12 ms·

Can't believe the sense of entitlement in this thread. I guess people think bandwidth grows on trees. For residential usage, unless you're in an apartment towe

Can't believe the sense of entitlement in this thread. I guess people think bandwidth grows on trees. For residential usage, unless you're in an apartment tower where all your neighbors are software engineers and you're all behind a CGNAT, you can still do a pull here and there for learning and other hobbyist purposes, which for Docker is a marketing expense to encourage uptake in commercial settings. If you're in an office, you have an employer, and you're using the registry for commercial purposes, you should be paying to help keep your dependencies running. If you don't expect your power plant to give you electricity for free, why would you expect a commercial company to give you containers for free?

randomNumber7 2y ago
Idk. I have seen stuff like GitHub and "pulled" open software with apt-get for years. So I got the impression that there are free usable services.
jjfanboy 2y ago
[flagged]
j4nek 2y ago
> Can't believe the sense of entitlement in this thread. I guess people think bandwidth grows on trees. bandwidth is super cheap if you dont use any fancy public cloud services.
- ahofmann 2y ago
  Which is very unlikely for a big service like docker. I haven't looked in this case, though.
  - coder543 2y ago
    The bigger the service, the more financial incentive they have to be smart and not pay absurd prices for things, since they can give themselves higher profit margins by controlling their costs.
- Ekaros 2y ago
  Bandwidth is cheap per unit. But if you have huge amount of those cheap units they can add up to real cost.
- linsomniac 2y ago
  How much bandwidth do you suppose DockerHub uses? I can't see it being any less than 10gigabit, probably more like 100gigabit. Just the cost of that transit is likely in the $600-6,000/mo range. Then you need to factor in the additional costs for storage and compute to serve it, switching gear, and management and maintenance. That's probably at least as much as transit. They aren't likely able to go for peering arrangements ("free" bandwidth) because their traffic is likely very asymmetric, and that doesn't save the management/storage/compute costs. I don't know what Docker's financials are, but I can imagine, as a business owner myself, situations where it was lean enough that that sort of cost could mean the difference between running the service and not.
mschuster91 2y ago
> I guess people think bandwidth grows on trees. Bandwidth is cheap, especially at scale, unless you're in one of the large clouds that make a shitload of money gouging their customers on egress fees. I don't say that Docker Inc should foot the bill for other multibillion dollar companies, but the fact that even after 8 years it still is impossible to use authentication in the registry-mirrors option is mind-boggling. [1] https://github.com/moby/moby/issues/30880 https://github.com/moby/moby/issues/30880
wkat4242 2y ago
Hmm yes but if it is limited to 10 in an hour that could even be an issue for hobbyists if you update multiple dockers at the same time. For example the excellent matrix ansible playbook pulls numerous dockers in a single update run because every little feature is in a separate container. Same with home assistant add-ons. It's pretty easy to reach 10 in an hour. Even though you may not pull any for a whole month afterwards. I only do this once a month because most matrix bridges only get updates at that rate. I have to say though, 90% of the dockers I use aren't on docker hub anymore. Most of them reside on the github docker repo now (ghcr.io). I don't know where the above playbook pulls from though as it's all automated in ansible. And really docker is so popular because of its ecosystem. There are many other container management platforms. I think that they are undermining their own value this way. Hobbyists will never pay for docker pulls but they do generate a lot of goodwill as most of us also work in IT. This works the other way around too. If we get frustrated with docker and start finding alternatives it's only a matter of time until we adopt them at work too. If they have an issue with bandwidth costs they could just use the infrastructure of the many public mirrors available that also host most Linux distros etc. I'm sure they'd be happy to add publicly available dockers.
- theshrike79 2y ago
  This means there is a market for a docker proxy. Just install it, in a Docker container of course, and it caches the most common containers you use locally!
  - rad_gruchalski 2y ago
    Yeah -> https://goharbor.io/ https://goharbor.io/
  - mitjam 2y ago
    K3s (a lightweight Kubernetes) has an embedded registry mirror (https://docs.k3s.io/installation/registry-mirror https://docs.k3s.io/installation/registry-mirror)
- RobotToaster 2y ago
  This wouldn't be much of a problem for hobbyists if this was 240 per day or 1680 per week, but hitting 10 is easy.
aiiizzz 2y ago
The amount of work this creates on fixing CI is going to be absurd.
InsomniacL 2y ago
> Can't believe the sense of entitlement in this thread. I don't use Docker so I genuinely don't know this... Is the Docker Library built on the back of volunteers which is then used to sell paid subscriptions? Does this commercial company expect volunteers to give them images for free which give their paid subscriptions value?
- Zandikar 2y ago
  > Does this commercial company expect volunteers to give them images for free which give their paid subscriptions value? Yes, to an extent, because it costs money to store and serve data, no matter what kind of data it is or it's associated IP rights/licensing/ownership. Regardless, this isn't requiring people to buy a subscription or otherwise charging anyone to access the data. It's not even preventing unauthenticated users from accessing the data. It's reducing the rate at which that data can be ingested without ID/Auth to reduce the operational expense of making that data freely (as in money) and publicly available. Given the explosion in traffic (demand) and the ability to make those demands thanks to automation and AI relative to the operational expense of supplying it, rate limiting access to free and public data egress is not in and of itself unreasonable. Especially if those that are responsible for that increased OpEx aren't respecting fair use (legally or conceptually) and even potentially abusing the IP rights/licensing of "images [given] for free" to the "Library built on the back of volunteers". To what extent that's happening, how relevant it is to docker, and how effective/reasonable Docker's response to it are all perfectly reasonable discussions to have. The entitlement is referring to those that explicitly or implicitly expect or demand such a service should be provided for free. Note: you mentioned you don't use docker. a single docker pull can easily be 100's of MB's (official psql image is ~150MB for example) or even in some cases over a GB worth of network transfer depending on the image. Additionally, there is no restriction by docker/dockerhub that prevents or discourages people from linking to source code or alternative hosts of the data. Furthermore you don't have to do a pull everytime you wish to use an image, and caching/redistributing them within your LAN/Cluster is easy. Should also be mentioned Docker Hub is more than just a publicly accessible storage endpoint for a specific kind of data, and their subscription services provide more that just hosting/serving that data.
