8 ms·

The OCI Distribution Spec is not great, it does not read like a specification that was carefully designed. > According to the specification, a layer push must

The OCI Distribution Spec is not great, it does not read like a specification that was carefully designed. > According to the specification, a layer push must happen sequentially: even if you upload the layer in chunks, each chunk needs to finish uploading before you can move on to the next one. As far as I've tested with DockerHub and GHCR, chunked upload is broken anyways, and clients upload each blob/layer as a whole. The spec also promotes `Content-Range` value formats that do not match the RFC7233 format. (That said, there's parallelism on the level of blobs, just not per blob) Another gripe of mine is that they missed the opportunity to standardize pagination of listing tags, because they accidentally deleted some text from the standard [1]. Now different registries roll their own. [1] https://github.com/opencontainers/distribution-spec/issues/461#issuecomment-1701554264 https://github.com/opencontainers/distribution-spec/issues/4...

mschuster91 2y ago
On top of that, it's either the OCI spec that's broken or it's just AWS being nuts, but unlike GitLab and Nexus, AWS ECR doesn't support automatically creating folders (e.g. "<acctid>.dkr.ecr.<region>.amazonaws.com/foo/bar/baz:tag"), it can only do flat storage and either have seriously long image names or tags. Yes you can theoretically create a repository object in ECR in Terraform to mimic that behavior, but it sucks in pipelines where the result image path is dynamic - you need to give more privileges to the IAM role of the CI pipeline than I'm comfortable with, not to mention that I don't like any AWS resources managed outside of the central Terraform repository. [1] https://stackoverflow.com/questions/64232268/storing-images-in-aws-ecr-using-namespaces https://stackoverflow.com/questions/64232268/storing-images-...
- hanikesn 2y ago
  That's seem standard AWS practice. Implement a new feature so you can check the box, but in practice it's a huge pain to actually use.
  - judge2020 2y ago
    It’s not as bad as Azure is (was?) with IPv6: https://news.ycombinator.com/item?id=29327773 https://news.ycombinator.com/item?id=29327773
    - X-Istence 2y ago
      Azure's IPv6 implementation is still flawed and still broken. That has not changed.
- xyzzy_plugh 2y ago
  IIRC it's not in the spec because administration of resources is out of scope. For example, perhaps you offer a public repository and you want folks to sign up for an account before they can push? Or you want to have an approval process before new repositories are created? Regardless it's a huge pain that ECR doesn't support this. Everybody I know of who has used ECR has run into this. There's a long standing issue open which I've been subscribed to for years now: https://github.com/aws/containers-roadmap/issues/853 https://github.com/aws/containers-roadmap/issues/853
eadmund 2y ago
> The OCI Distribution Spec is not great, it does not read like a specification that was carefully designed. That’s par for everything around Docker and containers. As a user experience Docker is amazing, but as technology it is hot garbage. That’s not as much of a dig on it as it might sound: it really was revolutionary; it really did make using Linux namespaces radically easier than they had ever been; it really did change the world for the better. But it has always prioritised experience over technology. That’s not even really a bad thing! Just as there are tons of boring companies solving expensive problems with Perl or with CSVs being FTPed around, there is a lot of value in delivering boring or even bad tech in a good package. It’s just sometimes it gets sad thinking how much better things could be.
- belter 2y ago
  Was it really so amazing? Here is half a Docker implementation, in about 100 lines of Bash... https://github.com/p8952/bocker https://github.com/p8952/bocker
  - samlinnfer 2y ago
    The other half is the other 90%. Looking at it now, it won't even run in the latest systemd, which now refuses to boot with cgroups v1. Good luck even accessing /dev/null under cgroups v2 with systemd.
  - redserk 2y ago
    Lines of code is irrelevant. Docker is important because: 1) it made a convenient process to build a “system” image of sorts, upload it, download it, and run it. 2) (the important bit!) Enough people adopted this process for it to become basically a standard Before Docker, it wasnt uncommon to ship some complicated apps in VMs. Packaging those was downright awful with all of the bespoke scripting needed for the various steps of distribution. And then you get a new job? Time to learn a brand new process.
    - Twirrim 2y ago
      I guess Docker has been around long enough now that people have forgotten just how much of an absolute pain it used to end up being. Just how often I'd have to repeat the joke Them: "Well, it works on my machine!" Me: "Great, back up your email, we're putting your laptop in production..."

