19 ms·

Ignoring Docker updates is a paid feature now?

276 points by andreareina 6y ago

sneak 6y ago
Docker desktop, unlike the docker command line tool and dockerd server, is not free software, and isn't even source available. It also transmits a HUGE amount of sensitive data about your system to Docker without your consent, so it's spyware. I can't really recommend avoiding this software any higher than I do. If you work on any sort of private codebases or under NDA, this thing is a liability magnet. Install the free software command line tool via a package manager (not brew, that one is also spyware) and set DOCKER_HOST="ssh://root@remotehost.example.com" in your environment. Don't develop with nonfree software and tools.
- nickjj 6y ago
  > It also transmits a HUGE amount of sensitive data about your system to Docker without your consent, so it's spyware. [...] If you work on any sort of private codebases or under NDA, this thing is a liability magnet. Can you please share a full list of what gets transmit with and without having the "Send usage statistics" option enabled? I'm assuming you have this data available because the wording of your reply is so specific.
  - sneak 6y ago
    Crash it and look in $TMPDIR for a zip it uploads.
    - wildrhythms 6y ago
      The creation of a .zip file in $TMPDIR does not imply uploading.
      - sneak 6y ago
        You're right. The software uploading the zip is what plainly indicates uploading.
    - GordonS 6y ago
      It's been a long time since I had Docker Desktop crash on me (it seems to be very stable these days), but I was sure there was an optional "send crash report" button?
      - sneak 6y ago
        It sends spy data even when it doesn't crash, too.
    - yladiz 6y ago
      sneak, the commenter didn't ask how to reproduce it, they asked what it sends. What is in the zip file and what exactly does it upload when it crashes? Are you certain that it uploads the whole zip file upon a crash?
      - sneak 6y ago
        The commenter asked for free research, which I'm not about to reproduce for them (at a minimum it takes the time to format/reinstall a machine), so rather than not answer I told them precisely what they need to do to get the data they desire.
        nickjj 6y ago
        > The commenter asked for free research, which I'm not about to reproduce for them Not really. You specifically wrote that anyone using Docker Desktop is now liable for breaking NDAs and that a "HUGE" amount of sensitive data about your system is being sent to Docker without consent. I mean, I'm taking for granted here that you didn't wake up yesterday with intent to write those sentences without having ever done the research yourself at least once. You're the one making these claims. If you've done the research, why not just post it here so other folks can verify what you're saying? What I'm getting from your latest reply is you're trying to make it sound way worse than it is and are using a lack of information to guide folks into thinking the worst case scenario by filling in the gaps with their own interpretation of what you wrote. Transmitting a crash dump is much different than them sending sensitive data without your consent, especially considering you can turn the "send usage stats" option off which no longer sends crash dumps, and the dump itself is only sent on a crash. Also the help text under the option says that it sends crash dumps too. Your original reply made it seem like every time you run a container with a volume, the contents of your source code is sent to Docker because in a lot of people's minds that's a "HUGE" amount of sensitive data and ties into your "private code base" and NDA liability sentence before.
        sneak 6y ago
        > I'm taking for granted here that you didn't wake up yesterday with intent to write those sentences without having ever done the research yourself at least once. You're the one making these claims. If you've done the research, why not just post it here so other folks can verify what you're saying? I have provided specific instructions for verifying precisely what I'm saying. I'm not going to spend hours reproducing this simply because I'm being cross-examined in a comment. It is immaterial to me if you believe my reports of the truth or not.
- jfk13 6y ago
  > Don't develop with nonfree software and tools. Don't try to dictate to others how they should work, as though you're some kind of oracle on the topic. I'll decide (together with my employer, when appropriate) what software and tools to use, based on a range of factors. Free-ness may be one of those factors, but it doesn't get to unconditionally veto everything else.
  - cmeacham98 6y ago
    It's just a strong recommendation, GP isn't pretending to have authority over HN commenters. This type of 'command as suggestion' construct is pretty common in modern english.
    - deleted 6y ago
      [deleted]
    - sneak 6y ago
      No, it's not a suggestion, it's definitely a command. Don't use nonfree tools, or you'll become a sharecropper ripe for abuse, such as the complete and utter "it's our computer now, fucko, even though you paid for it" nonsense demonstrated in TFA. Free software can't behave like this because the moment it tries we'll simply patch it out. See also: vscodium, ungoogled chromium.
      - ratww 6y ago
        > vscodium Wow, I had no idea this existed. Thanks for mentioning it. I block the telemetry with settings and with Little Snitch, but this is what I needed from the beginning.
        vikbytes 6y ago
        Just as a warning, if you use vscodium you will not be able to use some extensions, including Remote-SSH.
        6y ago
- thwave 6y ago
  > not brew, that one is also spyware how is brew spyware?
  - sneak 6y ago
    It transmits your on-device activity to Google without consent. It includes a unique tracking identifier generated on install that never changes, like a supercookie. Every time you run brew, it transmits this to Google, which allows Google to assemble a city-level tracklog of your device based on client IP geolocation, along with a list of all the packages you have installed, and when. It does this silently, and without obtaining any sort of consent, which is why most people are unaware that homebrew is spying on them.
    - sofixa 6y ago
      Why to Google?
      - sneak 6y ago
        You'd have to ask the homebrew developers that. Every time I've ever seen anyone question their decision to embed Google spyware in their product, however, the GitHub issues are closed and locked, so I don't know if you'll have very good luck. I stopped trying to convince them to behave ethically and simply use nixpkgs now instead (which incidentally in my experience works better) and do my best to inform people about the facts so they can make their own decisions (something I wish homebrew would do, instead of deciding for them to use their computer to spy).
        deleted 6y ago
        [deleted]
      - ratww 6y ago
        It uses Google Analytics.
        6y ago
- driverdan 6y ago
  I opened this ticket 3.5 years ago and they still violate GDPR https://github.com/docker/for-mac/issues/2122 https://github.com/docker/for-mac/issues/2122
malka 6y ago
