35 ms·
Docker is deleting Open Source organisations - what you need to know
- Quekid5 4y agoAre they actively trying to hasten their own demise? I guess I'll be moving our (FOSS) container images to GitHub Registry... but what a pain :/
- toastal 4y agoCan you move to GitLab? GitHub is purely proprietary which doesn't match the spirit of FOSS. At least GitLab is open core.
- martypitt 4y agoGitlab have been increasing pricing heavily recently, especially in storage-heavy areas such as containers. I don't think they're likely to be a cost-effective differentiator against what Docker are now charging.
- jck 4y agoiirc gitlab's free tier has a storage and bandwidth limit which applies to the container registry too. That makes gitlab a no go if you want to share containers widely.
- candiddevmike 4y agoJust did this yesterday, it was surprisingly easy. I used the HashiCorp Vault secrets plugin for GitHub and pushed containers via GitHub Actions, so for me it became more secure than storing and retrieving a docker hub API key.
- davedx 4y agoGithub also charges for usage. Are they also hastening their demise? AWS also charges you to host things in S3. Is it hastening its demise too? This argument is just weird to me.
- deleted 4y ago[deleted]
- koolba 4y agoCan we just get the big three cloud players to make a new public repo? They’ve got oodles of bandwidth and storage, plus the advantage that a lot of access would be local to their private networks. Setup a non-profit, dedicate resources from each of them spendable as $X dollars of credits, and this problem is solved in a way that works for the real world. Not some federated mess that will never get off the ground.
- pimterry 4y agoConsensus on a new repo for public community images would help, but it isn't the biggest problem (as the author notes, GHCR does that already, and GitHub seem pretty committed to free hosting for public data, and have the Microsoft money to keep doing so indefinitely if they like). The issue I worry about is the millions of blog posts, CI builds, docker-compose files, tutorials & individual user scripts who all reference community images on Docker Hub, a huge percentage of which are about to disappear, apparently all at once 29 days from now. From a business perspective particularly, this looks like suicide to me - if you teach everybody "oh this guide uses Docker commands, it must be outdated & broken like all the others" then you're paving a path for everybody to dump the technology entirely. It's the exact opposite of a sensible devrel strategy. And a huge number of their paying customers will be affected too! Most companies invested enough in Docker tech to be paying Docker Inc right now surely use >0 community images in their infrastructure, and they're going to see this breakage. Docker Inc even directly charge for pulling lots of images from Docker Hub right now, and this seems likely to actively stop people doing that (moving them all to GHCR etc) and thereby _reduce_ the offering they're charging for! It's bizarre. Seems like a bad result for the industry in general, but an even worse result for Docker Inc.
- JustBreath 4y agoYeah that's going to be the real issue, all the niche unmaintained images that no one is going to pick up the pieces for. They're taking a big chunk of open source and tossing it in the garbage.
- miyuru 4y agoaws already have one https://gallery.ecr.aws/ https://gallery.ecr.aws/
- nikanj 4y agoAll free tiers everywhere are going away, because someone always figures out how to run a crypto miner on them.
- fathyb 4y agoHow can you mine crypto using Docker Hub?
- orangepurple 4y agoNice try
- Tao3300 4y agohttps://youtu.be/1EF6kB9q4vg https://youtu.be/1EF6kB9q4vg
- madduci 4y agoStorage ain't free as well, someone uploads huge images
- pilif 4y agoTraffic is probably the higher cost
- nottorp 4y agoHmm. > GitHub's Container Registry offers free storage for public images. But for how long?
- agumonkey 4y ago> But for how long? the subtitle of the web era
- preciousoo 4y agoThe hippies were right
- Kwpolska 4y agoThey have a pretty good track record in code hosting (15 years), why would they ruin it for containers?
- bflesch 4y agoGithub shutting down is not on my risk matrix. Hopefully it happens after I retire.
- tankerkiller 4y agoIt's on ours where I work, which is why we use Gitea to clone the various open source projects we use to our own servers. With binary level deduplication the amount of data stored is actually incredibly small. I think the unduplicated storage is like 50GB, and the deduplicated is like 10GB?
- jnwatson 4y agoThe 6-8 orders of magnitude difference in storage required?
- bmacho 4y agoWe need a culture to not use resources even if it is available and cheap. Use github like it wasn't free.
- jon-wood 4y agoDocker the tool has been a massive benefit to software development, every now and then I have a moan about the hassle of getting something bootstrapped to run on Docker, but it's still worlds better than the old ways of managing dependencies and making sure everyone on a project is aligned on what versions of things are installed. Unfortunately Docker the company appears to be dying, this is the latest in a long line of decisions that are clearly being made because they can't work out how to build a business around what is at it's core a nice UI for Linux containers. My hope is that before the inevitable shuttering of Docker Inc another organisations (ideally a coop of some variety, but that's probably wishful thinking) pops up to take over the bits that matter, and then hopefully we can all stop trying to keep up with the latest way in which our workflows have been broken to try and make a few dollars.
- frognumber 4y agoDo you remember SCO?
- emeraldd 4y agoHonestly, this is reminding me of Oracle after buying Sun.
- spicyusername 4y agoideally a coop of some variety This is the role I feel like podman, the tool developed by Red Hat, is filling.
- quaintdev 4y agoPodman is great and is first class citizen on Fedora. It also integrates nicely with SystemD. My only gripe with it is not many developers provide podman configuration on their install pages like they do with docker compose
- regularfry 4y agoI'm using docker-compose with a podman VM for development on a mac. Works ok so far. It wasn't quite slick enough when Docker pulled the licence switch last year, but the experience in the last couple of months has been pretty painless.
- jszymborski 4y agoHas there been any work on making these centralised public repositories distributed?
- bandrami 4y agoWhat work needs to be done? Provision a server somewhere and host it. AWS has one-click "give me a docker hub" and "give me a git hub" products.
- alias_neo 4y agoThis has been happening recently with Helm chart repositories etc. Maybe it's time people started hosting their own Container Registries? The huge bandwidth requirements are an incentive to keep images small.
- angio 4y agoWould it be possible to build something on top of DHT+Torrent? Main issue seems around image discovery.
- qbasic_forever 4y agoYes containerd supports pulling images from IPFS: https://github.com/containerd/nerdctl/blob/main/docs/ipfs.md https://github.com/containerd/nerdctl/blob/main/docs/ipfs.md
- delfinom 4y agoExcept you need to pay for pinning IPFS files to actually persist. And there-in lies the crux. People don't got money to pay for their small time docker containers. The cost of some of the IPFS hosts that will give you a dropbox of sorts still end up costing roughly the $20/month similar to the Docker $25/month for a team account.
- RobotToaster 4y agoI was just thinking this seems like an ideal use case for IPFS or bittorrent, since most users will already be running on a server. It doesn't seem unreasonable to have the client automatically pin/seed the container it pulls.
- jiggywiggy 4y agoIt was always unbelievable too me how much they hosted for free. I recklessly pushed over 100gbs of containers the last years, all free. Never made sense to me, even google doesn't do this anymore.
