3 ms·

I feel like "single shared namespace" works best when the ecosystem is managed collaboratively, with a clear leadership to make calls on who gets what name— for

I feel like "single shared namespace" works best when the ecosystem is managed collaboratively, with a clear leadership to make calls on who gets what name— for example, something like a Linux distro, where there are Replaces/Provides metadata specifically to facilitate these kinds of transitions and avoid being stuck forever with crappy legacy nonsense. But this doesn't work at all in a free-for-all environment like PyPI, NPM, or Crates, where anyone can just grab a name and then have it in perpetuity. IMO the Docker ecosystem got this right, with baking in a domain name as part of the container, and insisting that everyone on docker.io use a vendor/product convention. This meant that the toplevel namespace was reserved for them to offer (or delegate the offering of) specific blessed container images, much more in line with how distro packaging might work. # Get the "official" image, whatever that means (but you trust Docker Inc, so yay). docker pull nginx # Get an image supplied by a specific vendor. docker pull bitnami/nginx # Get an image from a different server altogether; maybe it's your company, or you don't trust Docker Inc after all? docker pull quay.io/jitesoft/nginx Maybe the big-flat-namespace thing is still a years-later reaction against huge and unnecessary hierarchies in Java land? I think the ideal is not to permit infinite depth, but perhaps to insist on 2-3 levels.

dmurray 5y ago
Github generally has two levels (organization and repository) which works pretty well.
- hollerith 5y ago
  It works pretty well, but might not if making org2/repo55 a copy of org1/repo55 (i.e., forking) weren't free for the user (namely, org2) and maybe a venture-backed startup can afford to keep it free for the user, but a non-profit cannot.
  - xfer 5y ago
    Forking doesn't cost github anything it's a git branch of parent repo. That's why you could see people accessing youtube-dl via a commit hash of github dmca repo.
roywashere 5y ago
Similarly, Perl has CPAN and system where if a module is unmaintained and the author unresponsive, new maintainers can be granted permission by admins to take over. This ensures the namespace is preserved, peoples dependencies keep getting updated.
- cutemonster 5y ago
  > peoples dependencies keep getting updated. Updated maybe with malware sometimes? Is it unbelievable that the admins sometimes would hand over an inactive module to the wrong person? Maybe Perl is a less interesting target than npm so it works (so far) for them?
kbenson 5y ago
It's worth noting that this behavior is also a sticking point with some users and distros, and I believe was at least part of the reasoning behind podman being developed by Red Hat. Sometimes you don't want some third party controlling and blessing what's okay, you want to explicitly control that by only allowing sources you control so you can't even accidentally use that third party. Different groups have different use cases and it's hard to support them all well.
- marcosdumay 5y ago
  You mean you want to override or replace the global name registry? I can't imagine that getting any harder by the global vs. scoped name distinction. It's just an extra feature.
  - kbenson 5y ago
    It's a feature docker refused to implement, and is one of the reasons Red Hat created podman, which is a drop in docker replacement (you can alias it to docker for the most part), but it allows full control over what repos are checked. For docker, as I understand it to get something functionally similar you have to define a mirror for docker.io that's not really a mirror and then prefer that mirror and/or disallow traffic to docker.io in some fashion.
    - infogulch 5y ago
      I've heard this argument a million times, but I really don't get it. If you want to control which images are deployed, you want to be running your own image registry anyway. So you already have full control: just limit images to ones in your private registry with its fully qualified name. Why do you also insist on being able to deploy with 'short' names? Arguably it's better because users can't confuse "enterprise customized ubuntu:20.04" with the public one and bother open source maintainers with internal issues.
      - kbenson 5y ago
        Nobody is insisting on being able to deploy with short names (or at least not the people that actually care about this). They are insisting that someone screwing up and using a short name when they shouldn't doesn't go out to a third party that's not explicitly trusted. Making this about short names is completely missing the point. Requiring docker to be run with a "mirror" which isn't actually a mirror of docker.io and making it use your non-mirror mirror so docker.io can't be reached and everything still works is just a hacky way to trick docker into working in what many people think is a very valid way - where no external resources can be used as a container not just as a matter of policy, but as a matter of capability. Put simply, it's not about replacing the default repo, it's about excluding all external repos. Requiring they all use long names would be a perfectly acceptable trade off for most orgs I think, if that was an option offered.
krinchan 5y ago
I feel like namespaces came much later than Docker Hub, but I can’t really find a good historical record of docker registry features (or at least easily searchable ones). The global namespace was either forcibly cleaned or delegated to who was currently publishing them and projects raised issues if that wasn’t them. I vaguely remember annoyance that I had to publish my toy containers to the global namespace. I could be wrong though.
- mikepurvis 5y ago
  So per [1] it looks like Docker Hub launched in mid-2014. Admittedly my earliest pushes to there are more like the late-2015 timeframe, but definitely by that point I was pushing to namespace under my username. My impression had always been that the structure of Docker Hub was meant to mirror Github in terms of an org/repo scheme. [1]: https://www.docker.com/blog/announcing-docker-hub-and-official-repositories/ https://www.docker.com/blog/announcing-docker-hub-and-offici...