docker desktop is a burning pile of crap. I would not touch this with a 10 ft pole.
- Phil-bitplex 6y ago
  What is a alternative we can use? My team and I often use Docker images as part of our development process on our desktop machines.
  - langitbiru 6y ago
    Podman? https://podman.io/ https://podman.io/
    - rad_gruchalski 6y ago
      On Linux, sure.
      - yrro 6y ago
        Or in WSL!
  - starbugs 6y ago
    You can use docker-machine instead.
    - rzzzt 6y ago
      The Docker Toolbox repo is still hanging around, although in archived form: https://github.com/docker/toolbox https://github.com/docker/toolbox With 19.03 it should still be possible to access the public hub, I think.
  - the8472 6y ago
    just plain docker in a linux vm? wsl2 if the host is windows.
  - 6y ago
villgax 6y ago
This should be the first example in an anti-patterns/dark patterns book.
NewLogic 6y ago
Wow docker company has so little goodwill left to erode. Truly rock bottom.
- sn_master 6y ago
  Yup, they had one magic trick and stopped innovating since. A lot of their stuff feels very archaic now and they're refusing to change it.
Tommek 6y ago
Using a glorified chroot on desktop PCs needed some punishment. Great that they figured it out :D
CGamesPlay 6y ago
So, this is a terrible UI for the feature, but there is an X button which hides the dialog. Apparently it used to be called "snooze", from this blog post [0]. All in all, it's really gross that they put an "upgrade to not update" logo on the button, but the actual behavior and the underlying reasons for it make sense. Supporting older versions is hard, if you are going to indefinitely ban a version, it's going to increase the burden of support on Docker, so they make it a pro feature. [0] https://www.docker.com/blog/changing-how-updates-work-with-docker-desktop-3-3/ https://www.docker.com/blog/changing-how-updates-work-with-d...
- ratww 6y ago
  No, it's just a hostile and desperate move. It's a desktop app. There's absolutely no obligation for them to support anything. Server side, they can just deprecate APIs, and whatever chat/forum support they have can refuse to support outdated versions. They can even charge for it! This is how most companies go about it. This is nothing more than desperation and lack of ideas on how to generate money, which is very unfortunate. A more honest route would be just to charge for the app, charge for premium support, or come up with new Pro features by collaborating with the existing user base. This here is just lazy.
  - alpaca128 6y ago
    Or they could have done the same as many paid programs: charge money for updates. Instead they choose to do the opposite, which makes one wonder how they came to the conclusion that not updating is more desirable for their users.
    - aniforprez 6y ago
      Considering how updates randomly break things and wreck volumes and images my only assumption is that this is ransomware similar to how Windows updates operates
    - ketzu 6y ago
      Paying to not update is usually called "extended support." I belive it's not that rare and I think in enterprise even more common than in consumer software. The reason, I believe, is that upgrading creates cost for the user, while maintaining older versions creates cost for the maintainers.
magoon 6y ago
Having been blocked on a customer’s locked-down Windows machine where the security software breaks the update process, this isn’t a welcome change.
tyingq 6y ago
Docker the company seems to be in a pretty tough place. Docker desktop and their hub are the only revenue streams they have. That's after ~$300M of investments.
bradleyjg 6y ago
People asked for the feature. The company gave a reasonable explanation of why they didn’t want to do it—-that it would increase the burden on them. As a very reasonable compromise they coded up the feature and are offering it to actual customers. That way they can offset the extra burden with money, again from actual customers. Nothing about this is unreasonable except the massively entitled whining. This should be cross posted to r/BeggingChoosers.
- sarsway 6y ago
  Sure it's in their right to do, and we can't expect to get everything for free, but making "skip update" a paid feature? How tasteless is that, do we really want to defend that? You see that button as a free user and its a bit of a slap in the face, isn't it. It doesn't make me want to pay, it makes me think the company is completely out of touch. I'd rather uninstall and look for alternatives, then pay for skip updates.
  - bradleyjg 6y ago
    > it makes me think the company is completely out of touch As interest rates come up off the zero bound companies are increasingly going to have to learn how to make profits again. The culture this is out of touch with is not long for this world.
- ratww 6y ago
  This is not a feature, though, especially not a new one. This is just asking for payment for the software to not do something to your machine. This kind of behaviour so far was only present in ransomware. All the code required for this to work was already there. They only spent developer time changing it to only be available to Pro users. You can rationalise this all you want, but this is just hostile, desperate and lazy behaviour from a company that's too desperate to make money, but is has continuously proven to be unable to come up with better ideas for attracting paid users. As others have mentioned, they got millions in funding so far but still have no idea how to make money. Had it been announced a month earlier people would be sure it was an April Fool's joke.
sn_master 6y ago
Am I the only one who seen the pattern of using one Docker on one VM? i.e whole VM does nothing except run one Docker, or multiple Dockers but all part of the same app and running as a single unit, not distinct ones. I talked to a few friends and at least one of them told me they've seen the same pattern used in their company too.
- throwaway4good 6y ago
  There are many many silly uses of docker and k8s out there. But people seem to like it ...
  - sn_master 6y ago
    Yup, I feel they try to justify themselves and feel they've done something complicated that takes time to understand by newcomers, when in reality the whole thing could be a single Go or C# binary and the entire utilized cluster power is less than a single mid-sized VM that could just run said single binary, without any external dependencies that usually get used to justify Docker. If people paying the money knew the amount of waste being done...
- nrmitchi 6y ago
  I've seen it, and I've also seen it in Kubernetes. It's obviously not the intended use case, but it can have the advantage of plugging in much nicer with your existing tooling. As an example, if I have a Kubernetes cluster, and a new app that needs a full VM. My options are to containerize it (it likely already comes this way), and let Kubernetes scheduled it on it's own VM, or use a different tool in order to manage the unique VM for this app. Unless there are reasons to avoid the containerize approach, I'm going to stick with the existing tooling rather than add additional complexity.
  - sn_master 6y ago
