3 ms·

I don't do a ton with Docker outside dev tooling, but I have never understood why private container registries even exist? It just smells like rent seeking. Wha

by donatj 2y ago

I don't do a ton with Docker outside dev tooling, but I have never understood why private container registries even exist? It just smells like rent seeking. What real advantage does it provide over say just generating some sort of image file you manage yourself, as you please?

JackSlateur 2y ago
You will probably have images that you will not share to the world. Said images will probably be made available to your infrastructure (k8s clusters, CI/CD runners etc). So you have to either build your own registry or pay someone to do it for you. Of course, if you use images for dev only, all of that are worthless and you just store your images on your dev machine
- regularfry 2y ago
  Also if your infrastructure is within AWS, you want your images to also be within AWS when the infrastructure wants them. That doesn't necessarily imply a private registry, but it's a lot less work that way.
figmert 2y ago
You don't have to use it. You can use docker save and docker import: docker save alpine:3.19 > alpine.tar docker load < alpine.tar But now I have to manage that tar file, have all my systems be aware of where it is, how to access it, etc. Or, I could just not re-invent the wheel and use what docker already has provided.
- deleted 2y ago
  [deleted]
danmur 2y ago
Companies send young engineers (and older engineers who should know more but don't) to AWS and Microsoft for "cloud certification". They learn how to operate cloud services because thats what benefits AWS and MS, so thats what their solutions use. It's a difficult uphill battle to get people interested in how things work under the hood, which is what you need in order to know you can do things like easily host your own package repositories.
- figmert 2y ago
  This is a odd assessment. I agree certifications aren't all that, but having people learn them isn't about that. It's more that people don't feel like reinventing the wheel at every company, so they can focus on the real work, like shipping the application they've written. So companies like AWS, Docker etc, write things, abstract things away, so someone else doesn't have to redo the whole thing. Yes I can host my packages and write tooling around it to make it easy. But JFrog already has all the tooling around it, and it integrates with current tooling. Why would I write the whole thing again?
  - danmur 2y ago
    I am responding to this part of the parent comment: > I don't do a ton with Docker outside dev tooling, but I have never understood why private container registries even exist? You know the options and have made a conscious choice: > Yes I can host my packages and write tooling around it to make it easy. But JFrog already has all the tooling around it, and it integrates with current tooling. Why would I write the whole thing again? So presumably you are not the kind of people I was talking about. EDIT: I'm also assuming by the rent seeking part that the parent is referring to paid hosted services like ECR etc.
mcraiha 2y ago
Private (cloud) registries are very useful when there are mandatory AuthN/AuthZ things in the project related to the docker images. You can terraform/bicep/pulumi everything per environment.
arccy 2y ago
and how do you manage them? you use the same tooling that exists for all public images by running a container registry.
alemanek 2y ago
Integration with vulnerability scanning utilities and centralized permissions for orgs are nice benefits.
vel0city 2y ago
Why have a code repository instead of just emailing files around? Because you want a central store someplace with all the previous versions that is easily accessible to lots of consumers. I don't want to build my app and then have to push it to every single place that might run it. Instead, I'll build it and push it to a central repo and have everything reference that repo. > It just smells like rent seeking. You don't need to pay someone to host a private repo for you. There are lots of tools out there so you can self-host.

by donatj 2y ago

JackSlateur 2y ago

You will probably have images that you will not share to the world. Said images will probably be made available to your infrastructure (k8s clusters, CI/CD runners etc). So you have to either build your own registry or pay someone to do it for you. Of course, if you use images for dev only, all of that are worthless and you just store your images on your dev machine

regularfry 2y ago
Also if your infrastructure is within AWS, you want your images to also be within AWS when the infrastructure wants them. That doesn't necessarily imply a private registry, but it's a lot less work that way.

figmert 2y ago

You don't have to use it. You can use docker save and docker import: docker save alpine:3.19 > alpine.tar docker load < alpine.tar But now I have to manage that tar file, have all my systems be aware of where it is, how to access it, etc. Or, I could just not re-invent the wheel and use what docker already has provided.

deleted 2y ago
[deleted]

danmur 2y ago

Companies send young engineers (and older engineers who should know more but don't) to AWS and Microsoft for "cloud certification". They learn how to operate cloud services because thats what benefits AWS and MS, so thats what their solutions use. It's a difficult uphill battle to get people interested in how things work under the hood, which is what you need in order to know you can do things like easily host your own package repositories.

figmert 2y ago
This is a odd assessment. I agree certifications aren't all that, but having people learn them isn't about that. It's more that people don't feel like reinventing the wheel at every company, so they can focus on the real work, like shipping the application they've written. So companies like AWS, Docker etc, write things, abstract things away, so someone else doesn't have to redo the whole thing. Yes I can host my packages and write tooling around it to make it easy. But JFrog already has all the tooling around it, and it integrates with current tooling. Why would I write the whole thing again?
- danmur 2y ago
  I am responding to this part of the parent comment: > I don't do a ton with Docker outside dev tooling, but I have never understood why private container registries even exist? You know the options and have made a conscious choice: > Yes I can host my packages and write tooling around it to make it easy. But JFrog already has all the tooling around it, and it integrates with current tooling. Why would I write the whole thing again? So presumably you are not the kind of people I was talking about. EDIT: I'm also assuming by the rent seeking part that the parent is referring to paid hosted services like ECR etc.

mcraiha 2y ago

Private (cloud) registries are very useful when there are mandatory AuthN/AuthZ things in the project related to the docker images. You can terraform/bicep/pulumi everything per environment.

arccy 2y ago

and how do you manage them? you use the same tooling that exists for all public images by running a container registry.

alemanek 2y ago

Integration with vulnerability scanning utilities and centralized permissions for orgs are nice benefits.

vel0city 2y ago

Why have a code repository instead of just emailing files around? Because you want a central store someplace with all the previous versions that is easily accessible to lots of consumers. I don't want to build my app and then have to push it to every single place that might run it. Instead, I'll build it and push it to a central repo and have everything reference that repo. > It just smells like rent seeking. You don't need to pay someone to host a private repo for you. There are lots of tools out there so you can self-host.