- theamk 2y ago
amonith 2y ago
You're absolutely right, but explaining the cost to the employer and/or the client and getting approvals to even use Docker will be a PITA. Currently for smaller clients of the software house I work for we (normal employees) were able to use Docker whenever we felt like without manager's approval to optimize the deployment and maintenance costs on our side.
zozbot234 2y ago
Is there an easy way of changing the default repository that's pulled from when you issue a 'docker pull <whatever>' command, or do you always have to make sure to execute 'docker pull <mycustomrepo.io/whatever>' explicitly?
- wkat4242 2y ago
  As far as I know you do always have to specify it. But I tend to script this all anyway. It's not a big deal to me.
- c0balt 2y ago
  Not for docker AFAIK, https://github.com/moby/moby/issues/33069 https://github.com/moby/moby/issues/33069, however for podman, see https://docs.podman.io/en/latest/markdown/podman.1.html https://docs.podman.io/en/latest/markdown/podman.1.html (registries.conf under configuration files).
- hedora 2y ago
  No. Docker has refused patches that add such an option for anti-competitive reasons.
- donmcronald 2y ago
  > do you always have to make sure to execute 'docker pull <mycustomrepo.io/whatever>' explicitly I started using explicit repository names for everything including Docker Hub 5+ years ago and I don't regret it. I haven't thought about mirrors since, and I find it easier to reason about everything. I use pull-through caches with dedicated namespaces for popular upstream registries. - hub.example.com/ubuntu --> ubuntu from Docker Hub - ghcr.example.com/org/projectA --> project from GHCR I tried using mirrors at first, but it was a disaster with the shorthand notation because you can have namespace collisions. Consider: - docker.io/org/projectA (owner 1) - ghcr.io/org/projectA (owner 2) What happens below? What do you get? How do you know where the mirror admin is pulling from? - docker pull org/projectA That only works if you have single source of truth or if you keep a mapping somewhere. Ex: - org/projectA --> docker.io - org/projectB --> ghcr.io That's not useful because your definitions are still ambiguous unless you go look at the mappings, so all you've done is add external config vs explicitly declaring the namespace. Plus, you can set up a pull-through cache everywhere it makes sense. - locationA - hub.example.com = 192.0.2.1 - locationB - hub.example.com = 192.0.2.2 I'd be interested to hear about scenarios where mirrors are more than a workaround for failing to understand the power of Docker's namespacing and defaulting to the shorthand notation for everything.
vineyardmike 2y ago
Docker is a company, sure, and they’re entitled to compensation for their services, sure. That said, bandwidth is actually really cheap. Especially at that scale. Docker has publicly been struggling for cash for years. If they’re stuck on expensive clouds from a bygone VC era, that’s on them. Affordable bandwidth is available. My main complaint is: They built open source tools used all over the tech world. And within those tools they privileged their own container registry, and provided a decade or more of endless and free pulls. Countless other tools and workflows and experiences have been built on that free assumption of availability. Similarly, Linux distros have had built-in package management with free pulling for longer than I’ve been alive. To get that rug-pull for open-source software is deeply disappointing. Not only that, but the actual software hosted on the platform is other people’s software. Being distributed for free. And now they’re rent-seeking on top of it and limiting access to it. I assume most offices and large commercial businesses have cached and other tools built into their tools, but for indie developers and small businesses, storage of a ton of binary blobs starts to add up. That’s IF they can even get the blobs the first time, since I imagine they could experience contention and queuing if you use many packages. And many people use docker who aren’t even really aware of what they’re doing - plenty of people (myself included) have a NAS or similar system with docker-wrapping GUI pre-installed. My NAS doesn’t even give me the opportunity to login to docker hub when pulling packages. It’s effectively broken now if I’m on a CGNAT.
- clvx 2y ago
  You can always rebuild the dockerfile, or create an account increasing your pull limit, or just host all the free infrastructure they’ve already built, or use competitors providing the same service with the risk of them doing exactly the same in the future. The difference with docker hub and just mirroring a linux repo is docker made it really easy for people so they don’t need it to get into infra weeds but the complexity was always there.
  - josephcsible 2y ago
    > or just host all the free infrastructure they’ve already built, or use competitors providing the same service That would be more reasonable if they didn't go out of their way to make doing so painful: https://github.com/moby/moby/issues/7203 https://github.com/moby/moby/issues/7203
lovasoa 2y ago
If the electricity were generated by thousands of volunteers pedalling in their basement, then yes, I would expect the utility company not to be too greedy.
jonhohle 2y ago
From a security and reproducibility perspective, you, shouldn’t want to pull directly. I’ve used Artifactory in the past as a pass through cache that can “promote” image, making them available to test and production environments as they go through whatever validation process is required. Then you know images (or packages, or gems, or modules, or whatever you are deploying) has at least been tested and an unpinned dependency isn’t going to surprise you in production.
- bityard 2y ago
  This is what I've seen (and done) at every place that used containers at any kind of scale. I'm frankly impressed with the people who can sleep at night with their production hosts pointed directly at docker hub.
  - jdhendrickson 2y ago
    Agreed, it seems like a bunch of people in this thread are scared of having to setup authentication and monitoring, but are not scared of chain attack in the latest docker image they never even looked at.
- hedora 2y ago
  Artifactory is a tire fire though. Someone (maybe the podman folks?) should do what every Linux distribution has done, and set up a network of signed mirrors that can be rsynced.
  - Symbiote 2y ago
    I think the scale would be the problem. Debian is 5TB. Five years ago when Docker changed a storage policy they said it would save 5PB. I can't find the current size of Docker Hub. That's a huge cost to expect from a free mirror service, especially when a large fraction is of very limited interest, and unlike a Linux distribution Docker Hub isn't organized. (It's easy to only mirror the AMD64 packages for Debian, for example.) The Docker client also isn't able to work with a partial mirror.
rjst01 2y ago
Let me give you an alternative perspective. My startup pays Docker for their registry hosting services, for our private registry. However, some of our production machines are not set up to authenticate towards our account, because they are only running public containers. Because of this change, we now need to either make sure that every machine is authenticated, or take the risk of a production outage in case we do too many pulls at once. If we had instead simply mirrored everything into a registry at a big cloud provider, we would never have paid docker a cent for the privilege of having unplanned work foisted upon us.