    > and a new app that needs a full VM. Most cases I've seen the apps don't need more than a two dozen megabytes out of the gigabytes in the VM. It was crazy seeing how much resources were being wasted for no good reason.
asien 6y ago
Not surprising honestly , docker has had more 300M of investment and still has no decent stream of revenue to pay their 300+ employees of SV. The entire industry knows it , the Docker devtools brought containers to the mass but anything beyond that is being taken by Cloud Vendors / Redhat etc... The Open Container Initiative contributed massively to make Docker the standard for container but also for other initiatives to replace it.... I personally believe it will also be its death sentence, seeing how many competitions are coming to get a better / simpler container tool chains add to that a lack of leadership after the founder left with a big check from the fundraising it’s just a matter of time before Docker goes bankrupt.
- tyingq 6y ago
  I believe WSL2 and Apple's virtualization framework may eventually kill Docker desktop. Both provide enough underpinnings for an open source solution to match the "ease of use" thing that makes Docker Desktop popular. That leaves Docker Hub as their last revenue stream.
  - indymike 6y ago
    Util I can deploy an _____ (cool, new thing) image on pretty much anything Docker isn't going anywhere.
    - tyingq 6y ago
      Not "docker" in general...Docker desktop. Docker the company makes nothing on the command line docker tool.
  - sleepybrett 6y ago
    podman.
- raverbashing 6y ago
  Yeah, true. Docker is basically at its core a shell around cgroups/chroots and filesystems. An overengineered shell and a confusing cmdline (which got better to be fair) There's no "technology" there per se (on Docker "core"). Docker containers and Dockerfiles maybe? Which got eaten by other orchestration technologies there?
DoctorNick 6y ago
It's amusing to see all the little indicators that Docker is desperate for cashflow. At this rate, they're going to end up like Travis.
- cutemonster 6y ago
  What happened to Travis?
  - DoctorNick 6y ago
    Chased off all their users by reigning in all their free tiers until it became commercial-only.
tediousdemise 6y ago
Podman[0][1] is an alternative daemonless containerization software. In my line of work, Docker poses too many security risks and Podman is the approved alternative. Podman supports Docker images, Dockerfiles, and Docker-compatible CLI interfaces. Simply use alias docker=podman and you’ll never know the difference. [0] https://podman.io/ https://podman.io/ [1] https://github.com/containers/podman https://github.com/containers/podman
- atat7024 6y ago
  First thing I thought, who would skip over Podman?
  - vocram 6y ago
    - For some Linux distro the setup is not as easy as with Docker - Someone relying on Docker only features like Docker compose
    - tediousdemise 6y ago
      See Podman-compose: https://github.com/containers/podman-compose https://github.com/containers/podman-compose
      - fignews 6y ago
        So podman-compose is really not where it’s at. This is coming from a long time ex-user. It’s a simple project with 117 open issues and 37 pull requests going back to 2019 (very few/no comments). There are many missing features and incompatibilities. I’m an ex-user because as of podman v2.2 there’s support to emulate the Docker socket which allows one to use Docker-compose.
- vocram 6y ago
  (Pedantic) you probably meant (OCI) container images, not docker images.
asdz 6y ago
They need more free beta tester to ensure their prod build. With 200k crash logs, they can analyze what break their new updates.
rcarmo 6y ago
Well, good thing I use VS Code to build Docker containers on other machines then…
desertraven 6y ago
Many comments seem to be critiquing Docker’s monetisation strategy. If this is accurate, why don’t they just ask users what they would pay for? I’m sure customers understand that things need to be financially sustainable, so why not just ask the userbase their vision of a monetised Docker?
- cutemonster 6y ago
  Maybe could even be an HN topic of its own
lmeyerov 6y ago
I wonder if this was good intentions by some developers getting subverted by an unaligned leadership ethos? (panicked? too $ focused? not enough user advocacy? no idea!) I can easily imagine a few meetings that went something like this: 1. Security engineer meetings: "Flipping to default-on for automatic updates has been a major win for ~billions of people to help them mitigate the steady stream of 0-days exploiting gnarly web browser internals. Docker adoption isn't at that level but still big, and the individuals are pretty important. We should try it for our community too!" 2. Sales & CEO: "A ha, amazing! We can turn this into a $ win too. We've been needing more $ and conversion triggers for our install base now that we sold the enterprise business. Anyone with docker desktop on for > 2w is effectively a qualified leading with this, and this might finally tip them over to paid! $5/mo is nothing and this is just annoying enough that it might do it! (And if a developer won't pay for that, they're a freeloader / 1% / ... who'd never pay anyways...)" 3. PMs + designers + marketing + other user advocates responsible for trialing & trust: "Wait a minute! For their core workflows, developers need to easily control the versions of their tools in their environment. Messing with that willy-nilly for system version #'s breaks brand trust for our paid conversions!" 4. Sales & CEO: "Maybe. Let's try it and see. Overruled in the name of business experiments, and we can reverse course if it's too damaging!"
- t0mas88 6y ago
  That's the majority Hacker News kind of opinion "Sales or the CEO fucked it up for the engineers" but another likely explanation is that the main source of frustration (forced updates for everyone) came from the engineering side because most developers hate maintaining older versions. Then someone said "you can't do that to enterprise customers, they demand to pick their own versions" which resulted in this button for the paid version.
  - lmeyerov 6y ago
    I'm agreeing with you here for the first part: that's another great well-meaning dev explanation. The ball-dropping is sales/product/leadership not being aligned on user advocacy. "Our velocity & sales > breaking user environments" means either the former is overly prioritized, or the people making decisions are too far from users (developers) to understand their daily needs. Managing docker versions for dev/prod drift isn't "1% of devs 99% of the time" but "99% of devs 1% of the time", so it's a real miss. In an alternate org where the user advocates lead might look more like: * <reject early on the current feature plan proposal as user hostile and instead...> * free: default to auto-update (or not) * free: flip * pay ("Pro"): one-click to switch to another version, both forwards & backwards * pay ("Enterprise"): centrally managed update schedule, version tracking, audit logs, etc. for all devs in your org Folks there are some of the best, so I'm sure most of this was considered, and thus it's an org/process problem
jameshart 6y ago