- wenyuanyu 4y agoThere are techniques to compress and dedup redundancies... I doubt it is real 100gbs on their disks...
- 101011 4y agoEven so...storage is not free. Looking at the rates of enterprise storage costs compared to what Google or Apple charges consumers - I was surprised by how subsidized people's photo libraries are.
- VWWHFSfQ 4y agooh that's completely different. They want you to host your photos with them because then you can never leave their platform.
- girvo 4y agoApple does a pretty bad job of it then, because I have a local copy of my entire photo library too on an external hard drive. It’s quite nice really, cloud storage plus a local copy. I guess it’s somewhat of a moat because switching to some other cloud provider or my own system will be more expensive?
- VWWHFSfQ 4y agoobviously hn readers will know how to copy the photos to their own computer. most people won't and that's the point
- 4y ago
- lloydatkinson 4y agoIs there any progress on podman for Windows or any other way of running containers on Windows? I cannot wait for the day the development community doesn't need to rely on anything from this company.
- taspeotis 4y agoI use podman and it works fine? Podman Desktop runs podman machine for me at startup. Containers set to restart automatically don’t restart across podman machine restarts but that hasn’t upset my workflow much (at all?). I just start containers as I need them.
- girvo 4y agoI wonder if VSCode’s Remote Container stuff works with Podamn on windows. The Docker Desktop + VSCode + Remote Container Dev + the ESP-IDF tooling is the nicest way to do production ESP32 dev with multiple ESP-IDF version (and even without that is just much simpler to get up and running on Windows, despite the rube Goldberg machine-esque description of it)
- bluehatbrit 4y agoI've been playing around with it recently on macos and Podman is still a bit hit or miss. It seems mostly to be around assumptions of permissions. I switched over to colima (which is specifically for macos) and have had next to no issues though. Hopefully podman is able to tick off those last few boxes and make it properly stable in this use case.
- orra 4y agoBoth Podman Desktop and Rancher Desktop are viable options for running Linux containers on Windows.
- danielnesbitt 4y agoIs there something in particular missing? I have been using Podman for Windows almost daily for the past six months. There is no management GUI built-in like Docker for Windows, but I have not found that be a problem at all.
- FlyingSnake 4y ago> Start publishing images to GitHub And when GitHub starts similar shenanigans, move out to where? I am old enough to know the we can't trust BigTech and their unpredictable behaviors. Eventually we need to start a Codeberg like alternative using Prototype funds to be self reliant. 1: https://codeberg.org/ https://codeberg.org/ 2: https://prototypefund.de/ https://prototypefund.de/
- davedx 4y agoIt actually sounds reasonable to me? They have an open source program, the article says its open source definition is "too strict" because it says you must have "no pathway to commercialization". I mean why should you expect someone to host gigabytes of docker images for you, for free?
- JonChesterfield 4y agoWell, it's how they established themselves in the market. Without being friendly to open source projects they wouldn't have had that marketing and wouldn't exist as a company. So now they destroy their foundations and learn whether they 10x or fold. Pretty standard VC playbook so I assume that's the driving force here.
- lmm 4y agoIf you're going to call it "open source" that should mean what "open source" usually means, i.e. that e.g. RedHat is eligible.
- rollcat 4y ago> the article says its open source definition is "too strict" because it says you must have "no pathway to commercialization" What a load of crap. Free Software's "0th freedom" is the ability to use the program for whatever purpose you wish. The definition of Open Source is even looser than that. They are asking their "Open Source" users to make their software non-free, by restricting its use cases. Anyway, the writing has been on the wall for a long while. If you haven't moved off Docker Hub yet, now is the time.
- preciousoo 4y agoSide note: what did happen to Travis? I was just googling them yesterday because they were everywhere. They even came with the GitHub education package. Did GitHub just eat them?
- tankerkiller 4y agoSeems based on some of my research that they've completely exited the free side of the business. All of their plans are now paid and the cheapest plan is $64/year
- jacobwg 4y agoTravis CI got acquired by Idera in 2019 (https://news.ycombinator.com/item?id=18978251 https://news.ycombinator.com/item?id=18978251) then a month later laid off senior engineer staff (https://news.ycombinator.com/item?id=19218036 https://news.ycombinator.com/item?id=19218036).
- preciousoo 4y agoDamn. They were my introduction to CI/CD. Such is life
- Xylakant 4y agoTravis was acquired a few years ago and things went downhill from there on.
- VWWHFSfQ 4y agoIt wasn't a good business to be in anyway. I don't think any of these freebie devops businesses are all that smart. They're not a "business", they're a feature of someone else's business. And as soon as they catch up then you're done.
- acdha 4y agoAlso they’re surprisingly expensive: things like spam and cryptocurrency mean that you need a fairly large abuse prevention team which is expensive but has no customer-visible benefits. GitHub has that too but as you said they at least have the rest of the business with which to recoup that cost.
- JonChesterfield 4y agoMy first thought on this was good riddance. The dev model of "we've lost track of our dependencies so ship Ubuntu and a load of state" never sat well. However it looks like the main effect is going to be moving more of open source onto GitHub, aka under Microsoft's control, and the level of faith people have in Microsoft not destroying their competitor for profit is surreal.
- Sebb767 4y ago> The dev model of "we've lost track of our dependencies so ship Ubuntu and a load of state" never sat well. Docker, the company, is failing. Docker, as in containerization technology, is alive and very well. (edited for clarity)
- osigurdson 4y ago>> Docker, the company, is failing. Docker, the container technology, is alive and very well. Is it though? Podman is more well liked (no daemon / non-root) and Kubernetes doesn't have direct support for it any more. I don't think it matters much that k8s uses CRI-O but docker needs to be #1 for running a container on a single machine. Yet, they seem to be letting that slip away because it is not directly monetizable. Software businesses need to be creative - invest a lot into free things, which support monetization of others. If you want low risk returns, buy T-bills.
- cybrox 4y agoThe docker runtime is not supported by k8s anymore but docker built containers do still and will very likely continue to work for a long time.
- Zensynthium 4y agoTell that to svb
- Sebb767 4y ago> Is it though? Podman is more well liked (no daemon / non-root) and Kubernetes doesn't have direct support for it any more. I've used "Docker" as in "containerization", since they are often used synonymously and the grandparents intent was definitely to criticize the latter. Docker itself will quite likely stay around as a name, but I have no faith in the company.
- tyingq 4y agoThe only real moat they seem to have here is that "FROM" in a Dockerfile, "image:" in a docker-compose.yml file, and the docker command line default "somestring" as an image to "hub.docker.com:somestring". They pushed that with the aggressive rate limiting first though, which caused a lot of people to now understand that paragraph above and use proxies, specify a different "hub", etc. So this move, to me, has less leverage than they might have intended, since the previous move already educated people on how to work around docker hub. At some point, they force everyone's hand and lose their moat.
