6y ago
What else did you expect to happen? Honestly, as soon as they announced the new rate limits, it seemed obvious that this would happen: different platforms will implement workarounds. I'm sure the same would happen if npmjs or pypi started charging for using their package registry. There's lots of hobby programmer, or simply, companies from economies that can't afford to pay 5USD/month. For example, a friend of mine pays a total of $0.95 a month for his ecommerce needs.

deleted 6y ago

[deleted]

sneak 6y ago

> This is how you get people to stop doing nice things like writing open software. Docker stopped making open software before they limited the pulls. Docker Enterprise for Windows (Windows dockerd, basically), Docker Desktop for Mac, and Docker Desktop for Windows are all closed-source and proprietary. Docker-the-company hasn’t cared much for open source in a while.

nickstinemates 6y ago
Sad times
m463 6y ago
the thing that annoyed me was the telemetry in the mac installer before you even did an install. Additionally they made it hard to do a personal registries, which is what's going to happen now anyway. I think they tried to keep themselves in the loop too much, because it's valuable for business and monetizing was a long term goal. here's the thread I saw: https://stackoverflow.com/questions/33054369/how-to-change-the-default-docker-registry-from-docker-io-to-my-private-registry https://stackoverflow.com/questions/33054369/how-to-change-t... pointing to this: https://github.com/moby/moby/issues/7203 https://github.com/moby/moby/issues/7203 and also there was this comment: "It turns out this is actually possible, but not using the genuine Docker CE or EE version. You can either use Red Hat's fork of docker with the '--add-registry' flag or you can build docker from source yourself with registry/config.go modified to use your own hard-coded default registry namespace/index."
- sneak 6y ago
  Docker Desktop is terrible spyware. I managed to crash it a few times recently and intercepted the reports before they were sent off; it collects a ton of sensitive information about your computer in the crash report it sends, including pcap logs(!). I’ll never run code from them I didn’t build myself. That company is super shady now.
- djrobstep 6y ago
  What's the hard aspect of doing personal registries? I found it easy enough, although only set up something very basic.
  - curryst 6y ago
    It's not hard, it's just clunky. You have to put the full URL of your Docker registry every time you reference the image. There's no way to say "just always use this registry instead". I haven't found it terribly difficult to set up either, just annoying.
bdcravens 6y ago
I'm not sure they ever followed through completely, but that was part of the idea between Docker/moby
zapita 6y ago
Didn’t they just stop launching new OSS projects, and focused on maintaining what they already have launched? They’ve been criticized a lot over the years (correctly, I think) for lacking focus. Are we now criticizing them for narrowing down their focus?

BurritoAlPastor 6y ago

“Software might stop being free unless we start paying for it” has a certain circular irony.

parhamn 6y ago
Only if you squint at and reduce the actual matter enough so you can make a cute point.
- fiddlerwoaroof 6y ago
  Yeah, this is the ambiguity GNU/FSF people go on and on about. “Free” in the interesting sense means “available to modify and use as you like, as long as you don’t prevent other people from doing the same”
paulryanrogers 6y ago
It's not ironic if you consider the intent is that software paid for by other companies or volunteers may no longer be if huge companies take all the upside.

deanCommie 6y ago

Before Netflix and iTunes/Spotify, people were convinced that nobody would ever pay for movies and music on computers ever again. Turns out a product more convenient than piracy was worth people paying money for. Now there are 18 streaming services and piracy rates are climbing again. Ebbs and flows. Open source software is amazing but infrastructure development is a substantial part of any businesses development costs. AWS offers higher level abstractions - for a fee. In our industry people always take that option, until the cloud providers value proposition becomes no longer attractive, and open source innovation flourishes again. AWS makes really good stuff, there is value in that.

paulryanrogers 6y ago
AWS also takes good stuff, giving little or nothing back, and supplants solutions that fund the original. Hence the move to AGPL and similar licenses.

