19 ms·

Docker limits unauthenticated pulls to 10/HR/IP from Docker Hub, from March 1

• vednig 2y ago
  This will heavily impact the business relying on Docker for Teams, or Teams using unauthenticated systems when deploying or testing.
  • darkwater 2y ago
    10 pulls per hour per IP will even impact my homelab deployment if I'm not updating for a few weeks and I bump version of every software I run at once.
    • tucnak 2y ago
      If you're homelab is proper, you likely own a /56 range, also known as 256x /64 which is what they're limiting. I've always known my prefix would come in handy! Now, I only need to work out how to make it work without having to define all 256 network interfaces.
      • bolognafairy 2y ago
        [dead]
      • ralgozino 2y ago
        Or you set up a mirror and don't abuse a free service
        • kelnos 2y ago
          It's hard to call it "abuse" when Docker has been allowing -- and IMO tacitly encouraging -- this usage pattern for most/all of their existence. I get that bandwidth is expensive, but this feels a bit like the usual "make it free to get lots of users, and then start charging when everyone is locked in" plan. If they really just want to reduce their own costs, they should be evangelizing the use of a caching proxy, and providing a super easy way for people to set one up, both on the server and client side. (Maybe they already do this; I haven't looked.)
          • ralgozino 2y ago
            Sure, they were encouraging usage of the docker hub, but it's been at least a couple of years since they started pushing on the other way, when they introduced the first rate-limits. If everybody did a fair-use of the Docker Hub maybe we wouldn't have the rate-limits in the first place? But I think we all learned that won't be happening in the open Internet. Setting up a pull-through cache is pretty straight-forward, you can find the instructions in Docker's documentation: https://docs.docker.com/docker-hub/image-library/mirror/ https://docs.docker.com/docker-hub/image-library/mirror/
            • aragilar 2y ago
              See my comment above for the numbers (https://news.ycombinator.com/item?id=43127004 https://news.ycombinator.com/item?id=43127004), but the free limits haven't changed in magnitude, rather they've reduced how bursty the requests can be (which is somewhat interesting, in that for the free levels you'd expect the usage to be more bursty, and the more paid levels to be more consistent given more workers and more tooling happening at all hours).
          • unhingedlife 2y ago
            This is obviously the first time a big Silicon Valley company took back the free lunch and slapped a price tag on it. How could we have ever learned our lesson before this?
        • theshrike79 2y ago
          Do you have any pointers for a drop-in docker hub mirror I could install? Something that doesn't require me to go through 50+ container setups and manually move every one of them to use my custom proxy?
        • darkwater 2y ago
          Which would help exactly ZERO in my homelab scenario...
        • tucnak 2y ago
          To accomplish what exactly? The mirror would be similarly limited.
        • unhingedlife 2y ago
          [flagged]
      • darkwater 2y ago
        Sorry, my homelab is clearly not proper. I have a sad IPv4 /32, in a residential IP block.
        • tucnak 2y ago
          Many ISP's provide /56 or at least /64 these days, but at any rate you can always get some from cloud providers and use Wireguard to tunnel the rest... There really isn't much excuse for not supporting IPv6 at homelab scale.
• denysvitali 2y ago
  After I read this my immediate reaction was: I need to setup a Mutating Admission Webhook on my Kubernetes cluster to automatically rewrite all the Docker Hub images references to GCR's mirror. A quick Google search resulted in this [1]: then I realized that the author of this project is pretty much the company I work for. Wow, such a small world. [1]: https://github.com/Sqooba/k8s-mutate-image-and-policy-webhook https://github.com/Sqooba/k8s-mutate-image-and-policy-webhoo...
• inemesitaffia 2y ago
  Do they support user side caching? Something like steamcache
• yencabulator 2y ago
  A big part of the problem is that Docker has insisted on there being a "registry". In a better, more open, world, a container image would just be a thing fetched over HTTPS from anywhere that can serve large-ish files.
  • Havoc 2y ago
    Docker does run over https if memory serves
    • yencabulator 2y ago
      In the sense that almost everything does these days. In a better world, container images would be just plain static files any web server can serve.
• Havoc 2y ago
  Not even March yet and I’m running into issues. Im on a static IP so no NAT and it’s still asking for auth on like the second pull. Will need to find a way to kick docker.io to the curb. Ridiculous
• CaptainFever 2y ago
  Is it just me, or is this really low, especially since one Docker Compose can have multiple pulls? This also sounds like it would be impossible to use Docker behind a NAT or a VPN, when unauthenticated.
  • miohtama 2y ago
    It's quite simple to just to create a Docker Hub account for your local dev and server.
    • kelnos 2y ago
      And then you get 40 pulls per hour, which is a bit more, to be sure, but still isn't that many.
      • mmbleh 2y ago
        40/hour is higher than the current limits for authenticated free users.
      • baq 2y ago
        If it isn’t much for you you’re probably getting enough value to just pay for it.
• panny 2y ago
  Okay, so I guess I'm running my own docker repo and builds now. So long and thanks for all the fish. edit: Oh, per hour. I thought that was per MONTH. Okay, I can survive with this, but it's still puts me on notice. Need to leave dockerhub sooner than later.
  • bolognafairy 2y ago
    [dead]
  • Helmut10001 2y ago
    Gitlab Registry is a good alternative and easy to self-host.
  • remram 2y ago
    It's not that much lower than the current limit of 100 per 6 hours.
• mrweasel 2y ago
  The 10 pulls per IP per hour isn't my main concern. 40 pulls per hour for an authenticated user may be a little low, if you're trying out something new. The unauthenticated limit doesn't bother me as much, though I was little upset when I first saw it. Many business doesn't bother setting up their own registry, even though they should, nor do they care to pay for the service. I suspect that many doesn't even know that Docker can be used without Docker Hub. These are the freeloaders Docker will be targetting. I've never worked for company that was serious about Docker/Kubernetes and didn't run their own registry. One major issue for Docker is that they've always ran a publicly available registry, which is the default and just works. So people have just assumed that this was how Docker works and they've never bothered setting up accounts for developers nor production systems.
  • crimsonnoodle58 2y ago
    We run our own registry for our containers, but we don't for images from docker.io, quay.io, mcr.microsoft.com, etc. Why would we need to? It obviously seems now we do.