Worrying in this thread how few people seem to realize that docker desktop is not a) just another word for ‘docker’ or b) just an app frontend for running docker’s daemon in the background. People seem to forget: Docker is a Linux-only technology. If you’re running a non-Linux desktop OS like MacOS or Windows you need access to a Linux system to run docker. So docker desktop on MacOS runs a Linux VM for you under the hyperkit hypervisor hosting a Linux OS running containerd. On windows the equivalent involves managing a dockerd running inside WSL. So since we are talking here about an app that embeds an entire Linux OS image, the patching surface area is going to be considerable - it’s not just got to be updated whenever docker releases a new version. It’s actually a minimal Linux distribution. This also means people suggesting ‘alternatives’ to using docker are missing the entire value that docker desktop brings to MacOS and Windows users.
- dgan 6y ago
  Thank you, I never heard about Docker Desktop, and was confused what all the fuss is about in the comments
- ccmcarey 6y ago
  > People seem to forget: Docker is a Linux-only technology As I understand it, this is not true - you _can_ run Windows containers. https://hub.docker.com/_/microsoft-windows https://hub.docker.com/_/microsoft-windows
  - jameshart 6y ago
    That’s... a little bit of a stretch of what it means to be a ‘docker’ container. It’s more a ‘Windows container services’ image, which requires a host Windows OS to run... But yes, this further gets to the confusion about what ‘docker’ is vs ‘docker desktop’. Docker desktop for MacOS is certainly not going to just magically make it so you can run “docker run -it microsoft-windows” to get a CMD prompt on your MacBook though (but with a Windows VM and the right environment variables set, maybe?)
deorder 6y ago
What would anyone here recommend for local development (mostly on Linux) if I already have several production Kubernetes clusters? Podman or just running a local Kubernetes with Kind or Minikube for example? At the moment I use Docker compose.
rbjorklin 6y ago
I’m not on Windows/Mac so I can’t check this myself but couldn’t you just add a record to /etc/hosts for: 0.0.0.0 updates.docker.com Or something similar?
rubyn00bie 6y ago
This would be fine if Docker wasn't literally force-fed to me over the past six years. It would be fine if their updates didn't totally fuck up my development environment, or completely break it from time to time... it'd be okay if on MacOS you weren't forced into using the desktop application. shrug In the end I don't particularly care, I still run things like a caveman using processes, systemd units, disk images, and plan for my resource usage. I just find it mighty frustrating and think its short-sighted. Anyone who gets burned by a Desktop update (which they will, this happened to me within this last two months) isn't going to think "oh if only I paid them! Duh! Silly me." Instead it's going to seem like extortion... "Oh no! We broke your development environment! Whoopsie! If you upgrade to pro you can revert and continue working immediately!" Docker was originally "magical" and each year it becomes increasingly less "magical" I can only hope it is worth it.
- frenchman99 6y ago
  I'd probably pay if this is an issue for me, just like I pay for other stuff that has popups for as long as you don't pay (Sublime Text, Little Snitch, etc). You're only getting Docker for free because you help them by upgrading automatically. In fact, it's pretty cool that the only requirement is to stay up to date. Some companies make you pay to get upgrades, which is less secure in a way.
  - marcosnils 6y ago
    ^ 1000% this. One of the very few open minded answers I've seen so far. Of course people will complain, specially in HN. Even though I agree Docker's communication and execution wasn't the best, I applaud them since they're trying to monetize their work in a different strategy than the standard "support plan". In the end, I really hope this ends up working for them since it'll ultimately be reflected in the quality of the product. If you ever launch a Linux version I'll be happily be a paying customer.
  - guitarbill 6y ago
    If someone is using Docker professionally, maybe not a issue. I don't mind paying for software, and it could probably be expensed - although I am sure there's some cases where it isn't true or is more complicated. No, what's galling about this is that Docker is used so widely. What about open source projects using Docker? Now you have to apply for an "Open Source Plan"? Great. How does that even work with contributors if they just want to install Docker to check out the project? If a project I was working on depended on Docker, I'm not sure if I'd rather spend time figuring out how to ditch Docker vs fill out their application.
superkuh 6y ago
This is the image (and text) in the twitter post for anyone that cannot see it due to javascript: https://pbs.twimg.com/media/E0VAF-cXEAI5qqC?format=jpg https://pbs.twimg.com/media/E0VAF-cXEAI5qqC?format=jpg "Update ready to install" "Docker Desktop Version 3.3.1 (63152) - April 15 2021" "See what's new" "[Skip this update (pro)] [Install & Restart]"
lvs 6y ago
Update authoritarianism is on the march. Please stop.
yread 6y ago
Of course this is terrible but I would love to charge my laggard customers who delay major upgrades
lrvick 6y ago
I'll note that Docker only does this on the virtual machine infrastructure wrapper needed to run a minimal Linux VM to run Docker on non native platforms. If you run Docker on Linux, which it was designed for, it is totally open source and free. If you are on a Mac it is assumed you like paying for GUIs on top of things that are otherwise free. That checks out.
btdmaster 6y ago
I find plain Linux namespaces as sufficient for many things, for example: unshare --map-root-user chroot ~/rootfs /bin/sh Sure, it might not be able to clone the rootfs for you, but you don't need snapd to install it and it comes as part of util-linux, essentially being part of almost all Linux systems. (https://ilearnedhowto.wordpress.com/tag/unshare/ https://ilearnedhowto.wordpress.com/tag/unshare/ is a nice introduction.) Edit: https://ericchiang.github.io/post/containers-from-scratch/ https://ericchiang.github.io/post/containers-from-scratch/ is also interesting.
hda111 6y ago
I hope someone will make a Podman Desktop installer. On mac it would setup a small VM and Podman remote CLI on the Mac. On Windows it would setup a small WSL2 distro. The problem with Podman is that it currently has a lot of bugs when not running on Fedora/RHEL or similar. And there is no free fedora distro available for WSL that I’m aware of.
smashed 6y ago
Shout out to the docker.io debian/Ubuntu package maintainers, which is what I use on all systems I manage. After being burnt badly by the "official" docker auto-updates breaking stuff a few times, I've had enough and seeked a better solution. Turns out it was already there, no 3rd party package repos required. Linux distros package managers go to very great length not to break users' work environments. They keep things working, secure and stable, and I am very grateful for it.
voceboy521 6y ago
man, i wish Windows added this as a features, even if it's paid.