jen20 6y ago

> critical to a large majority of software teams. Do you have a reference for that?

steve_adams_86 6y ago
I personally haven’t worked on a software team not using containers in around 8 years. One place was kind of an exception - containerization was on the road map, but not in use in production yet. They’re everywhere. I’ve deployed 3 containerized services in the last 6 weeks - 2 using Go and 1 using Node. They’re kind of the default these days, especially when deploying to AWS/GC. I assume it must be similar to some degree for a lot of developers here.
renewiltord 6y ago
Out of curiosity, what sort of reference were you expecting? (I promise I didn't vote on your comment and I'm just curious)
- jen20 6y ago
  Some kind of white paper (even vendor supported) indicating that a majority, or even close to it, is using containers. As far as I can tell, the state of the art for enterprises, which still make up the bulk of software development, is ASP.NET and J2EE, deployed to bare metal or VMWare VMs. The hacker news bubble may be stronger than realised on this topic.
  - renewiltord 6y ago
    I see. Thank you.
bdcravens 6y ago
Pretty much 100% of the Docker tutorials and references out there tell you to pull core images (ie "FROM ruby" or "FROM ubuntu").

systemvoltage 6y ago

Docker should have just remained free for personal use and small companies, say less than 50 employees and charge a lot more for enterprises. Why aren't more licenses like this? What are the downsides? Traction? I am thinking how Adobe has made it easy to crack Photoshop so that students once they graduate demand Photoshop and Adobe Suite for their workflow. Docker should have been smarter.

viraptor 6y ago
If the containers caught on, someone would write a replacement. I mean podman exists. For the majority of use cases, you need only a tiny amount of docker's features.
INTPenis 6y ago
> Docker should have just remained free for personal use and small companies, say less than 50 employees and charge a lot more for enterprises. It sort of is, in a way. We have an on-prem k8s cluster that is small enough to fly under the 100pulls/6hrs limit. I believe even our Gitlab CI/CD runners could manage. Even so, we have setup our own internal repo mirror.
donmcronald 6y ago
> Why aren't more licenses like this? I wonder this too. I started using drone.io for CI early this year and part of the reason was because of their no BS license where anyone making under $1 million could just use it. Unfortunately they got bought by Harness who's already slicing it into tiers [1] so it'll turn into the same feature roulette crap (like GitLab) that I was trying to avoid. If I had input on the business model of some of these companies I'd say that every effort should be made to give individuals and small developers a competitive advantage if they choose to use your product and a big part of that is getting rid of tiers for technical features. A really good example of how not to do it is GitLab IMO. Look at the way they reserve container scanning [2] for their top tier. Remind me why only large enterprises need security. The implementation of that feature isn't even good IMO. Scanning an image at build time is the wrong time to do it. It should be more like Harbor [3] where it's a scheduled scan by the registry and everyone should have access to it. The feature tiering could be done via the deployment, traceability, and monitoring of the containers. As a small developer I can do those things by hand because I know everything that's going on and what's currently deployed. I can track it in a spreadsheet if needed. Large developers need a way for (ex:) a director to log in and get a report for all the vulnerable images running in production. As is, it's a checkbox feature, so I can see why it makes sense to have it in an enterprise tier. At a certain level it's about checking the box and covering your ass, so if / how it works doesn't even matter at that point. As long as you can claim due diligence that's all that matters, right? I mean GitLab is making $0 from me right now, so why not just give away everything until a company has 5 developers or $1 million in revenue or something. Make it so appealing that it would be stupid for small developers to use anything besides GitLab because it would be impossible to compete in terms of productivity. As it is, I hate dealing with the feature tiers so much that I gave up and switched to Gitea with other self hosted solutions for CI, Registry, etc.. I want to spend my time writing code, not trying to figure out what features I can use with my current plan. 1. https://harness.io/pricing/ https://harness.io/pricing/ 2. https://docs.gitlab.com/ee/user/application_security/container_scanning/ https://docs.gitlab.com/ee/user/application_security/contain... 3. https://goharbor.io/docs/2.1.0/administration/vulnerability-scanning/schedule-scans/ https://goharbor.io/docs/2.1.0/administration/vulnerability-...