    • baq 2y ago
      > Why would we need to? It obviously seems now we do. You should also run your own apt/yum, npm, pypi, maven, whatever else you use, for the same reasons. At a certain scale it's just prudent engineering.
      • black3r 2y ago
        at a certain scale yes... but a company with 10 developers in a single office is far from that scale...
        • baq 2y ago
          10 developers is a couple hundred bucks per month...
    • mrweasel 2y ago
• jensenbox 2y ago
  While not a great solution you can set one of these up on your network: https://docs.docker.com/docker-hub/image-library/mirror/#solution https://docs.docker.com/docker-hub/image-library/mirror/#sol... A giving person could also set one of these up publicly facing and share it out.
  • notpushkin 2y ago
    Google has one: { "registry-mirrors": ["https://mirror.gcr.io"] }
    • rsyring 2y ago
      More details: https://cloud.google.com/artifact-registry/docs/pull-cached-dockerhub-images https://cloud.google.com/artifact-registry/docs/pull-cached-...
    • bmicraft 2y ago
      Having gcr.io and ghcr.io both be a thing is kinda funny to me, almost like google typo-squatting github.
      • homebrewer 2y ago
        JFYI, % whois gcr.io | grep 'Creation Date' Creation Date: 2014-11-17T19:32:25Z % whois ghcr.io | grep 'Creation Date' Creation Date: 2020-04-16T16:48:05Z
• zspitzer 2y ago
  This ain't great for Github Actions, as PRs might now fail as there are no secrets available, randomly depending on your runner's IP Also it still takes some gymnastics to optionally support docker creds in a workflow https://github.com/orgs/community/discussions/131321 https://github.com/orgs/community/discussions/131321
  • MrBuddyCasino 2y ago
    OTOH, I don't understand by the big cloud platforms don't support caching, or at least make it easy. Azure pulling container dependencies on every build just feels rude.
    • mmbleh 2y ago
      These platforms do cache quite a bit. It's just that there is a very high volume of traffic and a lot of it does update pretty frequently (or has to check for updates)
      • MrBuddyCasino 2y ago
        Are you saying they cache transparently? Because I haven't seen that mentioned in the docs.
    • martypitt 2y ago
      Gitlab does this, and it works nicely
      • terminalbraid 2y ago
        Seconding, though it does require some setup at least for self-hosted. Gitlab also has a full container registry built in, so it's not difficult to pull the image you want, push it to gitlab, and reference that going forward.
    • hahn-kev 2y ago
      Yeah I don't get why I have to setup caching myself for this kind of thing. Like wouldn't it be more efficient to do it lower down in their infra anyway?
• crimsonnoodle58 2y ago
  10 pulls an hour is wild. There's no way we can wait hours and hours for work clusters to rebuild. Even just daily updates to containers will be over 10. This forces pretty much everyone to move to a Pro subscription or to put a cache in front of docker.io.
  • kennysoona 2y ago
    Medium to large orgaizations probably should have been caching images anyway out of courtesy.
    • theshrike79 2y ago
      It's not simple, you need to modify every Dockerfile and compose.yml to point to your cache instead of just using it directly. Still doable though.
      • Reubensson 2y ago
        With podman and kube (crio and containerd) you can create mirror config such that the pulls happen from a mirror transparently. Some mirrors also support proxy cache behaviour so you dont in theory have to preload images (though might be necessary with the new limits)
      • Spivak 2y ago
        Docker Inc. pushed all this work on individuals by being shitty and not supporting adding the ability to add to / change the default registry search. Redhat has been patching Docker engine to let their users do it. It would be trivial if it could be an engine-wide setting ["mydockercache.me", "docker.io"] that would be transparent to everyone's Dockerfile.
        • xena 2y ago
          There is, add this to your /etc/docker/daemon.json: { "registry-mirrors": [ "https://pt-dh.int.xeserv.us" ] } Where the URL points to your pull-through docker hub cache.
• solatic 2y ago
  Can't believe the sense of entitlement in this thread. I guess people think bandwidth grows on trees. For residential usage, unless you're in an apartment tower where all your neighbors are software engineers and you're all behind a CGNAT, you can still do a pull here and there for learning and other hobbyist purposes, which for Docker is a marketing expense to encourage uptake in commercial settings. If you're in an office, you have an employer, and you're using the registry for commercial purposes, you should be paying to help keep your dependencies running. If you don't expect your power plant to give you electricity for free, why would you expect a commercial company to give you containers for free?
  • randomNumber7 2y ago
    Idk. I have seen stuff like GitHub and "pulled" open software with apt-get for years. So I got the impression that there are free usable services.
  • jjfanboy 2y ago
    [flagged]
  • j4nek 2y ago
    > Can't believe the sense of entitlement in this thread. I guess people think bandwidth grows on trees. bandwidth is super cheap if you dont use any fancy public cloud services.
    • ahofmann 2y ago
      Which is very unlikely for a big service like docker. I haven't looked in this case, though.
      • coder543 2y ago
        The bigger the service, the more financial incentive they have to be smart and not pay absurd prices for things, since they can give themselves higher profit margins by controlling their costs.
    • 2y ago
• lousken 2y ago
  It's still crazy to me how costly bandwidth is even in 2025. Considering the ever increasing usage, it should be 10x cheaper
  • baq 2y ago
    They charge you for value, not for cost plus. Bandwidth is cheap if all you're getting is bandwidth.
  • coder543 2y ago
    How much do you think bandwidth costs? I’m trying to understand what 10x cheaper would look like to you, as an actual $/TB number. I think a lot of people have misconceptions about how much bandwidth really costs.
    • baq 2y ago
      Or what they’re actually buying when they’re looking at the bandwidth line item on their invoices.
    • lousken 2y ago
      I am mainly mentioning this with regards to Azure and other providers egress prices. And in Europe, onprem stuff is expensive if you are peering to other countries.