- remram 4y agox/y expands to docker.io/x/y and z expands to docker.io/library/z
- tyingq 4y agoRight, it's a little different than my summary, but the main point was that they educated everyone that there's a way around that with specific image names, or a proxy, etc. If they push hard enough, the internet will route around them, distros will ship a patched docker, preset environment variables, or a docker->podman alias, etc. They will lose control over the "root namespace".
- numbsafari 4y agoDocker have a responsibility to _their_ customers, not just OpenFaas and other open source projects. _Docker's_ customers rely on them to provide a safe and reliable service. If Docker allows these projects to be taken over by nefarious actors, then the risk falls to _their_ customers, not the Open Source projects that they've broken with.
- Ekaros 4y agoIt is kinda strange that developers who should be aware of their own costs think that these sort of services will be free forever or even available and never end. Specially when clearly there is not much monetization going on. Unlike when services are offered with adds. Big players can carry the costs, but what can small ones really do once money runs out?
- raesene9 4y agoImage hosting at scale is an expensive business and Docker are not the only ones trying to manage the costs. Kubernetes is currently in the process of changing the main repository for their images because, as I understand it, they're burning through their free GCP credits an an unsustainable rate. Ideally Docker Hub would be an industry funded effort, but that would require co-operation and funding from the major tech. players, and I have a feeling that in an era of cost cutting, that might be harder to achieve than it was in the past.
- adolph 4y agoSquatting and the effects of malware and poison images is my primary concern here. One of the things the docker api has going for it is that it is hash based. Aside from the first time, it doesn’t seem far fetched for a docker api client to refuse or warn based on comparing the new download’s hash to the previous hash.
- mac-chaffee 4y agoNot a lot of people pull by hash; they pull by tag. Tags are not immutable, so the image I get from "python:3.11" today will almost certainly change due to security updates and I will be none the wiser.
- adolph 4y agoI can see that. A human specifiable name is important. My proposal is that each time an image is pulled, the hash is recorded and retained even if the underlying container image is removed. When the same image is pulled again, if the files change from the previous hash, either fail or warn the user. I can see how pinning to a specific patch version is not a great idea and that "python:3.11" keeps people from pinning to an insecure version.
- justusw 4y agoAs long as we don’t share ownership in these platforms, nothing will ever truly belong to us. For Docker, the software, a Libre alternative is Podman. Instead of GitHub, use Codeberg, an open organization and service. Now we need a Docker registry cooperative owned by everyone.
- zoobab 4y ago"Now we need a Docker registry cooperative owned by everyone." You can build a pyramid with a non-profit, but that does not mean it owned by everyone. Pyramids are problematic, as governance are a nightmare.
- prepend 4y agoIs there any drop in replacement for dockerhub? I’m concerned about all my random oss containers (like ruby-latest) that may come from orgs that aren’t able or willing to pay. Is there another container hosting site?
- dijit 4y agoYou could always try mirror.gcr.io https://cloud.google.com/container-registry/docs/pulling-cached-images https://cloud.google.com/container-registry/docs/pulling-cac...
- xrd 4y agoYou can run the docker registry inside dokku. It's fantastic. I have an endpoint that is private for pushing with credentials, and a public endpoint that is open. This requires a little mucking around with the nginx configuration of the app, but totally doable.
- gabeio 4y agoAws seems to have mirrored some of docker hub for us (docker/library images seem to be hosted clones) and has their own public repos as well (not just docker hub’s images): https://gallery.ecr.aws/ https://gallery.ecr.aws/ edit: typo
- remram 4y agoquay.io and ghcr.io are popular free options.
- ridruejo 4y agoWithout entering into the specifics of this situation, I don’t understand the hate for Docker the company. They are providing a huge service for the community and looking for ways to make money from it to make it sustainable. I would give them a bit more empathy/benefit of the doubt as they iterate on their approach. Somewhere, somehow, someone has to pay for that storage and bandwidth whether directly or indirectly (I am old enough to remember what happened with sourceforge so I rather them find a model that works for everyone)
- HelloNurse 4y agoIf you inconvenience all users (by devastating the "ecosystem" of publicly available images) in order to extort money from a few users (some organizations will pay up, at least temporarily) you should expect hate. The only benefit of doubt Docker deserves is on a psychological plane: evil or stupid?
- NineStarPoint 4y agoIt’s a long standing hate for me that isn’t limited to just Docker, companies that used “we’re free” to obtain massive growth only to turn around and switch monetization models completely once they’ve become the dominant player in the market. It’s a massive distortion on the market, driving companies that tried to be fiscally sound from the start into irrelevancy while extremely inefficient ventures become the market leaders on account of superior funding. Or to put it another way, Docker should have been focused on sustainability from the start and not dangled a price they knew couldn’t last in front of people to increase adoption.
- armchairhacker 4y agoI agree they deserve to get paid, but there are better ways than essentially holding customers’ data and URLs hostage. The problem is they are trying to extract money from other open-source developers who are at least as cash-strapped as them. Plus, I doubt they will get many people to actually start paying. People will simply move to other storage (like Github) and switch the URLs. Docker is fully open-source and works without docker.io, they don’t really have a position here except owning the name. IMO they just need to edit / clarify that open-source developers and organizations won’t need to pay, only those who presumably should have the funds. And take a more passive stance: bug people with annoying messages like Wikipedia does, and threaten shutting down docker.io altogether if they don’t somehow get funding (some people will complain about this too but more will understand and will be sympathetic). Wikimedia, Unix/Linux, Mozilla, etc. as well as Homebrew/cURL/Rust all seem to be doing fine as nonprofits without creating huge controversies like this.
- Havoc 4y agoTo me this smells of VC model issues. Initially it's great if you can get all the FOSS to play in your technology walled garden. Subsidize it with VC cash. Downside is it generates a ton of traffic that is hard to monetize. Sooner or later it reaches a point where it can't be subsidized and then you get pay up or get out decisions like this. One question I haven't seen yet is 420 USD? Is that what it costs to serve the average FOSS project? Or is that number a bad Elon style joke? If they came out with "We've calculated X as actual costs. We're making no margin on this but can't free lunch this anymore" that would go down a lot better I think.
- rad_gruchalski 4y agoI just started paying for Docker. I use it daily, it makes my life easier so I decided to pay for it.
- nrvn 4y agoAfter Docker announced rate limiting for the hub this was an anticipated move. Was just the matter of time. The only recommendation to everyone: move away or duplicate. One of the strategies I am yet to test is the synchronization between gitlab and github for protected branches and tags and relying on their container registries. Thus (at least) you provide multiple ways to serve public images for free and with relatively low hassle. And then for open source projects’ maintainers: provide a one command way to reproducibly build images from scratch to serve them from wherever users want. In production I don’t want to depend on public registries at all and if anything I must be able to build images on my own and expect them to be the same as their publicly built counterparts. Mirroring images is the primary way, reproducing is the fallback option and also helps to verify the integrity.