black_puppydog 6y ago

The problem (okay, "a" problem) here is that it is indeed OSS, and not FOSS, that is being used. It might be worth re-visiting "Post-Open Source" by Melody Horn (boringcactus) [1] on this. You might want to copy/paste that link instead of clicking. :) It has been discussed here before [2] and (unsurprisingly, IMHO) gotten quite a bit of blow-back from the HN crowd. The General Intellect Unit podcast recently had an episode on the piece [3] and I think they made the point clearer (well... also they roll the piece out to 1h 40min) by more openly posing it in a class struggle context. (Side note: please don't post replies attacking this as communist. The podcast has "marxists" in the name, you wouldn't be insulting them, and I'm merely engaging with their content, so if you're gonna try to attack their/my positions, please do the same and don't just throw scary words.) The bottom-line is that Open Source Software has nothing to do with the freedoms of the developers. It is... * a corporate entrenchment scheme: enlarging your hiring pool by establishing your in-house solution as the industry standard, giving you full hiring pipelines and stronger negotiation position against current and prospective employees. * a capitalist commons: by tending to one industry standard, the companies (not their devs, who will still have full work days) save on duplication of effort. At the same time FOSS (which does focus on the freedoms of the devs to read, modify, learn...) kind of misses the point by being... * too obvious a trap, and thus ineffective. No sane capitalist company will go anywhere near AGPL code (and we just had an example on HN of someone trying. it wasn't pretty) * ultimately not even clear on how this will make anyone's lives materially better, even if it were effective. It's not gonna raise your salary, nor give you more paid vacation, health insurance. As a dev, you'll still be producing surplus value (okay, in a hopefully less alienated way) that will then not be paid to you (that's the definition of profit) so from this perspective the "F" in FOSS doesn't really bring much to the table. The GIU podcast concludes that yeah, working in IT was nice for a while, because it posed some fundamental problems to capital and as a dev you were in a much better negotiation position. However, those times are over. Capital has found a way to make IT labour just as fungible as manual labor, at least to the extent that we should expect those "rock star" benefits to dwindle soon. Up to us to realize that and take action. Again: relaying analysis here. Not sure I buy all of it. But even if, please keep your replies centered on the content, not the vocabulary it's presented with. [1]: https://www.boringcactus.com/2020/08/13/post-open-source.html https://www.boringcactus.com/2020/08/13/post-open-source.htm... [2]: https://news.ycombinator.com/item?id=24397552 https://news.ycombinator.com/item?id=24397552 [3]: http://generalintellectunit.net/e/066-post-open-source/ http://generalintellectunit.net/e/066-post-open-source/

hebrox 6y ago

It was an interesting business decision to begin with, trying to build a company around a simple spec and an LXC wrapper.

hannob 6y ago

> This is how you get people to stop doing nice things like writing open software. I mean... it doesn't look like people show any sign of stopping to write open software. There's more active FOSS than ever before, in large parts of the industry it's the norm. I agree these are issues to talk about, though "OSS is in trouble" is a pretty weak argument. It's obviously not.

brown9-2 6y ago

Perhaps not all open source projects make for great businesses.

travisjungroth 6y ago
There’s certainly some threshold, but maybe past that you have to adjust your definition of “great”. I think the technology of Docker just doesn’t line up with a venture scale business. So it’s not an execution failure, but just wrong from the start. If they had been successful at a huge scale, I think it would have almost been a pivot level change and using Docker as a springboard. Like offering container hosting or something. I wonder how they would have done if they just stayed a 50 person company.
- thu2111 6y ago
  Even 50 person seems like a lot. I think people tend to forget that there's a lot of room at the bottom. If you want to give your product away for free you need to accept that there'll be less revenue, unless you can pull off the neat trick of segmenting your market almost perfectly e.g. the only people who use the free version are people who wouldn't have paid you anyway and your marginal cost is zero. Could Docker as a developer tools business managed with 10-15 people? Quite possibly. Especially if it didn't try to become a generic VM on other platforms.