      • coder543 2y ago
        Azure and the other mega clouds seem to enjoy massive profit margins on bandwidth… why would they willingly drop those prices when they can get away with high prices? If bandwidth costs are important, there are plenty of options that will let you cut the cost by 10x (or more). Either with a caching layer like an external CDN (if that works for your application), or by moving to any of the mid-tier clouds (if bandwidth costs are an important factor, and caching won’t work for your application). AWS, GCP, and Azure are the modern embodiment of the phrase “nobody ever got fired for buying IBM.” Most companies don’t benefit from those big 3 mega clouds nearly as much as they think they do. So, sure, send a note to your Azure rep complaining about the cost of bandwidth… nothing will change, of course, because companies aren’t willing to switch away from the mega clouds. > and other providers Other providers, like Hetzner, OVH, Scaleway, DigitalOcean, Vultr, etc., do not charge anywhere near the same for bandwidth as Azure. I think they are all about 8x to 10x cheaper.
• keisborg 2y ago
  It is not immediately clear to me if the limit is per repo/package or globally in the hub. For instance, I fear it will not be possible to add a new kubernetes node to my cluster without hitting the limit as it would need to pull all the individual images.
  • ragingroosevelt 2y ago
    Why are you not using a registry mirror/cache (eg jfrog artifactory, etc)? Own your supply chain.
    • RobotToaster 2y ago
      When that cache has to update it will make more than 10 pulls.
      • keisborg 2y ago
        Exactly this. And when a base image has a new release, all images based on this will also need an update
  • davman 2y ago
    its globally in the hub. The announcement says they are rolling out the block in March but this already blew up my k8s clusters since last weekend. Have tried looking for an option to tell k8s to always use authentication tokens for image pulls, but can't find a way, going to have to add Kyverno to mutate all incoming Deployments to add imagePullSecrets.
• chillaranand 2y ago
  I stumbled up on this issue recently while setting up GHA and switched to AWS ECR Gallery which doesn't have limits. My blog post on the same at https://avilpage.com/2025/02/free-dockerhub-alternative-ecr-gallery.html https://avilpage.com/2025/02/free-dockerhub-alternative-ecr-...
  • deleted 2y ago
    [deleted]
  • thyrsus 2y ago
    My employer has stuff I'm responsible for which hit this the at least 18 months ago. The subscription cost was little problem but the headaches debugging kubernetes pod description imagepullsecrets was much more painful. We called Docker sales and asked how much it would cost us for unlimited anonymous downloads from our IP address. They took a couple weeks to just say "go away".
  • bityard 2y ago
    This is using AWS ECR as a proxy to docker hub, correct? Edit: Not exactly, it looks like ECR mirrors docker-library (a.k.a. images on docker hub no preceded by a namespace), not all of Docker Hub. Edit 2: I think the example you give there is misleading, as Ubuntu has its own namespace in ECR. If you want to highlight that ECR mirrors docker-library, a more appropriate example might be `docker pull public.ecr.aws/docker/library/ubuntu`.
  • mdaniel 2y ago
    I can tell you with 100% certainty that ECR definitely has limits, just not "screw you" ones like the blog post. So, while I do think switching to public.aws.ecr/docker/library is awesome, one should not make that switch and then think "no more 429s for me!" because they can still happen. Even AWS is not unlimited at anything
    • cmeacham98 2y ago
      Disclaimer: I work for Amazon, but not on ECR or ECR Public. The rate limit for unauthenticated pulls is 1/second/IP, source: https://docs.aws.amazon.com/general/latest/gr/ecr-public.html https://docs.aws.amazon.com/general/latest/gr/ecr-public.htm...
• dustrider 2y ago
  It’s their business choice, but they’re no longer the only option, nor in my opinion the best one. Vote with your feet and your wallets.
  • yjftsjthsd-h 2y ago
    Vote with your feet sure, but wouldn't people voting with their wallets be unaffected in the first place?
  • ivewonyoung 2y ago
    What are other good options.
    • binfinger 2y ago
      Make your software experts use their software skills to host a mirror.
• JamesMcMinn 2y ago
  The storage costs coming in from 1st March feel like they're going to catch a lot of organisations out too. Private repos will cost $10/month per 100GB of storage, something that was previously not charged for. We're in the middle of a clear out because we have several TB of images that we'd rather not pay for on top of the existing subscription costs.
  • mmbleh 2y ago
    The storage enforcement costs have been delayed until 2026 to give time for new (automated) tooling to be created and for users to have time to adjust. The pull limits have also been delayed at least a month.
    • jscarrott 2y ago
      Do you have a source for that? My company was dropping dockerhub this week as we have no way of clearing up storage usage (untagging doesn't work) until this new tooling exists and can't afford the costs of all the untagged images we have made over the last few years.
      • mmbleh 2y ago
        (I work there) If you have a support contact or AE they can tell you if you need an official source. Marketing communications should be sent out at some point.
        • jscarrott 2y ago
          Thanks, Just seems like quite poor handling on the comms around the storage changes as there is only a week to go and the current public docs make it seem like the only way to not start paying is to delete the repos or I guess your whole org.
          • mmbleh 2y ago
            Yep, agree that comms have a lot of room for improvement. We do have initial delete capabilities of manifests available now, but functionality is fairly basic. It will improve over time, along with automated policies.
• pcthrowaway 2y ago
  > 10 per IPv4 address or IPv6 /64 subnet Finally, a use for IPv6! I assume so anyway, as I think ISPs that support ipv6 will give you multiple IPv6 /64 spaces if requested.
  • the8472 2y ago
    RFC 6177 recommends handing out /56s, my ISP does by default, no need to ask.
• deleted 2y ago
  [deleted]
• deleted 2y ago
  [deleted]
• pronik 2y ago
  In case someone from Gitlab is watching: there is a long-standing issue that Gitlab Dependency Proxy does not work with containerd rewriting (https://gitlab.com/gitlab-org/gitlab/-/issues/350485 https://gitlab.com/gitlab-org/gitlab/-/issues/350485), making it impossible to use as a generic Docker Hub mirror.
  • stevekemp 2y ago
    Gitlab features are almost always half-baked, sadly.
    • pronik 2y ago
      Yes, but in this case it's not the problem. It's more about not accepting `?ns=docker.io` as a query parameter on an endpoint, so a rather small and isolated technical issue.