- acdha 4y ago> Mirroring images is the primary way, reproducing is the fallback option and also helps to verify the integrity. I suspect the latter will become more common over time. I can count on no fingers the number of open source projects which I’ve encountered which have production-grade container images. Once you need to think about security you need to build your own containers anyway and once you’ve done that you’ve also removed the concern of a public registry having issues at an inopportune moment.
- phillebaba 4y agoSome self promotion but I have built a project that aims to solve some of these issues in Kubernetes. https://github.com/xenitAB/spegel https://github.com/xenitAB/spegel I have avoided a couple of incidents caused by images being removed or momentarily not reachable with it. It would at least mitigate any immediate issues caused by images being removed from Docker Hub.
- Forestessential 4y agoIts a business
- ParetoOptimal 4y agoWe'll see how the free market responds to them dropping (possibly) substantial open source project support.
- xrd 4y agoI run multiple docker registries inside dokku. It's fantastic. $5/mo for peace of mind.
- LoonyFruiter 4y agoWhat alternatives to docker are there on ARM based devices like apple silicon macs? I'd like to get off of Docker in light of this change.
- SparkyMcUnicorn 4y agoI use Colima. https://github.com/abiosoft/colima https://github.com/abiosoft/colima
- martypitt 4y agoI think it's an interesting challenge with FOSS infrastructure in general, and I'm surprised it isn't more of an issue. Docker's storage is heavier than most, but what about other repositories like maven central, and npm? There must be significant costs associated with running those. These tools are all the backbone of modern software dev, and need a business model. It's reasonable that consumers should pay for the benefit. I think Docker have screwed the execution of this transition, but the overall pattern of "someone has to pay" is one I support. Personally, I pay for Docker. I use it every day, and get value from it. The argument that the OP makes is really valid though - OSS needs distribution channels, which need to be funded - and expecting the publisher to pay for this isn't always appropriate. I'd like to see something like the equivalent of CNCF which I can buy a subscription from, and it funnels money to the comapnies and developers that keep me in a job -- almost a Spotify model for OSS and it's supporting infrastructure.
- schneems 4y agoRubyCentral pays the bills for rubygems.org. It’s a non-profit (501c3, not a 501c9). I believe you can buy an individual subscription to Ruby Central. Also profits from their conferences: RailsConf and RubyConf go towards funding infra (and paying people to wear the pager too).
- jacques_chester 4y agoThat said, a lot of the true cost of rubygems.org is borne by Fastly, who provide the CDN. Disclosure: I work at Shopify on a team that does work in and around RubyGems.
- Symbiote 4y agohttps://mvnrepository.com/repos/central https://mvnrepository.com/repos/central That has Maven Central as 34TB, which seems reasonable. Docker is extremely inefficient in comparison, it was 15PB two years ago: https://www.docker.com/blog/scaling-dockers-business-to-serve-millions-more-developers-storage/ https://www.docker.com/blog/scaling-dockers-business-to-serv...
- numbsafari 4y agoYou don't go to war with the army you want, you go to war with a menagerie images built and generated by random strangers on the internet your team found in stack overflow posts.
- pelasaco 4y agoand now with some layer of chat gpt generated code/documentation/configuration and etc.
- roydivision 4y agoDocker should never have become a business. There’s virtually nothing there to make a business around, it’s a suite of useful utilities that should have remained a simple open source project. I switched to podman a while ago and haven’t looked back.
- sirius87 4y agoDocker Hub does host images running into several GBs for even small hobby projects, and they also bear network transfer costs. Even with podman, you're going to have to host your images somewhere, right? Right now, the internet infrastructure heavily relies on the good graces of Microsoft (Github, npm), and storage space and network transfer charges are taken for granted.
- manquer 4y agoThe design of docker distribution is poor because the company backing it wants to retain control . Torrent based distribution for open source projects and other public initiatives were there long before docker . Apt mirroring has also been there for a long long time . Checksum integrity verification of mirrors have well established workflows . We don’t need good graces of any company to distribute assets .
- Wronnay 4y agoGitea has support for packages, so if you don't want to use GitHub or something similar, you could simply self-host your packages.
- verdverm 4y agoThen you have to pay for distribution, which is what people are using Docker Hub to avoid (grift off of?)
- sam0x17 4y agoThey could probably have made more money from 1-line contextual advertising in image pull messages than this shit
- chatmasta 4y agoI think their goal, rather than making more money, is probably to stop spending money on resources belonging to "customers" who don't pay them any money. As annoyed as I am with the change, I understand their motivation. It seems rather entitled to demand Docker continue offering me the free service of storing hundreds of gigabytes of redundant, poorly optimized image layers. The complaints seem to largely boil down to "This is outrageous! I will no longer consume your resources without paying you! GOODBYE, good sir!"
- foepys 4y agoI posted this in the other thread already but will also add it here. https://news.ycombinator.com/item?id=35167136 https://news.ycombinator.com/item?id=35167136 --- In an ideal world every project had its own registry. Those centralized registries/package managers that are baked into tools are one of the reasons why hijacking namespaces (and typos of them) is even possible and so bad. Externalizing hosting costs to other parties is very attractive but if you are truly open source you can tell everybody to build the packages themselves from source and provide a script (or in this case a large Dockerfile) for that. No hosting of binary images necessary for small projects. Especially since a lot of open source projects are not used by other OSS but by large organizations I don't see the need to burden others with the costs for these businesses. Spinning this into "Docker hates Open Source" is absolutely missing the point. Linux distributions figured out decades ago that universities are willing to help out with decentralized distribution of their binaries. Why shouldn't this work for other essential OSS as well?
- nerdjon 4y agoI am missing something and I can't find a concrete explanation anywhere. What exactly does this mean as someone who pulls images but doesn't push to docker hub? Within a month or so are we going to start getting failures trying to pull images or docker hub no longer being updated and needing to start pulling from somewhere else?
- Riverheart 4y agoIt means the images you depend on may cease to exist failing your builds and at worst they'll be replaced by bad actors registering the free namespace so automated CI builds and unsuspecting users can pull their containers instead. So depending on whether these open-source orgs pay up will determine whether you continue using Docker Hub or whatever registry they migrate to.
- tolmasky 4y agoCould IPFS possibly be a good distributed (and free?) storage backing for whatever replaces DockerHub for Open Source, as opposed to using something like GitHub? We'd still need a registry for mapping the image name to CID, along with users/teams/etc., but that simple database should be much cheaper to run than actually handling the actual storage of images and the bandwidth for downloading images.
- kevincox 4y agoProbably. You still need to store and serve the data somewhere of course but for even moderately successful open source organizations they will likely find volunteer mirrors. The nice thing about IPFS is that new people can start mirroring content without any risk or involvement, new mirrors are auto-discovered, like bittorrent. It seems like the docker registry format isn't completely static so I don't think you can just use a regular HTTP gateway to access but there is https://github.com/ipdr/ipdr https://github.com/ipdr/ipdr which seems to be a docker registry built on IPFS. > We'd still need a registry for mapping the image name to CID, along with users/teams/etc. IPNS is fairly good for this. You can use a signing key to get a stable ID for your images or if you want a short memorable URL you can publish a DNS record and get /ipns/docker.you.example/. Of course now you have pushed responsibility of access control to your DNS or by who has access to the signing key.