- hkwerf 2y ago
  I get why this is annoying. However, if you are using docker's registry without authentication and you don't want to go through the effort of adding the credentials you already have, you are essentially relying on a free service for production already, which may be pulled any time without prior notice. You are already taking the risk of a production outage. Now it's just formalized that your limit is 10 pulls per IP per hour. I don't really get how this can shift your evaluation from using (and paying for) docker's registry to paying for your own registry. It seems orthogonal to the evaluation itself.
  - gcapu 2y ago
    If you offer a service, you have some responsibility towards your users. One of those responsibilities is to give enough notice about changes. IMO, this change doesn't provide enough notice. Why not making it a year, or at least a couple of months? Probably because they don't want people to have enough notice to force their hand.
    - deleted 2y ago
      [deleted]
    - lukeschlather 2y ago
      Didn't they institute more modest limits some time ago? Doesn't really seem like this is out of nowhere.
azalemeth 2y ago
I'm behind cgnat with half a city. Limits per IPv4 address are really, really annoying. All I can do is flick on a VPN... which likely won't work either
- sethops1 2y ago
  > All I can do You could also, you know, pay Docker for the resources you're using.
  - gertlex 2y ago
    He could also hit the limit downloading a single image, if I'm understanding his situation. If I'm an infrequent tinkerer that occasionally needs docker images, I'm not going to pay a monthly cost to download e.g. 1 image/month that happens to be hosted on Docker's registry. (It sounds like you can create an account and do authenticated pulls; which is fine and pretty workable for a large subset of my above scenario; I'm just pointing out a reason paying dollars for occasional one-off downloads is unpopular)
- jabart 2y ago
  Docker Personal is free unless I am missing something?
  - TeMPOraL 2y ago
    Authentication and automation don't mix well.
    - jabart 2y ago
      Works for LetsEncrypt AWS Azure GCP Github Actions Failing to see how they don't mix well.
    - bigstrat2003 2y ago
      That isn't true at all. Service accounts exist and aren't hard to set up.
kcb 2y ago
Isn't this a problem even with a cache? Only being able to cache 10 images an hour is still horribly limiting.
- theamk 2y ago
  How many new distinct docker images do you get daily? I'd expect less then one, on average, with a occasional peak when you do exploration. There is always a commercial subscription. You need only a single $9/mo account and you get 25,000 pulls/month. And if you are not willing to pay $9/mo, then you should be OK with using free personal account for experiments, or to spread out your experiments over longer timeline.
devmor 2y ago
Entitlement like building a business on top of free open source tech, relying on free open source to build and support your userbase, then using your cheapest line item as a cudgel to coerce subscriptions?
- an_guy 2y ago
  They are limiting your downloads from dockerhub, which is not funded or hosted by volunteers.
  - hedora 2y ago
    True, but the primary cost of docker hub is producing the images, and that is done by volunteers and employees of other companies.
  - devmor 2y ago
    What exactly do you think is hosted on dockerhub, making it useful?
    - an_guy 2y ago
      They don't charge you for hosting, uploading or downloading images. Without dockerhub you would have to host your own repository, which would cost money.
      - devmor 2y ago
        No, the subject of this post is that they are now charging for downloading images.
axegon_ 2y ago
It kind of depends. To a degree you are right, but not entirely. For the past two months for instance I've been making a huge push to de-cloud-ify myself entirely and self-host everything. I do have the bandwidth and I do have the hardware that is needed. Having said that, I am not making this whole thing little by little but whenever I have time. There were times when I was pulling 30 images/hour and it's clearly a one-off thing. While corporations are certainly abusing docker's generosity, in practice, the people that pull hundreds of images on hourly basis is astronomically low - most commonly one-off things, much like what I am doing. I've worked in similar environments and the abusers are the exception rather than the rule. The bottom line is, this genuinely feels like some half-assed biz-dev decision, promising to cut costs by 20%. Been there, done that. In the long run, those quick cuts ended up costing a lot more.
gregors 2y ago
So yeah you can say it's entitlement but if you build your business in one way and then change the fundamental limits AFTER you've gotten market saturation you really shouldn't be shocked at complaints. It's their fault because they fostered the previous user behavior. People understand that bandwidth costs money but that seems to have been priced in to their previous strategy or they did it knowingly as a loss leader to gain market share. If they knew this was a fundamental limitation they should have addressed it years ago.
- theamk 2y ago
  how would you want to them to address it? Perhaps they should have started by putting "we will enforce limits soon" in all documentation.. and in a few years, starting enforcement but with pretty high limits? and then slowly dialing limits down over a few years? That's exactly what they did. I remember setting up the docker proxy 4 years ago when we started getting first "rate limit" errors. And if someone was ignoring the news for all that time.. Well, tough for them, there was definitely enough notice.
hansmayer 2y ago
Not a huge fan of Docker as a company in general, but this is spot on- the DockerHub free tier is still quite generous for private/hobby usage actually - if you are a professional user, well you should very well be having your own professional solution, either your own internal registry or a commercial SaaS registry.
deleted 2y ago
[deleted]
mikedelfino 2y ago
> why would you expect a commercial company to give you containers for free Because they did. But you're right—they have no obligation to continue doing so. Now that you mention it, it also reminds me that GitHub has no such obligation either. In a way, expecting free container images is similar to how we can download packages from non-profit Linux distributions or how those distributions retrieve the kernel tarball from its official website. So, I’m not sure whether it’s better for everyone to start paying Docker Hub for bandwidth individually or for container images to be hosted by a non-profit, supported by donations from those willing to contribute.
binfinger 2y ago
Who knew that cramming 6 GB of Debian dependencies over the wire to run a Python script was a terrible idea? Who could have seen this coming? Maybe people wouldn't think bandwidth grows on trees if literally everyone in Silicon Valley hadn't developed software that way for the last 15 years. But idk maybe Docker shouldn't have pulled a bait-and-switch, which is also classical known as a "dick move".