      • arccy 2y ago
        sounds pretty half baked to me
• clvx 2y ago
  Hey Docker people, if you increased the pull limit in ipv6, you could help with its adoption.
  • nucleardog 2y ago
    Well, if your consumer ISP isn't a complete jerk and gives you a /56 then you have 256 separate /64 subnets getting you 2,560 pulls per hour. If that's not enough, you could tunnel through HE's tunnelbroker and get a /48 which has 65,536 separate subnets for 655,360 pulls per hour. Though, honestly, for the effort involved you're probably better off just mirroring the images.
• chrstowr 2y ago
  With my latest project, I decided to implement a private registry due to cost. After it was setup, it have been working great.
• chrstowr 2y ago
  With my latest project, we decided to setup a private registry for development and we are considering setting a main and backup registry for prod as well. We are a smaller operation so I'm not sure how much it would scale to larger business needs.
• 01HNNWZ0MV43FF 2y ago
  There should be a way to pirate these. Really, all this networking expertise floating around, and Docker artifacts already being content-addressable, there should be a way to torrent them.
  • Ocha 2y ago
    Torrenting is not pirating unless you are getting illegal content.
    • hedora 2y ago
      Copyrighted content is not illegal. Anyway, in this case, the initial download of the otherwise redistributable content would be piracy. From the docker TOS: > 2.4 You may not access or use the Service for the purpose of bringing an intellectual property infringement claim against Docker or for the purpose of creating a product or service competitive with the Service. Which is a great reason to default to / publish on other registries.
  • kirici 2y ago
    Like a P2P Docker registry? https://github.com/uber/kraken https://github.com/uber/kraken
  • unhingedlife 2y ago
    Amazing that HN doesn't realize that transit networking is actually not expensive at all. You can saturate a gigabit connection at a colo for pennies, but nobody blogged about that, so nobody knows it's an option.
  • remram 2y ago
    Spegel shares images between your machines (not everyone's) in a peer-to-peer fashion: https://github.com/spegel-org/spegel https://github.com/spegel-org/spegel
  • blinded 2y ago
    Egress and storage is not free.
• stego-tech 2y ago
  Seems reasonable on its face to me given what Docker Hub offers. Unless you’re orchestrating your entire homelab with containers from Docker Hub and doing fresh pulls everytime, you’re highly unlikely to hit that limit - and if you do, the personal plan quadruples your allowance for a $0 annual cost. The only folks likely to feel pain from this change were those either deliberately abusing Docker’s prior generosity or using bad development and deployment practices to begin with. I suspect that for 99% of us regular users, we won’t see or feel a thing.
• mfontani 2y ago
  Nice, limits for ipv6 are for a /64 and there's quite a lot of those in a /48...
• no_wizard 2y ago
  When Docker went hard on subscriptions, my company pivoted to Rancher Desktop as the replacement. I can't stress enough how much I dislike Rancher. I know we moved to it as a cost saving measure as I am assuming we would have to buy subs for Docker. Yet there is nothing I found easier to use than Docker proper. Rancher has a Docker compatible mode and it falls down in various ways. Now that this has happened, I wonder if Rancher is pulling by default from the Docker Hub registry, in which case now we'll need to setup our own registry for images we use, keep them up to date etc. Which feels like it would be more costly than paying up to Docker to begin with. All this makes me almost miss Vagrant boxes.
  • Etheryte 2y ago
    Out of curiosity, have you considered and/or tried Podman? Granted I don't do anything fancy with it, but for my use cases it's worked great.
    • no_wizard 2y ago
      Even if I have doesn't matter, Rancher is what we are suppose to use, and not using it means you're out of step with whats supported and such, which I don't find to be a good place to be.
      • SSLy 2y ago
        Do you mean "Rancher" Rancher, or Rancher Desktop? Those are two different things. I have found the latter to be a Just Works™ app that's miles ahead of Podman Desktop. Now, that one is a mess.
        • no_wizard 2y ago
          Rancher Desktop. Neither are drop in replacements for Docker Desktop, that much I am certain about, thus far.
  • everfrustrated 2y ago
    If you're on Mac worth checking out the commercial https://orbstack.dev/ https://orbstack.dev/ Reasonable price for better dev efficiency. Free for personal use.
• camgunz 2y ago
  I was forced into using some kind of Docker thing at my last job, where I looked into the license and it starts out: "Docker Desktop is free for small businesses (fewer than 250 employees AND less than $10 million in annual revenue), personal use, education, and non-commercial open source projects." I think that's reasonable, but it's hard for me to believe everyone's paying when they should be. I set up podman instead and I haven't had any major issues.
  • hkwerf 2y ago
    This is only for Docker Desktop. The Docker Engine itself is free (AFAIK). If you're on Linux, you probably don't care about Docker Desktop at all.
    • hedora 2y ago
      There are many decent alternatives for MacOS too. I had good luck with minikube a few years ago. This article seems decent, based on my previous research: https://dev.to/shohams/5-alternatives-to-docker-desktop-46am https://dev.to/shohams/5-alternatives-to-docker-desktop-46am I don’t use windows, put presumably you can just use their built in linux environment and docker cli.
    • camgunz 2y ago
      Yeah I'm on a Mac. Uh, you know I really had a memory of homebrew getting things out of the .app or something, but I really can't find any evidence that was ever the case. I blame sleep deprivation, this is like the 13th blunder I've made this week haha.
  • colechristensen 2y ago
    Docker Desktop is the only thing that has that license. Every time someone mentions docker I have to be annoying and make sure they didn't mean they installed Docker Desktop. Docker just needs to be open source software, there's no real revenue model that makes sense, but damn they're trying. Now I guess dockerhub is also just off the table.
• agumonkey 2y ago
  Time to setup cache registries I guess
• 0x1ceb00da 2y ago
  So sometimes when I do docker run I see a bunch of progress bars pulling images and layers. Are all of them counted individually or it all just counts as one?
  • LorenzoGood 2y ago
    It all counts as one.
• grandempire 2y ago
  GitHub culture has gone a little crazy with things like CI - assuming these cloud providers will always be up and providing their services for free. If your project can’t afford to pay for servers and sometime to maintain it, I think we should stick with local shell scripts and precommit hooks.