- verdverm 4y agoIPFS is the same free that Docker provides. Someone, somewhere is paying for the storage and network. The public IPFS would not likely support the bandwidth, volume, and most CSOs.
- ar9av 4y agoRock and a hard place. These organizations have large expenses and can't keep giving away so much for free. OTOH there are many better ways this could have been handled. More notice, discount for existing orgs etc .. OpenVS for life
- Groxx 4y ago> Has Docker forgotten Remember leftpad? Anyone who takes even a brief glance at the absurdly yolo identity, upgrade, and permissions model Docker encourages should be able to answer this with an immediate "obviously they don't care". The faster this implodes, the faster we get a safer setup where we don't blindly trust everything.
- dbingham 4y agoAs an SRE Manager, this is causing me a hell of a headache this morning. In 30 days a bunch of images we depend on may just disappear. We mostly depend on images from relatively large organizations (`alpine`, `node`, `golang`, etc), so one would want to believe that we'll be fine - they're all either in the open source program or will pay. But I can't hang my hat on that. If those images disappear, we lose the ability to release and that's not acceptable. There's no way for us to see which organizations have paid and which haven't. Which are members of the open source program and which aren't. I can't even tell which images are likely at risk. The best I can come up with, at the moment, is waiting for each organization to make some sort of announcement with one of "We've paid, don't worry", "We're migrating, here's where", or "We've applied to the open source program". And if organizations don't do that... I mean, 30 days isn't enough time to find alternatives and migrate. So we're just left basically hoping that nothing blows up in 30 days. And companies that do that to me give me a very strong incentive to never use their products and tools if I can avoid it.
- ohgodplsno 4y agoOr you could, you know, host a Docker registry and reupload those images to something you control. Worst case scenario, in 30 days, nothing is gone from Docker and you can just spin it down. Your job as an SRE is not to look at things and go "oh well, nothing we can do lol".
- dbingham 4y agoYes, that involves ripping out Docker Hub everywhere. It's a significant chunk of work, not something easily fit into 30 days on a team that is already strapped for resources with more work than we can do.
- mysterydip 4y agoI'm not familiar with how Docker works, so forgive the ignorance. I thought the point of docker images was portability? Is it not just taking the references and pointing to a new instance under your control?
- vbezhenar 4y agoI think that people should switch to GitHub container registry for free images. I don't like this kind of centralisation, but I least one can expect for Microsoft to have enough money to provide service for free without strings attached, just like they do with Git hosting.
- millerm 4y agoI suppose BitTorrent for Images should be a thing (again?) Discussions of decentralization and redundancy always come up in software/system design and development, but we seem to always gravitate to bottlenecks and full dependency on single entities for the tools we "need".
- Havoc 4y agoGood point. A dual system would be ideal. http to ensure coverage, bt to achieve network effects on the popular images. Presumably a few - nginx and what not - have a high %
- magicalhippo 4y agoMany (most?) BitTorrent clients support web seeding[1] by a regular HTTP server. A public registry could do web seeding, with bandwidth restrictions if needed, to ensure availability. [1]: https://en.wikipedia.org/wiki/BitTorrent#Web_seeding https://en.wikipedia.org/wiki/BitTorrent#Web_seeding
- zoobab 4y agoYou could even do some BT freeriding on top of multiple HTTP sources.
- bmitc 4y agoIt is my understanding that Microsoft has previously tried to purchase Docker. Despite me having problems with companies buying up each other, I wouldn't be surprised if Microsoft revisits, or already is revisiting, buying Docker. Being a heavy Visual Studio Code user, I have centered my personal development around Docker containers using VS Code's Devcontainer feature, which is a very, very nice way of developing. All I need installed is VS Code and Docker, and I can pull down and start developing any project. (I'm not there yet for all my personal projects, but that's where I'm headed.)
- boredumb 4y agoDocker had the ability to be baked into nearly every enterprise tech stack and extract money accordingly, instead they take time every 2 years to torment users. They will end up going down as one of the biggest missed plays in modern software.
- abdellah123 4y agoself hosting is the only alternative ... We cannot depend on the cloud anymore. This is not the first nor the last time something like this happens.
- jmac01 4y agoI havent used docker but my understanding is that dockerhub hosts docker images which are essentially just text files? Would that be something that cud just be migrated to another platform easily or does dockerhub do a lot of other things too?
- albert_e 4y agodockerfile is a text file spec on how to build a docker image. a container image (analogous to a VM snapshot) is built from a dockerfile. but dockers hub contains the actual images (that run into MBs and GBs) not just dockerfiles. most dockerfiles don't build an image from scratch. they start with a "FROM" keyword that references an existing pre-built image and then adds some layers of files and configuration on top. everytime you build a containerized app, your build scripts first pull down the latest pre-built base image referenced by your app's dockerfile. so a image registry like docker hub is core and essential for thousands of build pipelines and automation that run across thousands of companies globally. there are some alternatives like Amazon ECR, and private registries hosted by big companies on their own. but a lot of projects and pipelines still depend on public images of commonly used ones like Linux flavours and distros maintained by various teams.
- paxys 4y agoDockerfiles are text files. Docker images are entire OS file system snapshots (not exactly but close enough) built from those Dockerfiles. A single one can be hundreds of MBs or even multiple GBs in size.
- unilynx 4y agoIt seems to me that the only thing more devastating for a lot of developers would be npmjs.com blowing up like this because they desperately needed funding. But they got acquired by parties in no rush to profit off them Why didn't any of the big tech acquire Docker and their registry? They don't appear to be less interesting than npmjs considering technology or ecosystem. Did they resist being acquired and has the opportunity passed ?
- bambam24 4y ago[dead]
- ZunarJ5 4y ago1. I just started teaching myself Docker for my home server. How will this affect me? 2. What is a good alternative to Docker? Thanks!
- marvinblum 4y ago1. You probably won't be able to pull some of the images any longer and need to find an alternative host (ghcr.io instead of hub.docker.io for example) 2. Podman
- ZunarJ5 4y agoThank you!
- advancingu 4y agoAs I commented in yesterday's thread, this is not the first time Docker is pulling the plug on people with very short advance notice: See https://news.ycombinator.com/item?id=16665130 https://news.ycombinator.com/item?id=16665130 from 2018 Someone back then even wondered what would happen if such a change happened to Docker Hub https://news.ycombinator.com/item?id=16665340 https://news.ycombinator.com/item?id=16665340 and here we are today.
- Liberonostrud 4y agoWhat is the alternaive?
- yrro 4y agoGitHub container registries are free for open source projects. For now...
- roughly 4y agoThe ongoing Docker saga has convinced me I’m never, ever, ever making a product for developers.