- immibis 2y ago
  Literally every company offering a free service pulls a bait-and-switch. Fool me once, shame on you. Fool me three dozen times... you can't get fooled again. This was not unexpected. This was completely predictable from the moment anyone in the team asked "what does this command do?" and the answer was "it downloads something from Docker Hub"
Mekoloto 2y ago
The entitlement comes from the status quo. If the power company gave me free energy for 15 years, i would also be pissed. Rightly? No but hey thats not the issue. Also with docker being the status quo for so long, it does hurt the ecosystem / beginners quite a lot.
blitzar 2y ago
The entitlement of ... the VC powered powerplant that reinvented and reimagined electricity, gave out free electricity and put all the comeptitors out of business, succeeded in monopolizing electrity then come looking for a payday so they can pad the accounts and 'exit' passing it off to the next round of suckers. Truly unbelieveable.
- fennecbutt 2y ago
  That's business, baby. We're all involved in it, like it or not. And especially American tech/developer culture seems to thrive on fyigm gated community stuff. I couldn't give 2 shits whatever Docker does. They're a service, if I wanna use it I'll pay, if not then I'll use something else. Ez pz
ComputerGuru 2y ago
No one is mad merely because there is a capped free service and an unlimited paid service offering. The ire is because of the rug pull. (I presume) you know that. It’s predatory behavior to build an entire ecosystem around your free offering (on the backs of OSS developers) then do the good old switcheroo.
- 0_gravitas 2y ago
  Yea I don't get why this is being ignored, are we just becoming numb to it? Does HN consider this preferred behavior from a business?
hinkley 2y ago
We are all getting a little tired of “Come Into My Parlor,” Said the Spider to the Fly. Of if you want it a little more colorfully: capturing a market with free candy to get us into your van. Or more accurately, this “free until we need something from you” is the moral equivalent of a free meal or ski trip but you are locked into a room to watch a timeshare marketing deck. Open Source is built on a gift economy. When you start charging you break the rules of that socioeconomic model. So most of us make tools that we have a hope of keeping running the way they were designed. Some of us stay at the edges because we know we won’t still be interested in this tool in two years and we don’t want to occupy other people’s head space unfairly or dishonestly. Some of us believe we can persevere and then we find there’s a new programming language that we like so much more than this one that we fuck off and leave a vacuum behind us that others have to scramble to fill (I’m talking about you, TJ). And then there’s these kinds of people who hoover up giant sections of the mindshare using VC money and don’t ever find a new revenue stream, like Mozilla managed. And it’s getting really fucking old. One of the problems with XML is that the schemas aren’t cached by default, and so a build system or a test harness that scans dozens or hundreds of these files per run, or twenty devs running their sandboxes in a tight loop, can eat up ridiculous amounts of bandwidth. But the important difference is that they architected a way to prevent that, it’s just that it is fiddly to get set up and nobody reads the instructions. I found an email chain with the W3c.org webmaster complaining about it, and myself and a couple other people tried to convince him that they needed to add a 100ms delay to all responses. My reasoning was that a human loading a single XML file would never notice this increase, but a human running 100s of unit tests definitely would want to know why they suddenly got slower, and doing something about it wouldn’t just get back that extra 20 seconds, they’d get back 40 (or in our case 5-10minutes) by making the call one more time and putting it into a PR. We only noticed we were doing it because our builds stopped working one day when the internet went down. There’s no build tool I know of that will deal with being 429’d at 10 requests. Especially if you know anything about how layers work. There are tons that would work just fine being traffic shaped to a server with a lower SLA. Dedicate half of your cluster to paying customers and half to the free tier. Or add 250ms delay. It’ll sort itself out. People will install Artifactory or some other caching proxy and you’ll still have the mindshare at a lower cost per use.
boolemancer 2y ago
There's already a rate limit on pulls. All this does is make that rate limit more inconvenient by making it hourly instead of allowing you to amortize it over 6 hours. 10 per hour is slightly lower than 100 per 6 hours, but not in any meaningful way from a bandwidth perspective, especially since image size isn't factored into these rate limits in any way. If bandwidth is the real concern, why change to a more inconvenient time period for the rate limit rather than just lowering the existing rate limit to 60 per 6 hours?
thayne 2y ago
> unless you're in an apartment tower where all your neighbors are software engineers and you're all behind a CGNAT Replace "apartment tower" with "CS department at a university", and you have a relatively common situation.
qwertox 2y ago
Customary law exists for a reason. If Docker explicitly offers a service for free, then users are well within their rights to use it for free. That’s not entitlement, that’s simply accepting an offer as it stands. Of course, Docker has every right to change their pricing model at any time. But until they do, users are not wrong for expecting to continue using the service as advertised. I've seen this "sense of entitlement" argument come up before, and to be clear: users expecting a company to honor its own offer isn’t entitlement, it’s just reasonable.
spockz 2y ago
Until you have this one weird buildpak thing that for some unfathomable reason keeps downloading all the toolchain layers all the time for each build of the app. Then again, good that this measure forces fixing this bad behaviour, but as a user of buildpack you are not always in the know how to fix it.
WhyNotHugo 2y ago
There’s plenty of folks behind a CGNAT, sometimes shared with thousands of others. And this is more common in regions where actually paying for this service is often too expensive. I’ve also seen plenty of docker-compose files which pull out this amount of images (typically small images). I’m not saying that Docker Inc should provide free bandwidth, but let’s not also pretend that this won’t be an issue for a lot of users.
blinded 2y ago
100% Adding auth to pulls is easy. Mirroring images internally is easy. anyone that says otherwise is lazy.
johnnyo 2y ago
My immediate thought was college kids on campus. It’s basically your apartment building example (esp. something like the STEM dorms) When this stuff breaks in the hours leading up to a homework assignment being due, it’s going to discourage the next generation of engineers from using it.
est 2y ago
> I guess people think bandwidth grows on trees. I think Docker started the bloated image mess. Have you ever seen a project with <100MB in size? Guess pack everything with gzip isn't a good idea when size matters. Docker Hub have a traffic problem, so does every intranet image registry. It's slow. The culprit is Docker (and maybe ppl who won't bother to optimize)