  • yencabulator 2y ago
    Hermetically-sealed (container/vm/whatever) quality assurance tasks that can be run locally, please. The un-sandboxed shell scripts and precommit hooks are prone to doing the wrong thing, for example testing uncommitted changes and approving a commit based on that invalid reasoning.
• lukaslalinsky 2y ago
  Years ago, when Docker and Docker Hub was starting out, I didn't really understand why is the thing not built to allow super easy self-hosting/proxying. It seemed crazy to me that one company is hosting full OS images that needed to be downloaded over and over again, especially for CI environments. Linux distro ISO images always had mirrors, even torrent distribution. Whenever I tried looking at caching Docker Hub images, I gave up and just accepted the wasted bandwidth.
  • jugg1es 2y ago
    setting up your own local mirror is pretty easy. You set your docker to pull from your local network registry and you configure the registry to pull from the public repo if the requested image isn't found.
• mattgreenrocks 2y ago
  This gets at something I've never quite understood about Docker. And it might be a dumb question: why do we need a dedicated host for Docker images in the first place? I can see the use case for base images: they're the canonical, trusted source of the image. But for apps that are packaged? Not as much. I mean, if I'm using a PaaS, why can't I just upload my Docker image to them, and then they store it off somewhere and deploy it to N nodes? Why do I have to pay (or stay within a free tier) to host the blob? Many PaaS providers I've seen are happy to charge a few more bucks a month just to host Docker images. I'm not seeing any sort of value added here (and maybe that's the point).
  • ajross 2y ago
    So, on a technical level, obviously you don't. "docker image import" allows images to be stored anywhere you want. But obviously the real problem is that you're asking the wrong question. We don't "need" a centralized image repository. We WANT one, because the feature that Docker provides that "just use a tarball" doesn't (in addition to general ease-of-use, of course) is authentication, validation and security. And that's valuable, which is why people here are so pissed off that it's being locked behind a paywall. But given that it has value... sorry folks, someone's got to pay for it. You can duplicate it yourself, but that is obviously an engineering problem with costs. Just write the check if you're a heavy user. It's an obvious service with an obvious value proposition. It just sucks if it wasn't part of your earlier accounting.
    • lolinder 2y ago
      > It just sucks if it wasn't part of your earlier accounting. I generally agree with you, but to be fair to the complainers, what sucks is that Docker didn't make it clear up front that it should be part of your accounting. I don't know if they always intended to monetize this way (if so, we'd call that a bait and switch) or if they sincerely had other plans that just didn't pan out, but either way the problem is the same: There's a trend across all of technology of giving your stuff away for free until you become the obvious choice for everything, then suddenly altering the deal and raising prices. That kind of behavior has in the past been deemed anticompetitive and outlawed, because it prevents fair competition between solutions on their merits and turns it into a competition for who has the deepest war chest to spend on customer-acquisition-by-free-stuff.
• mmbleh 2y ago
  These dates have been delayed. They will not take effect March 1. Pull limit changes are delayed at least a month, storage limit enforcement is delayed until next year.
• solarkraft 2y ago
  Are they trying to push ghcr?
• jillesvangurp 2y ago
  Some obvious mitigations: don't depend on docker hub for publishing, use mirrors for stuff that does depend on that, use one of the several docker for desktop alternatives, etc. No need to pay anyone. Chances are that you already use a mirror without realizing it if you are using any of the widely used cloud or CI platforms. Can one of the big tech companies please use their petty cash account to acquire what remains of docker.com? Maybe OSS any key assets and donate docker hub, trademarks, etc. to some responsible place like the Linux Foundation which would be a good fit. This stuff is too widely used to leave taken hostage by an otherwise unimportant company like Docker. And the drama around this is getting annoying. MS, Google, AWS, anyone? Alternatively, let's just stop treating docker.io as a default place where containers live. That's convenient for Docker Inc. but not really necessary otherwise. Docker Inc is overly dependent on everybody just defaulting to fetching things without an explicit registry host from there. And with these changes, you wouldn't want any of your production environments be dependent on that anyway because those 429 errors could really ruin your day. So, any implied defaults should be treated like what they are: a user error. If most OSS projects stop pushing their docker containers to docker hub and instead spin up independent registries, most of the value of docker hub evaporates. Mostly the whole point of putting containers there was hassle free usage for users. It seems that Docker is breaking that intentionally. It's not hassle free anymore. So, why bother with it at all? Plenty of alternative ways to publish docker containers.
• hedora 2y ago
  For years, people have been trying to add a “override the default registry because docker hub is a single point of failure” option to the docker client. Upstream has blocked it. A fork over this one little feature is long overdue.
  • horsawlarway 2y ago
    Personally - I don't really see this one making sense. There's already a widely available way to specify exactly which repo you'd prefer in the docker client... `docker pull [repo]/[image]:[tag]` And that address format works across basically all of the tooling. Changing the defaults doesn't actually make sense, because there's no guarantee that repo1/secure_image === repo2/secure_image. Seems like a HUGE security issue to default named public images to a repo where the images may not be provided by the same owner.
    • lolinder 2y ago
      I like Podman's solution: all images must be fully qualified, with even Docker Hub images requiring a docker.io/ prefix.
      • raesene9 2y ago
        Fully qualified is indeed the way to go. Unfortunately a lot of tutorials manifests and other materials have short names, and changing the default registry just opens up a load of typo squatting attacks.
      • ffsm8 2y ago
        That's a very good argument, but people have down used to dropping the domain prefix because it's always been optional. Giving people the option to configure a default repository via the daemon.json would alleviate that issue, but I'm not sure if that's really enough to fork.
        • hedora 2y ago
          They’ve been betting it’s not for about ten years. With these changes, I can imagine “intro to docker” tutorials breaking. I suspect that’ll be enough to let a fork/competitor gain significant market share.