- delfinom 4y agoWelcome to the bane of targeting a educated or skilled audience.
- nikolay 4y agoThey really want to go in vain, hated, and making people happy they're finally off their continuously degrading service and attitude! I get it, they are a commercial entity, but it seems that even they realize that they are in the mode of agony!
- coding123 4y agoThere are other repositories to put your images and fetch images, right?
- pmlnr 4y ago> if we don't pay up, systems will break for many free users. Yep. These things happen, which is why hosting a copy on your own gitea, website, etc is so important. > Start publishing images to GitHub Why, to have this repeated in a few years time?
- judge2020 4y ago> Yep. These things happen, which is why hosting a copy on your own gitea, website, etc is so important. ...which involves an ongoing cost anyways. Docker is tired of free hosting to everyone (unless they're a vetted Open Source project), so you're going to see projects either move to the next free solution or solicit donations/more donations specifically to support hosting an open access registry.
- irrational 4y agoWhat is the best replacement or alternate to Docker?
- akho 4y agoThe most Docker-shaped one is Podman. “Best” depends on what you do with it. I think the bigger issue here is not the lack of replacements, but the end of oh-so-convenient centralization in DockerHub.
- technick 4y agoDocker is shooting itself in the foot. Oddly I decided to put on the docker shirt from one of their 2016 hackathons today before reading the news. I'm embarrassed to own this shirt and will throw it away after today. RIP Docker, your former self will be missed while your current self will be loathed.
- 54656g3 4y agoWell I am thankful because I don't use Docker in my professional life but do in my personal life. I guess I will rebuild my system without Docker. It made things easy but I have no interest in trying to track bullshit like this as an end user. I guess Docker is as good as dead.
- mc4ndr3 4y agoI am confused by the meaning of Docker's announcement. They keep saying "organizations" will have Docker images deleted. Does that include personal FOSS images or not? Because the vast majority of Docker Hub images are uploaded by individual contributors, not "organizations." Too bad about their poor relationship with the FOSS community. I've applied to them for years, and actually merged some minor patches to Docker to help resolve a go dependency fiasco. Zero offers. I guess the next logical move is to republish any and all non-enterprise Docker images to a more flexible host like the GitHub registry.
- bombolo 4y ago> Cybersquat before a bad actor can I don't see why the duty of preventing this falls on the shoulders of the maintainers that are being kicked out to begin with. I don't publish on docker hub, but if they were in the process of kicking me out, I'd let the chip fall and let them deal with any eventual disaster.
- ixtli 4y agoProfit motive above all else is fundamentally incompatible with the social engine that powers the open source community. It always has been and always will be. I'm no longer surprised, but im still disappointed.
- unity1001 4y ago> Profit motive above all else is fundamentally incompatible with the social engine that powers the open source community. Its not. Freemium format works splendidly in various ecosystems, one of the biggest being WordPress. It enabled WP ecosystem to fund itself without VC or investor money and grow. Real indie growth. So its possible. Without the funding from its own userbase to sustain itself, Open Source projects just flop eventually. Few remain if they are way too big or if they can get corporate sponsors. Thats not being 'free'. Real freedom is in Open Source being funded by its users without the unreliable mechanism of donations.
- Animats 4y agoWhat do we do when Microsoft/Github pulls a similar trick?
- twblalock 4y agoIt was sad to see people defending Docker Desktop changing from free to paid licenses. Now Docker is charging for even more things that used to be free. The defenders are reaping what they have sown. Next time a company starts to charge for things that used to be free, remember not to encourage it, because that will only make it happen more. People don't like this and many of them are not going to trust Docker in the future.
- grumple 4y agoNothing a company does is free to them. To expect them to provide a free service at all, let alone one with high costs associated with it, is not reasonable. They don't owe the world free service, same for any other company.
- twblalock 4y agoWhen you offer something for free and then suddenly start charging for it, you are jerking around your customers -- especially when you do it with such confusing and incomplete communication as Docker has provided in this instance. This is effectively a long-term bait and switch. This is not ok.
- kuratkull 4y agoIf a company offers something for free, it's likely part of their business plan. However, if they start charging for that feature, users may feel uneasy. Digital Ocean offers a container repo for $5/month, so users may be upset about the perceived mismatch between price and features. Users not paying signals that the company has failed in its business strategy. Additionally, the repo hosting service has weak vendor lock-in, making it easy for users to switch providers. Businesses must be mindful of user feedback and work hard to retain customer loyalty in a competitive market.
- muhehe 4y agoCan someone recommend some simple "caching proxy for docker images"? Something where instead of docker/podman pull docker.io/something I would do docker/podman pull my.cache/something and it would do the rest. Official docker registry image is supposed to do this, but cannot mirror other repositories outside of dockerhub.
- jhoelzel 4y agoPlease dont forget that you can cache all these images in your own registry! you will still have to worry about how to get updates, but set up a private registry and deal with this on your on time! As a side node, Rancher desktop is good enough. Docker has repeatedly demonstrated that they just where the first ones and not by any means the best ones.
- rustyminnow 4y agoAny tips to running your own registry? e.g. what registry software/package do you use? I think when I looked into this in the past, I couldn't find anything suitable. A quick search now brings up https://hub.docker.com/_/registry https://hub.docker.com/_/registry, but considering the content of the article, not sure how I feel about it
- jhoelzel 4y agothis depends on how your setup is! for instance bigger clouds offer you private registry with your account usually. Then there is the github container registry: https://github.blog/2020-09-01-introducing-github-container-registry/ https://github.blog/2020-09-01-introducing-github-container-... one integrated for self hosted gitlab: https://docs.gitlab.com/ee/user/packages/container_registry/ https://docs.gitlab.com/ee/user/packages/container_registry/ and of couse docker themselves have a container for a private registy you can run. the question is not so much how but where you want it to be and how big the images are that you are using! Hope this helps otherwise hit me up on linkedin (in my profile) and we can figure something out
- communism 4y agosocialize Docker!
- nathantotten 4y agoIts pretty easy to setup a Github Action that mirrors images to a private registry. We use this to mirror to GCP Artifact registry: https://zuplo.com/blog/2023/03/15/mirroring-docker-images-with-github-actions https://zuplo.com/blog/2023/03/15/mirroring-docker-images-wi...
- zxcvbn4038 4y agoThe OP goes through a lot of trouble to obscure they are asking for $35 a month, which honestly I think most people can afford, even if its open source software they develop only out of kindness. So I'm not really buying that argument. That said I don't really want to reward Docker for writing themselves in as the distribution hub for all things docker and then more or less extorting money from people. I think the solution is don't give Docker a dime, just run your own registry in Digital Ocean, thats $5/m. If we can front the registry server with a CDN then its potentially free.
- TheRealDunkirk 4y ago> I don't really want to reward Docker for writing themselves in as the distribution hub for all things docker and then more or less extorting money from people. I finally bit the bullet and paid for YouTube Premium. The ad "experience" on YouTube has become so abysmal and unblockable, that to use it at all really forces you into it. I had a hard time expressing why this was so aggravating -- considering that I see literally 5 other streaming services I pay for on the same launch screen -- but this really nails it. It's the same monopolize-for-free-and-then-charge-and-extract-all-rent-forever move at the heart of every digital service now.