276 points by andreareina 6y ago

Docker desktop, unlike the docker command line tool and dockerd server, is not free software, and isn't even source available. It also transmits a HUGE amount of sensitive data about your system to Docker without your consent, so it's spyware. I can't really recommend avoiding this software any higher than I do. If you work on any sort of private codebases or under NDA, this thing is a liability magnet. Install the free software command line tool via a package manager (not brew, that one is also spyware) and set DOCKER_HOST="ssh://root@remotehost.example.com" in your environment. Don't develop with nonfree software and tools.

nickjj 6y ago
> It also transmits a HUGE amount of sensitive data about your system to Docker without your consent, so it's spyware. [...] If you work on any sort of private codebases or under NDA, this thing is a liability magnet. Can you please share a full list of what gets transmit with and without having the "Send usage statistics" option enabled? I'm assuming you have this data available because the wording of your reply is so specific.
- sneak 6y ago
  Crash it and look in $TMPDIR for a zip it uploads.
  - wildrhythms 6y ago
    The creation of a .zip file in $TMPDIR does not imply uploading.
    - sneak 6y ago
      You're right. The software uploading the zip is what plainly indicates uploading.
  - GordonS 6y ago
    It's been a long time since I had Docker Desktop crash on me (it seems to be very stable these days), but I was sure there was an optional "send crash report" button?
    - sneak 6y ago
      It sends spy data even when it doesn't crash, too.
  - yladiz 6y ago
    sneak, the commenter didn't ask how to reproduce it, they asked what it sends. What is in the zip file and what exactly does it upload when it crashes? Are you certain that it uploads the whole zip file upon a crash?
    - sneak 6y ago
      The commenter asked for free research, which I'm not about to reproduce for them (at a minimum it takes the time to format/reinstall a machine), so rather than not answer I told them precisely what they need to do to get the data they desire.
      - nickjj 6y ago
        > The commenter asked for free research, which I'm not about to reproduce for them Not really. You specifically wrote that anyone using Docker Desktop is now liable for breaking NDAs and that a "HUGE" amount of sensitive data about your system is being sent to Docker without consent. I mean, I'm taking for granted here that you didn't wake up yesterday with intent to write those sentences without having ever done the research yourself at least once. You're the one making these claims. If you've done the research, why not just post it here so other folks can verify what you're saying? What I'm getting from your latest reply is you're trying to make it sound way worse than it is and are using a lack of information to guide folks into thinking the worst case scenario by filling in the gaps with their own interpretation of what you wrote. Transmitting a crash dump is much different than them sending sensitive data without your consent, especially considering you can turn the "send usage stats" option off which no longer sends crash dumps, and the dump itself is only sent on a crash. Also the help text under the option says that it sends crash dumps too. Your original reply made it seem like every time you run a container with a volume, the contents of your source code is sent to Docker because in a lot of people's minds that's a "HUGE" amount of sensitive data and ties into your "private code base" and NDA liability sentence before.
        sneak 6y ago
        > I'm taking for granted here that you didn't wake up yesterday with intent to write those sentences without having ever done the research yourself at least once. You're the one making these claims. If you've done the research, why not just post it here so other folks can verify what you're saying? I have provided specific instructions for verifying precisely what I'm saying. I'm not going to spend hours reproducing this simply because I'm being cross-examined in a comment. It is immaterial to me if you believe my reports of the truth or not.
jfk13 6y ago
> Don't develop with nonfree software and tools. Don't try to dictate to others how they should work, as though you're some kind of oracle on the topic. I'll decide (together with my employer, when appropriate) what software and tools to use, based on a range of factors. Free-ness may be one of those factors, but it doesn't get to unconditionally veto everything else.
- cmeacham98 6y ago
  It's just a strong recommendation, GP isn't pretending to have authority over HN commenters. This type of 'command as suggestion' construct is pretty common in modern english.
  - deleted 6y ago
    [deleted]
  - sneak 6y ago
    No, it's not a suggestion, it's definitely a command. Don't use nonfree tools, or you'll become a sharecropper ripe for abuse, such as the complete and utter "it's our computer now, fucko, even though you paid for it" nonsense demonstrated in TFA. Free software can't behave like this because the moment it tries we'll simply patch it out. See also: vscodium, ungoogled chromium.
    - ratww 6y ago
      > vscodium Wow, I had no idea this existed. Thanks for mentioning it. I block the telemetry with settings and with Little Snitch, but this is what I needed from the beginning.
      - vikbytes 6y ago
        Just as a warning, if you use vscodium you will not be able to use some extensions, including Remote-SSH.
        6y ago
thwave 6y ago
> not brew, that one is also spyware how is brew spyware?
- sneak 6y ago
  It transmits your on-device activity to Google without consent. It includes a unique tracking identifier generated on install that never changes, like a supercookie. Every time you run brew, it transmits this to Google, which allows Google to assemble a city-level tracklog of your device based on client IP geolocation, along with a list of all the packages you have installed, and when. It does this silently, and without obtaining any sort of consent, which is why most people are unaware that homebrew is spying on them.
  - sofixa 6y ago
    Why to Google?
    - sneak 6y ago
      You'd have to ask the homebrew developers that. Every time I've ever seen anyone question their decision to embed Google spyware in their product, however, the GitHub issues are closed and locked, so I don't know if you'll have very good luck. I stopped trying to convince them to behave ethically and simply use nixpkgs now instead (which incidentally in my experience works better) and do my best to inform people about the facts so they can make their own decisions (something I wish homebrew would do, instead of deciding for them to use their computer to spy).
      - deleted 6y ago
        [deleted]
    - ratww 6y ago
      It uses Google Analytics.
      - 6y ago
driverdan 6y ago
I opened this ticket 3.5 years ago and they still violate GDPR https://github.com/docker/for-mac/issues/2122 https://github.com/docker/for-mac/issues/2122

malka 6y ago

docker desktop is a burning pile of crap. I would not touch this with a 10 ft pole.