indymike 6y ago

Open source is a trade-off. In many cases, it's rocket fuel for early and mid-stage growth in exchange for reduced barriers to entry for competitors. It also points out a real weakness in infrastructure: why is provisioning, configuring and deploying code so difficult and expensive? Shouldn't we have OS level tools that make this trivial at this point? It's pretty amazing that we're taking patterns like load balancer + Shared Cache + Database + Libraries + App Code + config files and assets and making it so difficult to configure them and deploy them. Reducing deployment complexity is still a huge opportunity...

donmcronald 6y ago
> Reducing deployment complexity is still a huge opportunity... I agree with that. There's probably even room for another CI system that's highly opinionated and focused on building images. Most of the existing ones kind of suck at building images.
- jonfw 6y ago
  We use Tekton where I work- which is really great in a K8s context.
  - devthane 6y ago
    Agreed, we use it as well, it’s shaping up nicely, though its a good bit more user complicated than other solutions. But hey, this is Kubernetes.
xnx 6y ago
Deploying apps is truly ridiculously complex. This is the problem I really see "no code" addressing. To me, writing the logic of an application is easy compared to the ridiculousness of publishing the code somewhere.

akerl_ 6y ago

I moved off of Docker Hub because of the number of unfixed bugs and lack of features. Builds sporadically failed for years, they took forever to add any kind of MFA at all. Docker also has been a business since day 1. They didn’t write open source software because it was a “nice thing”, they saw a market for an open source container solution. I’m thus not worried that using non-Docker-operated registries will impact the future prospects of open source.

013a 6y ago

> As consumers if we just keep taking the freest lunch without any care or love for the general OSS ecosystem there will be a ton of adverse effects. This is a pretty F’ed up way to do business. Open source doesn't care about the way you (/we) do business. I know its easy to get this defeatist view about OSS, like, "the linux desktop is losing the war" or "iOS is killing open computing" or whatever, but even if that were what was happening here (its not), open source persists. There is no war. Its just people writing code to help other people. In fifty years AWS, Apple, Google, whoever, might be dead, but code will still be here. In this specific case, here's how I view this situation. Docker provides an indispensable public service via Docker Hub. They have had six plus years to monetize it, but it turns out, monetizing public services is nearly impossible. AWS has the scale to step in and take over some of the load, and they already have a monetization strategy. Good on AWS for this; Docker couldn't handle it, so AWS will.