- zxcvbn4038 4y agoI just ignore the ads on youtube. I don't own any animals so the pet food ads are a miss. I don't take any medicines so I'm not buying those either. I work remotely so I'm not going to buy a new car. I already have a VPN so those are all pointless also. I think that is all they try to advertise to me. Oh yeah! I will never play Rage Shadow Legends in this life or the next. Give it up!
- 999900000999 4y agoEhh. How much money should I spend on my hobbies, 35$ isn't a lot, but I'd rather not waste it. Plus instead of just grabbing the image I come up with to do x or y, you'll have to implement it yourself. Duplicate this hundreds or thousands of times.
- PedroBatista 4y agoThe truth is Docker ( the company ) could never capitalize the success of their software. They clearly need the money and I have the impression things have not been "great" in the last couple of years. ( regardless of reasons ) The truth is also the fact that most people/organizations never paid a dime for the software or the service, and I'm talking about Billion dollar organizations that paid ridiculous amounts of money for both "DevOps Managers" and consultants but the actual source of the images they pull are either from "some dude" or some opensource orgs. I get that there will be many "innocent victims" of the circumstances but most people who are crying now are the same ones who previously only took, never gave and are panicking because as Warren Buffett says: "Only when the tide goes out do you discover who's been swimming naked." And there are a lot of engineering managers and organizations who like to brag with expressions like "Software supply chains" and we'll find out who has been swimming with their willy out.
- foxandmouse 4y agoI think it's also a product of the larger economic environment. The old model of grow now and profit later seems to be hitting a wall, leaving companies scrambling to find profit streams in their existing customer base not realizing that doing so will hinder their growth projection leading to more scrambling for profit. It's a vicious cycle, but when you don't grow in a sustainable way it seems unavoidable.
- projectazorian 4y agoSad but unsurprising; Docker has been slowly transforming into a traditional enterprise software company for quite a while now. They really squandered their potential.
- sigwinch28 4y agoThis is incredibly frustrating to deal with because of how deeply the registry name is baked into Dockerfiles and image names. We end up "mirroring" our base images but there's some disconnect internally between "oh, yeah, our harbor.company/library/debian:bullseye is some random pull of library/debian:bullseye from the docker hub". Imagine if you needed to change mirrors for `apt` and as part of that process you had to change all of the names of installed packages because the hostname of the mirror formed part of the package's identifier.
- worik 4y agoSucked in. I am sorry so many people got caught out by this. But it is an regular pattern in tech. Cory Doctorow coined a word for this: enshittification. https://pluralistic.net/tag/enshittification/ https://pluralistic.net/tag/enshittification/
- matt3210 4y agoTime to switch to Podman
- tannhaeuser 4y agoOr, you know, just install the fscking app on a Linux VM using the app's native installation method, and be done with it? Oh no, we can't have that, must be using k8s, downloading the Internet, and using a zoo of incidental tools and "registries" to download your base images over http (which are STILL either Debian- or RedHat-based, which is the entire reason of the distro abstraction circus to begin with) is SO MUCH EASIER lol.
- didip 4y agoDocker should have sold to Microsoft. Whatever they have been doing recently is a mistake.
- VadimBauer 4y agoMany people are quite upset. But on the other hand, how many years could this work? Petabytes of data and traffic. When we started to offer an alternative to Docker Hub in 2015-2016 with container-registry.com, everyone was laughing at us. Why are you doing that, you are the only one, Docker Hub is free or almost free. Owning your data and having full control over the distribution is crucial for every project, event open source.
- MarkSweep 4y agoOne annoyance with how docker images are specified is they include the location where they are stored. So if you want to change where you store you image you break everyone. I wonder if what regsitry.k8s.io does could be generalized: https://github.com/kubernetes/registry.k8s.io/blob/main/cmd/archeio/docs/request-handling.md https://github.com/kubernetes/registry.k8s.io/blob/main/cmd/... The idea is the depending on which cloud you are pulling the image from, they will use the closest blob store to service the request. This also has the effect that you could change the source of truth for the registry without breaking all Dockerfiles.
- synthc 4y agoAnother reminder that VC-funded hosting does not last forever. Self-host your mission critical dependencies folks!
- aakash_test 4y ago[flagged]
- rvz 4y agoTough. Should have self-hosted rather than get yourself locked in. (Again) > Start publishing images to GitHub > GitHub's Container Registry offers free storage for public images. It doesn't require service accounts or long-lived tokens to be stored as secrets in CI, because it can mint a short-lived token to access ghcr.io already. Even after the montage of outages. Still suggesting to re-centralizing back to GitHub as the solution is really asking for more disappointment. [0] Once again, we have learned nothing. [0] https://news.ycombinator.com/item?id=34843847 https://news.ycombinator.com/item?id=34843847 [1] https://news.ycombinator.com/item?id=22867803 https://news.ycombinator.com/item?id=22867803
- acd 4y agoSince Silicon Valley bank with fdic takeover, the "free" services will go away. Free central bank money is gone due to higher inflation and interest rates. Free open source tiers are going away.
- cookiengineer 4y agoDoes anybody know whether there could be something like an open/libre container registry? Maybe the cloud native foundation or the linux foundation could provide something like this to prevent vendor lock-ins? I was coincidentially trying out harbor again over the last days, and it seems nice as a managed or self-hosted alternative. [1] after some discussions we probably gonna go with that, because we want to prevent another potential lock-in with sonarpoint's nexus. Does anybody have similar migration plans? The thing that worries me the most is storage expectations, caching and purging unneeded cache entries. I have no idea how large/huge a registry can get or what to expect. I imagine alpine images to be much smaller than say, the ubuntu images where the apt caches weren't removed afterwards. [1] https://goharbor.io https://goharbor.io
- jillesvangurp 4y agoIt's all open source software. Stupidly simple and easy to host. It's a low value commodity thing without mucb value that anyone can trivially self host. All you need is a docker capable machine (any linux machine basically) and some disk space to host the images. And a bit of operational stuff like monitoring, backups, etc. So there's an argument to be made for using something that's there, convenient, and available but not too costly. Which until recently was dockerhub. But apparently they are happy to self destruct and leave that to others. They should take a good look at Github. If only for the simple reason that it's a natural successor to what they are offering (a free hub to host software for the world). Github actually has a container registry (see above for why). And of course the vast majority of software projects already uses them for storing their source files. And they have github actions for building the docker images from those source files. Unlike dockerhub, it's a complete and fully integrated solution. And they are being very clever about their pricing. Which is mostly free and subsidized by paid features relevant to those who get the most value out of them. I like free stuff of course. But I should point out that I was actually a paying Github user before they changed their pricing to be essentially free (for small companies and teams). I love that of course but I was paying for that before and I think they were worth the money. And yes, it was my call and I made that call at the time. Also worth pointing out that Github actions builds on top of the whole docker eco system. It's a valuable service that is built on top of Docker. Hosting the docker images is the least valuable thing. And it's the only thing dockerhub was ever good for. Not anymore apparently. Unlike dockerhub, Github figured out how to create value here.