randomNumber7 2y ago

Idk. I have seen stuff like GitHub and "pulled" open software with apt-get for years. So I got the impression that there are free usable services.

jjfanboy 2y ago

[flagged]

j4nek 2y ago

> Can't believe the sense of entitlement in this thread. I guess people think bandwidth grows on trees. bandwidth is super cheap if you dont use any fancy public cloud services.

ahofmann 2y ago
Which is very unlikely for a big service like docker. I haven't looked in this case, though.
- coder543 2y ago
  The bigger the service, the more financial incentive they have to be smart and not pay absurd prices for things, since they can give themselves higher profit margins by controlling their costs.
Ekaros 2y ago
Bandwidth is cheap per unit. But if you have huge amount of those cheap units they can add up to real cost.
linsomniac 2y ago
How much bandwidth do you suppose DockerHub uses? I can't see it being any less than 10gigabit, probably more like 100gigabit. Just the cost of that transit is likely in the $600-6,000/mo range. Then you need to factor in the additional costs for storage and compute to serve it, switching gear, and management and maintenance. That's probably at least as much as transit. They aren't likely able to go for peering arrangements ("free" bandwidth) because their traffic is likely very asymmetric, and that doesn't save the management/storage/compute costs. I don't know what Docker's financials are, but I can imagine, as a business owner myself, situations where it was lean enough that that sort of cost could mean the difference between running the service and not.