• pzmarzly 2y ago
  Does anyone recommend some pull-through registry to use? Docker Docs has some recommendations [0], but I wonder how feature complete it is. I'd like to find something that: - Can pull and serve private images - Has UI to show a list of downloaded images, and some statistics on how much storage and bandwidth they use - Can run periodic GC to delete unused images - (maybe) Can be set up to pre-download new tags IIRC Artifactory has some support for Docker images, but that seems like a big hammer for this problem. [1] [0] https://docs.docker.com/docker-hub/image-library/mirror/ https://docs.docker.com/docker-hub/image-library/mirror/ [1] https://jfrog.com/artifactory/ https://jfrog.com/artifactory/
  • bdsa 2y ago
    You could have a look at Harbor: https://goharbor.io/ https://goharbor.io/
  • Palomides 2y ago
    also interested, everything I could find for this seemed very heavy and/or integrated into some large piece of infrastructure
  • horsawlarway 2y ago
    Depending on your use-case, the default registry mirroring you've linked works well. It... does not have a UI or the GC/pre-download stuff, but it absolutely works for private images (see: https://distribution.github.io/distribution/recipes/mirror/#configure-the-cache https://distribution.github.io/distribution/recipes/mirror/#...) I've been using it as a cache for a while locally and it's a solid choice. --- I guess an edit - it does also have basic TTL, which might cover your GC case, but it's not very configurable or customizable. It's literally just a TTL flag on the proxied image.
  • folmar 2y ago
    harbor should have enough features and is popular/rising, otherwise Artifactory will do everything you imagine but is quite heavy both on resources and configuration.
  • sc68cal 2y ago
• osigurdson 2y ago
  Unless cloud providers cache these images by default, this is going to break the internet.
  • movedx01 2y ago
    GCP does, at least in GKE.
• OptionOfT 2y ago
  With storage now becoming something that is charged for, I hope we can make the case for trying to shrink images. There is a huge difference in images carefully curated, with separate build layers and shipped layers vs the ones that dump in the codebase, install a whole compiler toolchain needed to build the application / wheels / (whatever its called in Node.JS), package it, and then ship off the image.
  • hereonout2 2y ago
    All well and good until you need an image with CUDA toolkit and pytorch involved. Clearing your apt cache and removing extraneous packages is peeing in the wind when faced with GB worth of shared objects.
• yonatan8070 2y ago
  Could you spin up something like a Steam cache but for Docker? So when someone in your network pulls an image, it gets cached and served to subsequent pullers of the same image.
• a022311 2y ago
  One thing I haven't seen mentioned at all here is the impact of this change on self-hosting. Updating apps or checking for updates becomes a real challenge with such a small rate limit. Suddenly everybody will have to switch to some mirror/proxy (or self-host one). For people running k8s clusters... good luck. I understand Docker is paying for the bandwidth, but it's relatively cheap for them at the scale they operate. ghcr.io doesn't impose any rate limit at all (although it isn't really GitHub's main product), which I'd say proves that it's sustainable. In any case, 100 to 10 and 200 to 40 are both huge decreases and are unjustifiable for me.
  • unhingedlife 2y ago
    1. Don't use Docker; you don't need it. People were hosting things successfully long before Docker. 2. Host a mirror. 3. Rack a server and stop paying insane egress costs and padding the profit margins of grifters.
• vladkens 2y ago
  RIP Docker Hub.
• varelse 2y ago
  [dead]
• varelse 2y ago
  [dead]
• binfinger 2y ago
  Crazy idea: stop using Docker.
  • DaSHacka 2y ago
    Never do by choice, distribution repos are good enough for me. The bigger problem is when projects only officially ship as docker images for some banal reason.
    • unhingedlife 2y ago
      Then don't use those projects, or build them yourself, or use non-Docker options. I'm aghast that people think they need an expensive, bloated container runtime to run software. It's never been necessary.
      • remram 2y ago
        > bloated container runtime As opposed to what? SystemD?
        • johntash 2y ago
          I think what he's probably thinking of is more like using a virtualenv for python. Or bundler for ruby.
          • remram 2y ago
            Yeah and installing it as a systemd service, which uses basically as much namespacing/cgroup/supervision/mounts as any other container runtime.
• kylegalbraith 2y ago
  This is just another thing in a laundry list of things from Docker that feel developer-hostile. Does it make sense? Sure, it might, given the old architecture of Docker Hub. I'm biased (i.e., co-founder of Depot [0]) and don't have the business context around internal Docker things. So this is just my view of the world as we see it today. There are solutions to the egress problem that negates needing to push that down to your users. So, this feels like an attempt to get even more people onto their Docker Desktop business model and not explicitly related to egress costs. This is why when we release our registry offering, we won't have this kind of rate limiting. There are also solutions to avoiding the rate limits in CI. For example, our GitHub Actions runners come online with a public unique IP address for every job you run. Avoiding the need to login to Docker at all. [0] https://depot.dev https://depot.dev
  • lolinder 2y ago
    > There are solutions to the egress problem that negates needing to push that down to your users. Please do elaborate on what those are! There are always lots of comments like this providing extremely vague prescriptions for other people's business needs. I'd love to hear details if you have them, otherwise you're just saying "other companies have found ways to get someone else besides their customers to pay for egress costs" without any context for why those people are willing to pay the costs in those contexts.
• sigy 2y ago
  I host OSS images there, and I see no notice about how they will be affected. If they limit access to my published images, then it will be an issue. In that case the benefit and thus incentive for many of the projects which have made docker and docker hub pervasive goes away. Without that adoption, there would probably be no docker hub today. This should help people understand a bit better why this feel a bit underhanded. The images are free, and I and many other OSS devs have used docker hub in partnership to provide access to software, often paying for the ability to publish there. In this case, any burden of extra cost was on the producer side. Turning this into a way to "know" every user and extract some value from them is their prerogative, but it does not feel like it is good faith. It also feels a bit creepy in the sense of "the user is the product".
  • deleted 2y ago
    [deleted]
  • vinyl7 2y ago
    This has been the standard practice for all tech companies. Make it free to capture the market and snuff out all competition. Once they have secured the whole market then its time to start making money to pay back the millions they borrowed from VCs for decades
    • bogeholm 2y ago
      It’s like playing Plague Inc. (reverse version of Pandemic the board game where you play as the disease): to win, develop all possible methods of spreading first; only then develop symptoms, and do it fast before anyone has time to react
      • thih9 2y ago
        I find it surprising that people notice the part about symptoms[1], and despite this happening repeatedly we do relatively little against the part about spreading. Part of it is perhaps by definition, “spreading” already assumes success. Still, I’d welcome some regulation; or at least awareness; e.g. a neologism for companies in that stage, growing at cost and only getting ready to develop symptoms. [1]: The American Dialect Society selected “Enshittification” as its 2023 word of the year, source: https://en.m.wikipedia.org/wiki/Enshittification https://en.m.wikipedia.org/wiki/Enshittification
• Mekoloto 2y ago
  Its an unfortunate strategy. They could just give X Budget to public images and create a status code for 'server overloaded, pls consider buying premium' or whatever. It would create the same responose: Either paying or mirroring it yourself but it wouldn't harm the reputation that much.