Phil-bitplex 6y ago
What is a alternative we can use? My team and I often use Docker images as part of our development process on our desktop machines.
- langitbiru 6y ago
  Podman? https://podman.io/ https://podman.io/
  - rad_gruchalski 6y ago
    On Linux, sure.
    - yrro 6y ago
      Or in WSL!
- starbugs 6y ago
  You can use docker-machine instead.
  - rzzzt 6y ago
    The Docker Toolbox repo is still hanging around, although in archived form: https://github.com/docker/toolbox https://github.com/docker/toolbox With 19.03 it should still be possible to access the public hub, I think.
- the8472 6y ago
  just plain docker in a linux vm? wsl2 if the host is windows.
- 6y ago

villgax 6y ago

This should be the first example in an anti-patterns/dark patterns book.

NewLogic 6y ago

Wow docker company has so little goodwill left to erode. Truly rock bottom.

sn_master 6y ago
Yup, they had one magic trick and stopped innovating since. A lot of their stuff feels very archaic now and they're refusing to change it.

Tommek 6y ago

Using a glorified chroot on desktop PCs needed some punishment. Great that they figured it out :D

CGamesPlay 6y ago

So, this is a terrible UI for the feature, but there is an X button which hides the dialog. Apparently it used to be called "snooze", from this blog post [0]. All in all, it's really gross that they put an "upgrade to not update" logo on the button, but the actual behavior and the underlying reasons for it make sense. Supporting older versions is hard, if you are going to indefinitely ban a version, it's going to increase the burden of support on Docker, so they make it a pro feature. [0] https://www.docker.com/blog/changing-how-updates-work-with-docker-desktop-3-3/ https://www.docker.com/blog/changing-how-updates-work-with-d...

ratww 6y ago
No, it's just a hostile and desperate move. It's a desktop app. There's absolutely no obligation for them to support anything. Server side, they can just deprecate APIs, and whatever chat/forum support they have can refuse to support outdated versions. They can even charge for it! This is how most companies go about it. This is nothing more than desperation and lack of ideas on how to generate money, which is very unfortunate. A more honest route would be just to charge for the app, charge for premium support, or come up with new Pro features by collaborating with the existing user base. This here is just lazy.
- alpaca128 6y ago
  Or they could have done the same as many paid programs: charge money for updates. Instead they choose to do the opposite, which makes one wonder how they came to the conclusion that not updating is more desirable for their users.
  - aniforprez 6y ago
    Considering how updates randomly break things and wreck volumes and images my only assumption is that this is ransomware similar to how Windows updates operates
  - ketzu 6y ago
    Paying to not update is usually called "extended support." I belive it's not that rare and I think in enterprise even more common than in consumer software. The reason, I believe, is that upgrading creates cost for the user, while maintaining older versions creates cost for the maintainers.

magoon 6y ago

Having been blocked on a customer’s locked-down Windows machine where the security software breaks the update process, this isn’t a welcome change.

tyingq 6y ago

Docker the company seems to be in a pretty tough place. Docker desktop and their hub are the only revenue streams they have. That's after ~$300M of investments.

bradleyjg 6y ago

People asked for the feature. The company gave a reasonable explanation of why they didn’t want to do it—-that it would increase the burden on them. As a very reasonable compromise they coded up the feature and are offering it to actual customers. That way they can offset the extra burden with money, again from actual customers. Nothing about this is unreasonable except the massively entitled whining. This should be cross posted to r/BeggingChoosers.

sarsway 6y ago
Sure it's in their right to do, and we can't expect to get everything for free, but making "skip update" a paid feature? How tasteless is that, do we really want to defend that? You see that button as a free user and its a bit of a slap in the face, isn't it. It doesn't make me want to pay, it makes me think the company is completely out of touch. I'd rather uninstall and look for alternatives, then pay for skip updates.
- bradleyjg 6y ago
  > it makes me think the company is completely out of touch As interest rates come up off the zero bound companies are increasingly going to have to learn how to make profits again. The culture this is out of touch with is not long for this world.
ratww 6y ago
This is not a feature, though, especially not a new one. This is just asking for payment for the software to not do something to your machine. This kind of behaviour so far was only present in ransomware. All the code required for this to work was already there. They only spent developer time changing it to only be available to Pro users. You can rationalise this all you want, but this is just hostile, desperate and lazy behaviour from a company that's too desperate to make money, but is has continuously proven to be unable to come up with better ideas for attracting paid users. As others have mentioned, they got millions in funding so far but still have no idea how to make money. Had it been announced a month earlier people would be sure it was an April Fool's joke.

sn_master 6y ago

Am I the only one who seen the pattern of using one Docker on one VM? i.e whole VM does nothing except run one Docker, or multiple Dockers but all part of the same app and running as a single unit, not distinct ones. I talked to a few friends and at least one of them told me they've seen the same pattern used in their company too.

throwaway4good 6y ago
There are many many silly uses of docker and k8s out there. But people seem to like it ...
- sn_master 6y ago
  Yup, I feel they try to justify themselves and feel they've done something complicated that takes time to understand by newcomers, when in reality the whole thing could be a single Go or C# binary and the entire utilized cluster power is less than a single mid-sized VM that could just run said single binary, without any external dependencies that usually get used to justify Docker. If people paying the money knew the amount of waste being done...
nrmitchi 6y ago
I've seen it, and I've also seen it in Kubernetes. It's obviously not the intended use case, but it can have the advantage of plugging in much nicer with your existing tooling. As an example, if I have a Kubernetes cluster, and a new app that needs a full VM. My options are to containerize it (it likely already comes this way), and let Kubernetes scheduled it on it's own VM, or use a different tool in order to manage the unique VM for this app. Unless there are reasons to avoid the containerize approach, I'm going to stick with the existing tooling rather than add additional complexity.
- sn_master 6y ago
  > and a new app that needs a full VM. Most cases I've seen the apps don't need more than a two dozen megabytes out of the gigabytes in the VM. It was crazy seeing how much resources were being wasted for no good reason.