dmurray 5y ago

Github generally has two levels (organization and repository) which works pretty well.

hollerith 5y ago
It works pretty well, but might not if making org2/repo55 a copy of org1/repo55 (i.e., forking) weren't free for the user (namely, org2) and maybe a venture-backed startup can afford to keep it free for the user, but a non-profit cannot.
- xfer 5y ago
  Forking doesn't cost github anything it's a git branch of parent repo. That's why you could see people accessing youtube-dl via a commit hash of github dmca repo.

roywashere 5y ago

Similarly, Perl has CPAN and system where if a module is unmaintained and the author unresponsive, new maintainers can be granted permission by admins to take over. This ensures the namespace is preserved, peoples dependencies keep getting updated.

cutemonster 5y ago
> peoples dependencies keep getting updated. Updated maybe with malware sometimes? Is it unbelievable that the admins sometimes would hand over an inactive module to the wrong person? Maybe Perl is a less interesting target than npm so it works (so far) for them?

kbenson 5y ago

It's worth noting that this behavior is also a sticking point with some users and distros, and I believe was at least part of the reasoning behind podman being developed by Red Hat. Sometimes you don't want some third party controlling and blessing what's okay, you want to explicitly control that by only allowing sources you control so you can't even accidentally use that third party. Different groups have different use cases and it's hard to support them all well.

marcosdumay 5y ago
You mean you want to override or replace the global name registry? I can't imagine that getting any harder by the global vs. scoped name distinction. It's just an extra feature.
- kbenson 5y ago
  It's a feature docker refused to implement, and is one of the reasons Red Hat created podman, which is a drop in docker replacement (you can alias it to docker for the most part), but it allows full control over what repos are checked. For docker, as I understand it to get something functionally similar you have to define a mirror for docker.io that's not really a mirror and then prefer that mirror and/or disallow traffic to docker.io in some fashion.
  - infogulch 5y ago
    I've heard this argument a million times, but I really don't get it. If you want to control which images are deployed, you want to be running your own image registry anyway. So you already have full control: just limit images to ones in your private registry with its fully qualified name. Why do you also insist on being able to deploy with 'short' names? Arguably it's better because users can't confuse "enterprise customized ubuntu:20.04" with the public one and bother open source maintainers with internal issues.
    - kbenson 5y ago
      Nobody is insisting on being able to deploy with short names (or at least not the people that actually care about this). They are insisting that someone screwing up and using a short name when they shouldn't doesn't go out to a third party that's not explicitly trusted. Making this about short names is completely missing the point. Requiring docker to be run with a "mirror" which isn't actually a mirror of docker.io and making it use your non-mirror mirror so docker.io can't be reached and everything still works is just a hacky way to trick docker into working in what many people think is a very valid way - where no external resources can be used as a container not just as a matter of policy, but as a matter of capability. Put simply, it's not about replacing the default repo, it's about excluding all external repos. Requiring they all use long names would be a perfectly acceptable trade off for most orgs I think, if that was an option offered.

krinchan 5y ago

I feel like namespaces came much later than Docker Hub, but I can’t really find a good historical record of docker registry features (or at least easily searchable ones). The global namespace was either forcibly cleaned or delegated to who was currently publishing them and projects raised issues if that wasn’t them. I vaguely remember annoyance that I had to publish my toy containers to the global namespace. I could be wrong though.

mikepurvis 5y ago
So per [1] it looks like Docker Hub launched in mid-2014. Admittedly my earliest pushes to there are more like the late-2015 timeframe, but definitely by that point I was pushing to namespace under my username. My impression had always been that the structure of Docker Hub was meant to mirror Github in terms of an org/repo scheme. [1]: https://www.docker.com/blog/announcing-docker-hub-and-official-repositories/ https://www.docker.com/blog/announcing-docker-hub-and-offici...