• Mekoloto 2y ago
  Why is there no P2P option? I would be happy to give back to the community by hosting a container p2p host. would that be even possible out of the box?
  • _verandaguy 2y ago
    There _sort-of_ is. You can pull from registries other than Docker Hub (these can be run by anyone with the will and resources to do so -- GHCR is a popular one), though these may have their own usage restrictions. You can run your own following Docker's own guide here[0] if you'd like. It's not peer-to-peer in the sense that the lines between clients and servers are blurred, as with torrenting, but it allows for a distributed registry architecture, which I think is the part that matters here. [0] https://www.docker.com/blog/how-to-use-your-own-registry-2/
  • kevmo314 2y ago
    I don't think it would be possible out of the box: Docker pulls assume a direct HTTP download for the image. It would be pretty cool to build a proxy that acts as a torrent client for images however it would be a lot less ergonomic to use on top of the security risk of tags not being checksums.
• aftbit 2y ago
  Oops time for everyone to pull their open source containers off docker hub and use a different registry.
• deleted 2y ago
  [deleted]
• suryao 2y ago
  This sucks for individuals and open source. For folks that have a heavy reliance on dockerhub, here are some things that may help (not all are applicable to all use cases): 1. Setup a pull through mirror. Google Artifact Registry has decent limits and good coverage for public images. This requires just one config change and can be very useful to mitigate rate limits if you're using popular images cached in GAR.[1] 2. Setup a private pull through image registry for private images. This will require renaming all the images in your build and deployment scripts and can get very cumbersome. 3. Get your IPs allowlisted by Docker, especially if you can't have docker auth on the servers. The pricing for this can be very high. Rough numbers: $20,000/year for 5 IPs and usually go upwards of $50k/year. 4. Setup a transparent docker hub mirror. This is great because no changes need to be made to pipelines except one minor config change (similar to 1). We wrote a blog about how this can be done using the official docker registry image and AWS.[2] It is very important to NOT use the official docker registry image [3] as that itself can get throttled and lead to hairy issues. Host your own fork of the registry image and use that instead. We spent a lot of time researching this for certain use cases while building infrastructure for serving Github actions at WarpBuild. Hope this helps. [1] https://cloud.google.com/artifact-registry/docs/pull-cached-dockerhub-images https://cloud.google.com/artifact-registry/docs/pull-cached-... [2] https://www.warpbuild.com/blog/docker-mirror-setup https://www.warpbuild.com/blog/docker-mirror-setup [3] https://hub.docker.com/_/registry https://hub.docker.com/_/registry
  • knallfrosch 2y ago
    Register for free and you get a higher limit: 40 pulls is plenty. What do you imagine running that requires more than 40 dockerhub (not local) pulls on an hourly basis?
    • tekno45 2y ago
      if i start an eks cluster in a NAT environment with 10 nodes and 4 daemon sets. I need 40 pulls by default. Lots of tutorials out there to do this that will no longer work as well.
      • 2y ago
• colechristensen 2y ago
  Well now it's time to do everything I can to never use dockerhub. This is going to be annoying. If you don't want to host an OSS repository, just decide to not do that. And this is the first I've heard of it so now it's an emergency to work around this rug pull. Now for every image I'm going to have to try to find a trustable alternative source. (things like postgres, redis, nginx) or copy and rehost everything.
• belter 2y ago
  https://gallery.ecr.aws/ https://gallery.ecr.aws/
• mococa 2y ago
  How about GitHub Actions or other CIs, they will create a allowlist?
• bdhcuidbebe 2y ago
  Docker keeps making themselves irrelevant, one step at a time. I switched to podman during their last stunt in 2020 and have been a happy user since. Going forward, the cheapest (free) container hub today is probably github.
• PeterZaitsev 2y ago
  If you're getting something for free... you should ask a question who and how is actually paying for it. Facebook can give you lots of stuff for free... because they can show you ads and use that awesome data for various purposes Docker can't really market to machines doing most of downloads autonomously and probably can't monetize download data well to, so they want you to start paying them... or go use something else. If I read these limits correctly, looks like lots of things are going to break on March 1st
• ckbishop 2y ago
  The inevitable consequence of misconfigured Watchtower disease, I suppose. I pay for Docker because I like all of their products, and their private registry + scout is good, so I can go on misconfiguring all of the things!
• urda 2y ago
  My workflow lately has been to establish an operations organization on my local intranets Forgejo instance. I then pull the images I want once from the internet, and shove them into that. From here, I make sure all my compose and scripts reference my local registry on the Forgejo server.
• PaulHoule 2y ago
  Back when Docker got popular, maybe 10 years ago, I was behind a slow ADSL connection (less < 2Mbps) and I couldn't stand anything up with it to save my life. Downloads from Docker Hub just wouldn't complete. I figured some kind of smart download manager and caching system would save the day but frankly I saw Docker as a step backward because I had been doing a really good job of installing 100+ web services on a single server since 2003 or so. [1] [2] Looking back it, I'm sure that a short timeout was a deliberate decision by the people running Docker Hub, as people with slow internet connections because telcos choose not to serve us with something better are unpeople. [1] Nothing screams "enterprise feature, call sales for pricing" like being able to run your own local hub [2] My experience with docker is roughly: if you can write a bash script to build your environment, you can write a Dockerfile; the Dockerfile is the gateway to a system that will download 5GB of images when you really want to install 50MB of files, so what's the point? Sure, Docker accelerates your ability to have 7 versions of the JVM and 35 different versions of Python, but is that something to be proud of, really?