mschuster91 2y ago

> I guess people think bandwidth grows on trees. Bandwidth is cheap, especially at scale, unless you're in one of the large clouds that make a shitload of money gouging their customers on egress fees. I don't say that Docker Inc should foot the bill for other multibillion dollar companies, but the fact that even after 8 years it still is impossible to use authentication in the registry-mirrors option is mind-boggling. [1] https://github.com/moby/moby/issues/30880 https://github.com/moby/moby/issues/30880

wkat4242 2y ago

Hmm yes but if it is limited to 10 in an hour that could even be an issue for hobbyists if you update multiple dockers at the same time. For example the excellent matrix ansible playbook pulls numerous dockers in a single update run because every little feature is in a separate container. Same with home assistant add-ons. It's pretty easy to reach 10 in an hour. Even though you may not pull any for a whole month afterwards. I only do this once a month because most matrix bridges only get updates at that rate. I have to say though, 90% of the dockers I use aren't on docker hub anymore. Most of them reside on the github docker repo now (ghcr.io). I don't know where the above playbook pulls from though as it's all automated in ansible. And really docker is so popular because of its ecosystem. There are many other container management platforms. I think that they are undermining their own value this way. Hobbyists will never pay for docker pulls but they do generate a lot of goodwill as most of us also work in IT. This works the other way around too. If we get frustrated with docker and start finding alternatives it's only a matter of time until we adopt them at work too. If they have an issue with bandwidth costs they could just use the infrastructure of the many public mirrors available that also host most Linux distros etc. I'm sure they'd be happy to add publicly available dockers.

theshrike79 2y ago
This means there is a market for a docker proxy. Just install it, in a Docker container of course, and it caches the most common containers you use locally!
- rad_gruchalski 2y ago
  Yeah -> https://goharbor.io/ https://goharbor.io/
- mitjam 2y ago
  K3s (a lightweight Kubernetes) has an embedded registry mirror (https://docs.k3s.io/installation/registry-mirror https://docs.k3s.io/installation/registry-mirror)
RobotToaster 2y ago
This wouldn't be much of a problem for hobbyists if this was 240 per day or 1680 per week, but hitting 10 is easy.

aiiizzz 2y ago

The amount of work this creates on fixing CI is going to be absurd.

InsomniacL 2y ago

> Can't believe the sense of entitlement in this thread. I don't use Docker so I genuinely don't know this... Is the Docker Library built on the back of volunteers which is then used to sell paid subscriptions? Does this commercial company expect volunteers to give them images for free which give their paid subscriptions value?

Zandikar 2y ago
> Does this commercial company expect volunteers to give them images for free which give their paid subscriptions value? Yes, to an extent, because it costs money to store and serve data, no matter what kind of data it is or it's associated IP rights/licensing/ownership. Regardless, this isn't requiring people to buy a subscription or otherwise charging anyone to access the data. It's not even preventing unauthenticated users from accessing the data. It's reducing the rate at which that data can be ingested without ID/Auth to reduce the operational expense of making that data freely (as in money) and publicly available. Given the explosion in traffic (demand) and the ability to make those demands thanks to automation and AI relative to the operational expense of supplying it, rate limiting access to free and public data egress is not in and of itself unreasonable. Especially if those that are responsible for that increased OpEx aren't respecting fair use (legally or conceptually) and even potentially abusing the IP rights/licensing of "images [given] for free" to the "Library built on the back of volunteers". To what extent that's happening, how relevant it is to docker, and how effective/reasonable Docker's response to it are all perfectly reasonable discussions to have. The entitlement is referring to those that explicitly or implicitly expect or demand such a service should be provided for free. Note: you mentioned you don't use docker. a single docker pull can easily be 100's of MB's (official psql image is ~150MB for example) or even in some cases over a GB worth of network transfer depending on the image. Additionally, there is no restriction by docker/dockerhub that prevents or discourages people from linking to source code or alternative hosts of the data. Furthermore you don't have to do a pull everytime you wish to use an image, and caching/redistributing them within your LAN/Cluster is easy. Should also be mentioned Docker Hub is more than just a publicly accessible storage endpoint for a specific kind of data, and their subscription services provide more that just hosting/serving that data.
theamk 2y ago

amonith 2y ago

You're absolutely right, but explaining the cost to the employer and/or the client and getting approvals to even use Docker will be a PITA. Currently for smaller clients of the software house I work for we (normal employees) were able to use Docker whenever we felt like without manager's approval to optimize the deployment and maintenance costs on our side.

zozbot234 2y ago

Is there an easy way of changing the default repository that's pulled from when you issue a 'docker pull <whatever>' command, or do you always have to make sure to execute 'docker pull <mycustomrepo.io/whatever>' explicitly?