mschuster91 2y ago

On top of that, it's either the OCI spec that's broken or it's just AWS being nuts, but unlike GitLab and Nexus, AWS ECR doesn't support automatically creating folders (e.g. "<acctid>.dkr.ecr.<region>.amazonaws.com/foo/bar/baz:tag"), it can only do flat storage and either have seriously long image names or tags. Yes you can theoretically create a repository object in ECR in Terraform to mimic that behavior, but it sucks in pipelines where the result image path is dynamic - you need to give more privileges to the IAM role of the CI pipeline than I'm comfortable with, not to mention that I don't like any AWS resources managed outside of the central Terraform repository. [1] https://stackoverflow.com/questions/64232268/storing-images-in-aws-ecr-using-namespaces https://stackoverflow.com/questions/64232268/storing-images-...

hanikesn 2y ago
That's seem standard AWS practice. Implement a new feature so you can check the box, but in practice it's a huge pain to actually use.
- judge2020 2y ago
  It’s not as bad as Azure is (was?) with IPv6: https://news.ycombinator.com/item?id=29327773 https://news.ycombinator.com/item?id=29327773
  - X-Istence 2y ago
    Azure's IPv6 implementation is still flawed and still broken. That has not changed.
xyzzy_plugh 2y ago
IIRC it's not in the spec because administration of resources is out of scope. For example, perhaps you offer a public repository and you want folks to sign up for an account before they can push? Or you want to have an approval process before new repositories are created? Regardless it's a huge pain that ECR doesn't support this. Everybody I know of who has used ECR has run into this. There's a long standing issue open which I've been subscribed to for years now: https://github.com/aws/containers-roadmap/issues/853 https://github.com/aws/containers-roadmap/issues/853

eadmund 2y ago

> The OCI Distribution Spec is not great, it does not read like a specification that was carefully designed. That’s par for everything around Docker and containers. As a user experience Docker is amazing, but as technology it is hot garbage. That’s not as much of a dig on it as it might sound: it really was revolutionary; it really did make using Linux namespaces radically easier than they had ever been; it really did change the world for the better. But it has always prioritised experience over technology. That’s not even really a bad thing! Just as there are tons of boring companies solving expensive problems with Perl or with CSVs being FTPed around, there is a lot of value in delivering boring or even bad tech in a good package. It’s just sometimes it gets sad thinking how much better things could be.

belter 2y ago
Was it really so amazing? Here is half a Docker implementation, in about 100 lines of Bash... https://github.com/p8952/bocker https://github.com/p8952/bocker
- samlinnfer 2y ago
  The other half is the other 90%. Looking at it now, it won't even run in the latest systemd, which now refuses to boot with cgroups v1. Good luck even accessing /dev/null under cgroups v2 with systemd.
- redserk 2y ago
  Lines of code is irrelevant. Docker is important because: 1) it made a convenient process to build a “system” image of sorts, upload it, download it, and run it. 2) (the important bit!) Enough people adopted this process for it to become basically a standard Before Docker, it wasnt uncommon to ship some complicated apps in VMs. Packaging those was downright awful with all of the bespoke scripting needed for the various steps of distribution. And then you get a new job? Time to learn a brand new process.
  - Twirrim 2y ago
    I guess Docker has been around long enough now that people have forgotten just how much of an absolute pain it used to end up being. Just how often I'd have to repeat the joke Them: "Well, it works on my machine!" Me: "Great, back up your email, we're putting your laptop in production..."