  • maccard 2y ago
    > My experience with docker is roughly: if you can write a bash script to build your environment, you can write a Dockerfile I agree. > Sure, Docker accelerates your ability to have 7 versions of the JVM and 35 different versions of Python, but is that something to be proud of, really? No, but it's not my fault that the python packaging ecosystem is broken and requires isolation, and that every Java project relies on a brittle toolchain. At least docker means that nonsense is isolated and doesn't affect the stuff I write.
• Vaslo 2y ago
  If they choose to do this, hopefully they report the reason for the pull failure when you try rather than a nonsense 404 error.
  • blinded 2y ago
    You can query for the limits via curl on the effected instance https://docs.docker.com/docker-hub/usage/pulls/#view-hourly-pull-rate-and-limit https://docs.docker.com/docker-hub/usage/pulls/#view-hourly-...
• linotype 2y ago
  It never should have been free or unauthenticated to begin with.
• WhyNotHugo 2y ago
  I’ve seen a few projects publish images in their own registry and I hope this move keeps fuelling this practice. It’s much healthier for the ecosystem to have lots of small registries rather than all depend on a single central one.
• miki123211 2y ago
  I suspect uni labs will have the most problems with this. Teaching people to use Docker is not uncommon. The entire class pulling an image at (roughly) the same time is not uncommon either. Yes, you can ask people to set up an account (provided you don't have policies against requiring students to sign up for unvetted US-based third-party services and provide personal data to them), but that complicates things.
  • Symbiote 2y ago
    The university could allocate public IPv4 (or IPv6) addresses to their computers. Most did this in the past, but many stopped once people who didn't understand IP retired.
• __MatrixMan__ 2y ago
  It seems like a good time to point out that oci images' layer-based caching system is incredibly bandwidth inefficient. A change to a lower layer invalidates all layers above it, regardless of whether there's actually any dependency on the changed data. With a competent caching strategy (the sort of thing you'd set up with nix or bazel) it's often faster to send the git SHA and build the image on the other end than it is to move built images around. This is because 99% of that image you're downloading or pushing is probably already on the target machine, but the images don't contain enough metadata to tell you where that 1% is. A build tool, by contrast, understands inputs and outputs. If the inputs haven't changed, it can just use the outputs which are still lying around from last time.
  • silverwind 2y ago
    > A change to a lower layer invalidates all layers above it Does it have to? It seems it should be possible to diff the layers and only invalidate if there are conflicts.
    • __MatrixMan__ 2y ago
      The way Dockerfiles work, yes I think it does need to do this. It wouldn't be a matter of "conflicts" but rather of assembling containers with the wrong data. Imagine a Dockerfile like so: RUN echo 1 > A RUN echo "$(cat A) + 1" | bc > B So that's two layers each with one file. If, in a later version, the first command changes to `echo 3 > A` then the contents of B should become "4", even though the second command didn't change. That is, neither layer can be reused because the layers depend on each other. But maybe there's no dependency. If your Dockerfile is like this: RUN echo 1 > A RUN echo 2 > B Then the second layer could in theory be re-used when the first layer changes, and not built/pushed/downloaded a second time. RUN echo 3 > A # new RUN echo 2 > B # no dependency on layer 1, can be reused But docker doesn't do this. It plays it safe and unnecessarily rebuilds both layers anyway. And since these files end up with timestamps, the hashes of the layers differ, so both layers are consequently reuploaded and redownloaded. Build tools like nix and bazel require more of the user. You can't just run commands all willy nilly, you have to tell them more info about which things depend on which other things. But the consequence is that instead of a list of layers you end up with a richer representation of how dependency works in your project (I guess it's a DAG). Armed with this, when you try to build the next version of something, you only have to rebuild the parts that actually depend on the changes. Whether the juice is worth the squeeze is an open question. I think it is.
• KronisLV 2y ago
  So this is more or less a funnel towards getting people either to register and log in, or open their wallets and pay up a bit for increased usage. That's understandable, but if the claim would be that this is primarily related to the costs of bandwidth, shouldn't the instructions to deploy an image caching solution (e.g. Sonatype Nexus or anything else) be at the forefront? Like, if the same image gets pulled for some CI process that doesn't have a cache for whatever reason or gets redeployed often, having a self-hosted proxy between the user and Docker Hub would solve it really well with quite limited risks.
• jillyboel 2y ago
  > When utilizing the Docker Platform, users should be aware that excessive data transfer, pull rates, or data storage can lead to throttling, or additional charges. To ensure fair resource usage and maintain service quality, we reserve the right to impose restrictions or apply additional charges to accounts exhibiting excessive data and storage consumption. Well, that's ominous. No mention what they consider consider excessive or how much they might charge. They're essentially saying they can send you whatever bill they want.
• SOLAR_FIELDS 2y ago
  The way I figured out this was going on is that the organization I work at MITM’s non allowlisted endpoints. We started having engineers randomly fail for pulling from dockerhub proxying to Cloudflare R2 under the hood. After a while of scratching our heads I thought to check dockerhub and here was the news. Builds failing like this is because many prominent projects are now changing under the hood the storage location. I can say with reasonable confidence a lot of prominent projects have moved already. Notably the Python base image was moved to Cloudflare R2 sometime yesterday which caused all manner of fun breakages before we implemented a fix We fixed the problem by using a pull through registry
• almosthere 2y ago
  https://aws.amazon.com/about-aws/whats-new/2023/11/amazon-ecr-pull-through-cache-additional-upstream-registries/ https://aws.amazon.com/about-aws/whats-new/2023/11/amazon-ec...
• rtpg 2y ago
  I do feel like it's ... a good thing if we can move away from "stuff is stored on servers and downloaded over and over and over to other servers in an arbitrary region". I know that places like Circle already do a lot of stuff to automatically set up local caches as it can to avoid redownloading the same thing over and over from the outside world, and I hope that becomes more of the norm. This timeline is kinda wild thouhg.
• trumpvoter 2y ago
  This comes and goes, maybe it will just go again. But it's getting old, basically any OSS projects that have source on GitHub but only push to docker hub need to get to double pushing it to ghcr since the ones that do will be getting priority in image decisions.
  • trumpvoter 2y ago
    Wait a second - April Fool's?