asien 6y ago

Not surprising honestly , docker has had more 300M of investment and still has no decent stream of revenue to pay their 300+ employees of SV. The entire industry knows it , the Docker devtools brought containers to the mass but anything beyond that is being taken by Cloud Vendors / Redhat etc... The Open Container Initiative contributed massively to make Docker the standard for container but also for other initiatives to replace it.... I personally believe it will also be its death sentence, seeing how many competitions are coming to get a better / simpler container tool chains add to that a lack of leadership after the founder left with a big check from the fundraising it’s just a matter of time before Docker goes bankrupt.

tyingq 6y ago
I believe WSL2 and Apple's virtualization framework may eventually kill Docker desktop. Both provide enough underpinnings for an open source solution to match the "ease of use" thing that makes Docker Desktop popular. That leaves Docker Hub as their last revenue stream.
- indymike 6y ago
  Util I can deploy an _____ (cool, new thing) image on pretty much anything Docker isn't going anywhere.
  - tyingq 6y ago
    Not "docker" in general...Docker desktop. Docker the company makes nothing on the command line docker tool.
- sleepybrett 6y ago
  podman.
raverbashing 6y ago
Yeah, true. Docker is basically at its core a shell around cgroups/chroots and filesystems. An overengineered shell and a confusing cmdline (which got better to be fair) There's no "technology" there per se (on Docker "core"). Docker containers and Dockerfiles maybe? Which got eaten by other orchestration technologies there?

DoctorNick 6y ago

It's amusing to see all the little indicators that Docker is desperate for cashflow. At this rate, they're going to end up like Travis.

cutemonster 6y ago
What happened to Travis?
- DoctorNick 6y ago
  Chased off all their users by reigning in all their free tiers until it became commercial-only.

tediousdemise 6y ago

Podman[0][1] is an alternative daemonless containerization software. In my line of work, Docker poses too many security risks and Podman is the approved alternative. Podman supports Docker images, Dockerfiles, and Docker-compatible CLI interfaces. Simply use alias docker=podman and you’ll never know the difference. [0] https://podman.io/ https://podman.io/ [1] https://github.com/containers/podman https://github.com/containers/podman

atat7024 6y ago
First thing I thought, who would skip over Podman?
- vocram 6y ago
  - For some Linux distro the setup is not as easy as with Docker - Someone relying on Docker only features like Docker compose
  - tediousdemise 6y ago
    See Podman-compose: https://github.com/containers/podman-compose https://github.com/containers/podman-compose
    - fignews 6y ago
      So podman-compose is really not where it’s at. This is coming from a long time ex-user. It’s a simple project with 117 open issues and 37 pull requests going back to 2019 (very few/no comments). There are many missing features and incompatibilities. I’m an ex-user because as of podman v2.2 there’s support to emulate the Docker socket which allows one to use Docker-compose.
vocram 6y ago
(Pedantic) you probably meant (OCI) container images, not docker images.

asdz 6y ago

They need more free beta tester to ensure their prod build. With 200k crash logs, they can analyze what break their new updates.

rcarmo 6y ago

Well, good thing I use VS Code to build Docker containers on other machines then…

desertraven 6y ago

Many comments seem to be critiquing Docker’s monetisation strategy. If this is accurate, why don’t they just ask users what they would pay for? I’m sure customers understand that things need to be financially sustainable, so why not just ask the userbase their vision of a monetised Docker?

cutemonster 6y ago
Maybe could even be an HN topic of its own

lmeyerov 6y ago

I wonder if this was good intentions by some developers getting subverted by an unaligned leadership ethos? (panicked? too $ focused? not enough user advocacy? no idea!) I can easily imagine a few meetings that went something like this: 1. Security engineer meetings: "Flipping to default-on for automatic updates has been a major win for ~billions of people to help them mitigate the steady stream of 0-days exploiting gnarly web browser internals. Docker adoption isn't at that level but still big, and the individuals are pretty important. We should try it for our community too!" 2. Sales & CEO: "A ha, amazing! We can turn this into a $ win too. We've been needing more $ and conversion triggers for our install base now that we sold the enterprise business. Anyone with docker desktop on for > 2w is effectively a qualified leading with this, and this might finally tip them over to paid! $5/mo is nothing and this is just annoying enough that it might do it! (And if a developer won't pay for that, they're a freeloader / 1% / ... who'd never pay anyways...)" 3. PMs + designers + marketing + other user advocates responsible for trialing & trust: "Wait a minute! For their core workflows, developers need to easily control the versions of their tools in their environment. Messing with that willy-nilly for system version #'s breaks brand trust for our paid conversions!" 4. Sales & CEO: "Maybe. Let's try it and see. Overruled in the name of business experiments, and we can reverse course if it's too damaging!"

t0mas88 6y ago
That's the majority Hacker News kind of opinion "Sales or the CEO fucked it up for the engineers" but another likely explanation is that the main source of frustration (forced updates for everyone) came from the engineering side because most developers hate maintaining older versions. Then someone said "you can't do that to enterprise customers, they demand to pick their own versions" which resulted in this button for the paid version.
- lmeyerov 6y ago
  I'm agreeing with you here for the first part: that's another great well-meaning dev explanation. The ball-dropping is sales/product/leadership not being aligned on user advocacy. "Our velocity & sales > breaking user environments" means either the former is overly prioritized, or the people making decisions are too far from users (developers) to understand their daily needs. Managing docker versions for dev/prod drift isn't "1% of devs 99% of the time" but "99% of devs 1% of the time", so it's a real miss. In an alternate org where the user advocates lead might look more like: * <reject early on the current feature plan proposal as user hostile and instead...> * free: default to auto-update (or not) * free: flip * pay ("Pro"): one-click to switch to another version, both forwards & backwards * pay ("Enterprise"): centrally managed update schedule, version tracking, audit logs, etc. for all devs in your org Folks there are some of the best, so I'm sure most of this was considered, and thus it's an org/process problem

jameshart 6y ago

Worrying in this thread how few people seem to realize that docker desktop is not a) just another word for ‘docker’ or b) just an app frontend for running docker’s daemon in the background. People seem to forget: Docker is a Linux-only technology. If you’re running a non-Linux desktop OS like MacOS or Windows you need access to a Linux system to run docker. So docker desktop on MacOS runs a Linux VM for you under the hyperkit hypervisor hosting a Linux OS running containerd. On windows the equivalent involves managing a dockerd running inside WSL. So since we are talking here about an app that embeds an entire Linux OS image, the patching surface area is going to be considerable - it’s not just got to be updated whenever docker releases a new version. It’s actually a minimal Linux distribution. This also means people suggesting ‘alternatives’ to using docker are missing the entire value that docker desktop brings to MacOS and Windows users.