- anon4242 4y agoI wonder if this is related to the large number of more and more desperate sounding emails I've been getting from a Docker sales rep. Are they bleeding and trying desperately to find additional revenue streams?
- dadrian 4y agoI migrated to Github Container Registry in less time than it took to read this blog.
- yencabulator 4y agoContainer images should just be files at a URL, anything else just leads to this sort of rent-seeking.
- imhoguy 4y agoIPFS or Torrents would be ideal way to host and distribute docker images as every layer is content addressable therefore read-only. I don't mind to seed any public images I keep running on my server.
- mcdermott 4y agoSwitched to Multipass (https://multipass.run/ https://multipass.run/) and run docker with portainer on my Mac there.
- kazinator 4y agoIronically, Docker wouldn't exist without Linux kernel support for containers.
- Simran-B 4y agoGoogle's crane tool to efficiently copy images from Docker Hub to e.g. GitHub's Container Registry, in case you want to migrate: https://github.com/google/go-containerregistry/tree/main/cmd/crane#readme https://github.com/google/go-containerregistry/tree/main/cmd...
- jiggawatts 4y agoMicrosoft’s Azure Container Registry now has a check box feature to “vendor” external container images. This takes more space obviously but will protect systems from critical base images suddenly disappearing or becoming rate-limited.
- pxc 4y agoMaybe the process of rerunning upstream Dockerfiles in an attempt to recover lost images and then, in many cases, getting back substantially different images will help illustrate to more teams the difference between what Docker itself achieves (easily distributable disk images, which are very useful) and reproducibility. (Hopefully most of those differences end up being unimportant and little to no tweaks to the tools using those images is required, though.)
- thrashh 4y agoYou know what I love about Java’s library ecosystem? You configure your project to use the de-facto ones… OR you configure your project (not your system’s user profile!) to use your own internal registry/repo And all the repo software supports pull-through from every other repo, so you cache all your dependencies however you want and have full control over everything. Why does pretty much no other ecosystem do this?
- mdavidn 4y agoCargo and NPM and PyPi and RubyGems and likely others all definitely support this too.
- porker 4y agoTweet on the impact of this on the Elixir project: https://mobile.twitter.com/josevalim/status/1635767176769462272 https://mobile.twitter.com/josevalim/status/1635767176769462...
- sneak 4y agoThe fact that this was allowed to be carried out in this manner means, in my view, that the capital-D Docker brand is basically toast now. There is no set of subsequent decisions that allows serious people to trust them.
- scoopr 4y agoI'm not too familiar with docker infra at large, but could the docker hub in principle act just as a namespace such that the opensource projects could have the images hosted elsewhere, but docker hub just redirects them there, so saving on the bandwidth on those? I suppose there are hand-wavy business reasons not to do that, but somehow I feel that would: 1. Still keep themselves in the loop and relevant, owning the namespace/hub/main registry 2. Offset the costs of those that they don't want to deal with (push them to ghcr or whatever) 3. Preserve some notion of goodwill in not braking the whole dockerverse
- aurelien 4y agoThis is cool and I explain why: - cool because advocate for a proprietary technology hidden behind Open Source and Free Software purism is a fallacy - cool because by theses actions you improve their business against users freedoms And most of all, Cool because I hope you and other will take the time to ask yourself before advocating a technology: Is this technology good for my rights and by the way for knowledge of all.
- tyranron 4y agoFrom the article: > If you are able to completely delete your organisation, then you could re-create it as a free personal account. That should be enough to reserve the name to prevent hostile take-over. Has Docker forgotten Remember leftpad? > > This is unlikely that large projects can simply delete their organisation and all its images. > > If that's the case, and you can tolerate some downtime, you could try the following: > - Create a new personal user account > - Mirror all images and tags required to the new user account > - Delete the organisation > - Rename the personal user account to the name of the organisation Seems like no? We cannot rename personal accounts on Docker Hub in 2023. There is no such feature in account settings, and here is the related issue: https://github.com/docker/roadmap/issues/44 https://github.com/docker/roadmap/issues/44 So, at the moment, any public organization images are doomed to be lost, if they won't pay.
- sickill 4y agoYeah, the procedure outlined in the article is not going to work so don't even attempt it. No way to rename personal account right now.
- sigwinch28 4y agoIf you are using containerd then you might find the "hosts" section of the configuration file useful: https://github.com/containerd/containerd/blob/main/docs/hosts.md https://github.com/containerd/containerd/blob/main/docs/host... You could mirror the images to another registry of your choosing and then use containerd configuration as a stopgap until you update all of your `FROM`/`image` fields.
- al_be_back 4y agosadly, cloud providers (GCE, AWS etc) make it too convenient and cheap to host/manage container/package registries. You also have github, gitlab offering similar services, free or cheap, eating further into Docker's market. I don't see how they can offer Free accounts to Orgs unless they've a steady-growing paying-customer base to offset running costs. Unless they massively restrict team size, image size, number of projects, throttle connections - costs would spiral out of control.
- deleted 4y ago[deleted]
- dnsmichi 4y agoThanks for the many insights in this discussion. I've collected them and added more analysis, inventory and mitigation tips in a new blog post. (GitLab team member here) https://about.gitlab.com/blog/2023/03/16/how-gitlab-can-help-mitigate-deletion-open-source-images-docker-hub/ https://about.gitlab.com/blog/2023/03/16/how-gitlab-can-help... The blog post includes a Python script to programmatically search CI/CD configurations in GitLab, shows the Dependency Proxy and container registry possibilities, and discusses more ideas around custom Docker images (Dockerfile: FROM), Kubernetes/IaC image usage, policies and Observability. Hope sharing this knowledge helps :-)
- deleted 4y ago[deleted]
- Dowwie 4y agoIt's going to cost companies a lot more money to migrate their docker dependencies than simply pay their open source dependency maintainers to keep the org intact. Might as well become a project sponsor! This could be the best thing to happen to open source projects if the argument is framed correctly. You don't solve a cost problem by pursuing a more costly alternative.
- xialvjun 4y agoWe need Nostr like protocols.
- saddist0 4y agoDiscord pricing model has been so much cool when compared to these reckless move by Docker. Imagine the following: [1] Ultra-bad rate-limiting by default to all public images. [2] X$/month "boost" to have relaxed rate-limit for yourself & contributing some to the community. [3] The popular the repository is, the higher rate limit it get. [4] After Y$/month, Docker just suggest other repositories to "support", so the $$ tickle down the whole ecosystem. [5] Simple feature which allows you to quickly view public images you are dependent on. And which one you/your organisation should support to. But hey wait... welcome to the world run by VCs and shitty PM roles. :)