wkat4242 2y ago
As far as I know you do always have to specify it. But I tend to script this all anyway. It's not a big deal to me.
c0balt 2y ago
Not for docker AFAIK, https://github.com/moby/moby/issues/33069 https://github.com/moby/moby/issues/33069, however for podman, see https://docs.podman.io/en/latest/markdown/podman.1.html https://docs.podman.io/en/latest/markdown/podman.1.html (registries.conf under configuration files).
hedora 2y ago
No. Docker has refused patches that add such an option for anti-competitive reasons.
donmcronald 2y ago
> do you always have to make sure to execute 'docker pull <mycustomrepo.io/whatever>' explicitly I started using explicit repository names for everything including Docker Hub 5+ years ago and I don't regret it. I haven't thought about mirrors since, and I find it easier to reason about everything. I use pull-through caches with dedicated namespaces for popular upstream registries. - hub.example.com/ubuntu --> ubuntu from Docker Hub - ghcr.example.com/org/projectA --> project from GHCR I tried using mirrors at first, but it was a disaster with the shorthand notation because you can have namespace collisions. Consider: - docker.io/org/projectA (owner 1) - ghcr.io/org/projectA (owner 2) What happens below? What do you get? How do you know where the mirror admin is pulling from? - docker pull org/projectA That only works if you have single source of truth or if you keep a mapping somewhere. Ex: - org/projectA --> docker.io - org/projectB --> ghcr.io That's not useful because your definitions are still ambiguous unless you go look at the mappings, so all you've done is add external config vs explicitly declaring the namespace. Plus, you can set up a pull-through cache everywhere it makes sense. - locationA - hub.example.com = 192.0.2.1 - locationB - hub.example.com = 192.0.2.2 I'd be interested to hear about scenarios where mirrors are more than a workaround for failing to understand the power of Docker's namespacing and defaulting to the shorthand notation for everything.

vineyardmike 2y ago

Docker is a company, sure, and they’re entitled to compensation for their services, sure. That said, bandwidth is actually really cheap. Especially at that scale. Docker has publicly been struggling for cash for years. If they’re stuck on expensive clouds from a bygone VC era, that’s on them. Affordable bandwidth is available. My main complaint is: They built open source tools used all over the tech world. And within those tools they privileged their own container registry, and provided a decade or more of endless and free pulls. Countless other tools and workflows and experiences have been built on that free assumption of availability. Similarly, Linux distros have had built-in package management with free pulling for longer than I’ve been alive. To get that rug-pull for open-source software is deeply disappointing. Not only that, but the actual software hosted on the platform is other people’s software. Being distributed for free. And now they’re rent-seeking on top of it and limiting access to it. I assume most offices and large commercial businesses have cached and other tools built into their tools, but for indie developers and small businesses, storage of a ton of binary blobs starts to add up. That’s IF they can even get the blobs the first time, since I imagine they could experience contention and queuing if you use many packages. And many people use docker who aren’t even really aware of what they’re doing - plenty of people (myself included) have a NAS or similar system with docker-wrapping GUI pre-installed. My NAS doesn’t even give me the opportunity to login to docker hub when pulling packages. It’s effectively broken now if I’m on a CGNAT.

clvx 2y ago
You can always rebuild the dockerfile, or create an account increasing your pull limit, or just host all the free infrastructure they’ve already built, or use competitors providing the same service with the risk of them doing exactly the same in the future. The difference with docker hub and just mirroring a linux repo is docker made it really easy for people so they don’t need it to get into infra weeds but the complexity was always there.
- josephcsible 2y ago
  > or just host all the free infrastructure they’ve already built, or use competitors providing the same service That would be more reasonable if they didn't go out of their way to make doing so painful: https://github.com/moby/moby/issues/7203 https://github.com/moby/moby/issues/7203

lovasoa 2y ago

If the electricity were generated by thousands of volunteers pedalling in their basement, then yes, I would expect the utility company not to be too greedy.

jonhohle 2y ago

From a security and reproducibility perspective, you, shouldn’t want to pull directly. I’ve used Artifactory in the past as a pass through cache that can “promote” image, making them available to test and production environments as they go through whatever validation process is required. Then you know images (or packages, or gems, or modules, or whatever you are deploying) has at least been tested and an unpinned dependency isn’t going to surprise you in production.

bityard 2y ago
This is what I've seen (and done) at every place that used containers at any kind of scale. I'm frankly impressed with the people who can sleep at night with their production hosts pointed directly at docker hub.
- jdhendrickson 2y ago
  Agreed, it seems like a bunch of people in this thread are scared of having to setup authentication and monitoring, but are not scared of chain attack in the latest docker image they never even looked at.
hedora 2y ago
Artifactory is a tire fire though. Someone (maybe the podman folks?) should do what every Linux distribution has done, and set up a network of signed mirrors that can be rsynced.
- Symbiote 2y ago
  I think the scale would be the problem. Debian is 5TB. Five years ago when Docker changed a storage policy they said it would save 5PB. I can't find the current size of Docker Hub. That's a huge cost to expect from a free mirror service, especially when a large fraction is of very limited interest, and unlike a Linux distribution Docker Hub isn't organized. (It's easy to only mirror the AMD64 packages for Debian, for example.) The Docker client also isn't able to work with a partial mirror.

rjst01 2y ago

Let me give you an alternative perspective. My startup pays Docker for their registry hosting services, for our private registry. However, some of our production machines are not set up to authenticate towards our account, because they are only running public containers. Because of this change, we now need to either make sure that every machine is authenticated, or take the risk of a production outage in case we do too many pulls at once. If we had instead simply mirrored everything into a registry at a big cloud provider, we would never have paid docker a cent for the privilege of having unplanned work foisted upon us.