dgan 6y ago
Thank you, I never heard about Docker Desktop, and was confused what all the fuss is about in the comments
ccmcarey 6y ago
> People seem to forget: Docker is a Linux-only technology As I understand it, this is not true - you _can_ run Windows containers. https://hub.docker.com/_/microsoft-windows https://hub.docker.com/_/microsoft-windows
- jameshart 6y ago
  That’s... a little bit of a stretch of what it means to be a ‘docker’ container. It’s more a ‘Windows container services’ image, which requires a host Windows OS to run... But yes, this further gets to the confusion about what ‘docker’ is vs ‘docker desktop’. Docker desktop for MacOS is certainly not going to just magically make it so you can run “docker run -it microsoft-windows” to get a CMD prompt on your MacBook though (but with a Windows VM and the right environment variables set, maybe?)

deorder 6y ago

What would anyone here recommend for local development (mostly on Linux) if I already have several production Kubernetes clusters? Podman or just running a local Kubernetes with Kind or Minikube for example? At the moment I use Docker compose.

rbjorklin 6y ago

I’m not on Windows/Mac so I can’t check this myself but couldn’t you just add a record to /etc/hosts for: 0.0.0.0 updates.docker.com Or something similar?

rubyn00bie 6y ago

This would be fine if Docker wasn't literally force-fed to me over the past six years. It would be fine if their updates didn't totally fuck up my development environment, or completely break it from time to time... it'd be okay if on MacOS you weren't forced into using the desktop application. shrug In the end I don't particularly care, I still run things like a caveman using processes, systemd units, disk images, and plan for my resource usage. I just find it mighty frustrating and think its short-sighted. Anyone who gets burned by a Desktop update (which they will, this happened to me within this last two months) isn't going to think "oh if only I paid them! Duh! Silly me." Instead it's going to seem like extortion... "Oh no! We broke your development environment! Whoopsie! If you upgrade to pro you can revert and continue working immediately!" Docker was originally "magical" and each year it becomes increasingly less "magical" I can only hope it is worth it.

frenchman99 6y ago
I'd probably pay if this is an issue for me, just like I pay for other stuff that has popups for as long as you don't pay (Sublime Text, Little Snitch, etc). You're only getting Docker for free because you help them by upgrading automatically. In fact, it's pretty cool that the only requirement is to stay up to date. Some companies make you pay to get upgrades, which is less secure in a way.
- marcosnils 6y ago
  ^ 1000% this. One of the very few open minded answers I've seen so far. Of course people will complain, specially in HN. Even though I agree Docker's communication and execution wasn't the best, I applaud them since they're trying to monetize their work in a different strategy than the standard "support plan". In the end, I really hope this ends up working for them since it'll ultimately be reflected in the quality of the product. If you ever launch a Linux version I'll be happily be a paying customer.
- guitarbill 6y ago
  If someone is using Docker professionally, maybe not a issue. I don't mind paying for software, and it could probably be expensed - although I am sure there's some cases where it isn't true or is more complicated. No, what's galling about this is that Docker is used so widely. What about open source projects using Docker? Now you have to apply for an "Open Source Plan"? Great. How does that even work with contributors if they just want to install Docker to check out the project? If a project I was working on depended on Docker, I'm not sure if I'd rather spend time figuring out how to ditch Docker vs fill out their application.

superkuh 6y ago

This is the image (and text) in the twitter post for anyone that cannot see it due to javascript: https://pbs.twimg.com/media/E0VAF-cXEAI5qqC?format=jpg https://pbs.twimg.com/media/E0VAF-cXEAI5qqC?format=jpg "Update ready to install" "Docker Desktop Version 3.3.1 (63152) - April 15 2021" "See what's new" "[Skip this update (pro)] [Install & Restart]"

lvs 6y ago

Update authoritarianism is on the march. Please stop.

yread 6y ago

Of course this is terrible but I would love to charge my laggard customers who delay major upgrades

lrvick 6y ago

I'll note that Docker only does this on the virtual machine infrastructure wrapper needed to run a minimal Linux VM to run Docker on non native platforms. If you run Docker on Linux, which it was designed for, it is totally open source and free. If you are on a Mac it is assumed you like paying for GUIs on top of things that are otherwise free. That checks out.

btdmaster 6y ago

I find plain Linux namespaces as sufficient for many things, for example: unshare --map-root-user chroot ~/rootfs /bin/sh Sure, it might not be able to clone the rootfs for you, but you don't need snapd to install it and it comes as part of util-linux, essentially being part of almost all Linux systems. (https://ilearnedhowto.wordpress.com/tag/unshare/ https://ilearnedhowto.wordpress.com/tag/unshare/ is a nice introduction.) Edit: https://ericchiang.github.io/post/containers-from-scratch/ https://ericchiang.github.io/post/containers-from-scratch/ is also interesting.

hda111 6y ago

I hope someone will make a Podman Desktop installer. On mac it would setup a small VM and Podman remote CLI on the Mac. On Windows it would setup a small WSL2 distro. The problem with Podman is that it currently has a lot of bugs when not running on Fedora/RHEL or similar. And there is no free fedora distro available for WSL that I’m aware of.

smashed 6y ago

Shout out to the docker.io debian/Ubuntu package maintainers, which is what I use on all systems I manage. After being burnt badly by the "official" docker auto-updates breaking stuff a few times, I've had enough and seeked a better solution. Turns out it was already there, no 3rd party package repos required. Linux distros package managers go to very great length not to break users' work environments. They keep things working, secure and stable, and I am very grateful for it.

voceboy521 6y ago

man, i wish Windows added this as a features, even if it's paid.