jtdev 6y ago
I agree, this is a good thing; market efficiencies simply cannot be stopped in a free market.
jjoonathan 6y ago
> Open source doesn't care about the way you (/we) do business. Open source doesn't write code. People write code. People who see their code get commercialized by competitors. They update their priors and next time they are in a position to choose whether or not to open source something, they do so keeping in mind what they have learned.
- 013a 6y ago
  Are the Postgres developers mad that AWS makes money via RDS? Are the (unaffiliated) Linux developers mad that DigitalOcean makes money via a compute offering? Are the (unaffiliated) Kubernetes developers mad that Microsoft sells their product on Azure? Unaffiliated being a critical part there, because of course Microsoft, AWS, etc contribute back to these projects. But, many, many of the developers on these projects are unaffiliated, often working at smaller companies/consultancies with no affiliation to the megacorps that make billions on the software. Yet, I've not once noticed a single instance of aforementioned drama. What makes Docker, MongoDB, etc different? They're open source products developed and monetized by singular corporations, not communities or non-profit cross-functional organizations like The Linux Foundation. Its a big corporation slighting a smaller corporation. This may reveal a bias in online discourse, especially on HN; we revere corporations, not people. We want to protect venture-backed Docker, but the individual developers working on, say, Postgres? Less deserving. Peter Eisentraut, Bruce Momjian, and Dave Page are core maintainers of Postgres, all working at a company named EnterpriseDB, who sell managed Postgres offerings. Why doesn't anyone complain about AWS screwing over Postgres? Well, there's something bigger at play: Its actually, totally alright if megacorps use Linux, Postgres, whatever in this way. Developers enter these projects knowing it'll happen, and these projects are healthier than ever. That's a beautiful relationship right there! No drama. No one slighted. If these companies give open source back, that's great, but I don't expect them to (exempting GPL requirements of course), just like no one expects me to contribute every bit of code I write just because I coded it on Ubuntu using vim and linux and gnome and docker and such. With Docker (and similar corporations), someone is slighted; its the company that was also trying to make money on it. And I think that's just mismanaged expectations at every level; the company believing they could build an OSS community of users and builders while still extracting profit, the leaders for accepting venture capital, and the users believing a company could solely develop and distribute something as complex as core application containerization or a database. To be clear: I have a lot of respect for Docker continuing to run Hub for free as long as they did. They're an awesome company. No qualifications around that; I hope they find success in the market. I just don't believe that success will come at the scale and valuation they expect, because they aren't selling what customers want to pay for. AWS is.

iamsb 6y ago

Registry is not a really something that can be monetised easily. Java ecosystem has had plenty of open and free registries, such as mvnrepository, mvncentral, jcenter etc, for a while for example. In fact, I would argue that if they let go of their registry, then focus more efforts on possibly monetisable products/features. Even there k8s ecosystem is miles ahead of docker swarm.

curryst 6y ago
That's because they're generally extremely easy to replicate. "Repository" generally implies that all of the intelligence is baked into the client, and the server is just some minor variation on an FTP or HTTP server (as Linux repos tend to be, PyPI afaik is largely the same way, I don't think NPM does anything super clever server side). The flip side of that is something closer to a CDN, where clients are dumb and the server/network is smart. Those are monetizable because the servers have to be featureful, so you can win on features and charge money for those features. I struggle to think of any really great value add features for a repository. There's vulnerability scanning, but the successes with that seem largely meh, and there are dozens of competitors in that space already. I think they were hoping to ride on the "enterprise" crew, because no one gets fired for buying the canonical implementation. But then RedHat acquired Quay and that was basically the end of the end, since RedHat is enterprise and already has about a half dozen products in the ops space.

awinder 6y ago

The tale of Docker is the tale of a non-success business, and unfortunately in those stories, a lot of problems created a lot of bad fallout. So depending on the lens you come and view it through, you can find villains all over the place. IMO, one of the biggest problems was that the Docker moat was primarily about mindshare. The core tech popularized containers, but it was thin enough that there's now the OCI, many other competing container runtimes, and docker plays completely no role in many large container usage scenarios (large public cloud operators). Kubernetes and really a lot of other clustering solutions always seemed to outweigh docker swarm, which was unfortunate too because that was probably one of the better monetizable vectors for the company. If you compare all of this to a company like hashicorp, which in my opinion is just expertly run from the top, it's just a night-and-day tale. You can build great developer businesses, but you have to be careful, and probably still a little lucky. Docker had poor luck but I think they also had a lot of problems with not fully ideating the business of the product.

WhyNotHugo 6y ago

What else did you expect to happen? Honestly, as soon as they announced the new rate limits, it seemed obvious that this would happen: different platforms will implement workarounds. I'm sure the same would happen if npmjs or pypi started charging for using their package registry. There's lots of hobby programmer, or simply, companies from economies that can't afford to pay 5USD/month. For example, a friend of mine pays a total of $0.95 a month for his ecommerce needs.