hkwerf 2y ago
I get why this is annoying. However, if you are using docker's registry without authentication and you don't want to go through the effort of adding the credentials you already have, you are essentially relying on a free service for production already, which may be pulled any time without prior notice. You are already taking the risk of a production outage. Now it's just formalized that your limit is 10 pulls per IP per hour. I don't really get how this can shift your evaluation from using (and paying for) docker's registry to paying for your own registry. It seems orthogonal to the evaluation itself.
- gcapu 2y ago
  If you offer a service, you have some responsibility towards your users. One of those responsibilities is to give enough notice about changes. IMO, this change doesn't provide enough notice. Why not making it a year, or at least a couple of months? Probably because they don't want people to have enough notice to force their hand.
  - deleted 2y ago
    [deleted]
  - lukeschlather 2y ago
    Didn't they institute more modest limits some time ago? Doesn't really seem like this is out of nowhere.

azalemeth 2y ago

I'm behind cgnat with half a city. Limits per IPv4 address are really, really annoying. All I can do is flick on a VPN... which likely won't work either

sethops1 2y ago
> All I can do You could also, you know, pay Docker for the resources you're using.
- gertlex 2y ago
  He could also hit the limit downloading a single image, if I'm understanding his situation. If I'm an infrequent tinkerer that occasionally needs docker images, I'm not going to pay a monthly cost to download e.g. 1 image/month that happens to be hosted on Docker's registry. (It sounds like you can create an account and do authenticated pulls; which is fine and pretty workable for a large subset of my above scenario; I'm just pointing out a reason paying dollars for occasional one-off downloads is unpopular)
jabart 2y ago
Docker Personal is free unless I am missing something?
- TeMPOraL 2y ago
  Authentication and automation don't mix well.
  - jabart 2y ago
    Works for LetsEncrypt AWS Azure GCP Github Actions Failing to see how they don't mix well.
  - bigstrat2003 2y ago
    That isn't true at all. Service accounts exist and aren't hard to set up.

kcb 2y ago

Isn't this a problem even with a cache? Only being able to cache 10 images an hour is still horribly limiting.

theamk 2y ago
How many new distinct docker images do you get daily? I'd expect less then one, on average, with a occasional peak when you do exploration. There is always a commercial subscription. You need only a single $9/mo account and you get 25,000 pulls/month. And if you are not willing to pay $9/mo, then you should be OK with using free personal account for experiments, or to spread out your experiments over longer timeline.

devmor 2y ago

Entitlement like building a business on top of free open source tech, relying on free open source to build and support your userbase, then using your cheapest line item as a cudgel to coerce subscriptions?

an_guy 2y ago
They are limiting your downloads from dockerhub, which is not funded or hosted by volunteers.
- hedora 2y ago
  True, but the primary cost of docker hub is producing the images, and that is done by volunteers and employees of other companies.
- devmor 2y ago
  What exactly do you think is hosted on dockerhub, making it useful?
  - an_guy 2y ago
    They don't charge you for hosting, uploading or downloading images. Without dockerhub you would have to host your own repository, which would cost money.
    - devmor 2y ago
      No, the subject of this post is that they are now charging for downloading images.

axegon_ 2y ago

It kind of depends. To a degree you are right, but not entirely. For the past two months for instance I've been making a huge push to de-cloud-ify myself entirely and self-host everything. I do have the bandwidth and I do have the hardware that is needed. Having said that, I am not making this whole thing little by little but whenever I have time. There were times when I was pulling 30 images/hour and it's clearly a one-off thing. While corporations are certainly abusing docker's generosity, in practice, the people that pull hundreds of images on hourly basis is astronomically low - most commonly one-off things, much like what I am doing. I've worked in similar environments and the abusers are the exception rather than the rule. The bottom line is, this genuinely feels like some half-assed biz-dev decision, promising to cut costs by 20%. Been there, done that. In the long run, those quick cuts ended up costing a lot more.

gregors 2y ago

So yeah you can say it's entitlement but if you build your business in one way and then change the fundamental limits AFTER you've gotten market saturation you really shouldn't be shocked at complaints. It's their fault because they fostered the previous user behavior. People understand that bandwidth costs money but that seems to have been priced in to their previous strategy or they did it knowingly as a loss leader to gain market share. If they knew this was a fundamental limitation they should have addressed it years ago.

theamk 2y ago
how would you want to them to address it? Perhaps they should have started by putting "we will enforce limits soon" in all documentation.. and in a few years, starting enforcement but with pretty high limits? and then slowly dialing limits down over a few years? That's exactly what they did. I remember setting up the docker proxy 4 years ago when we started getting first "rate limit" errors. And if someone was ignoring the news for all that time.. Well, tough for them, there was definitely enough notice.

hansmayer 2y ago

Not a huge fan of Docker as a company in general, but this is spot on- the DockerHub free tier is still quite generous for private/hobby usage actually - if you are a professional user, well you should very well be having your own professional solution, either your own internal registry or a commercial SaaS registry.

deleted 2y ago

[deleted]

mikedelfino 2y ago

> why would you expect a commercial company to give you containers for free Because they did. But you're right—they have no obligation to continue doing so. Now that you mention it, it also reminds me that GitHub has no such obligation either. In a way, expecting free container images is similar to how we can download packages from non-profit Linux distributions or how those distributions retrieve the kernel tarball from its official website. So, I’m not sure whether it’s better for everyone to start paying Docker Hub for bandwidth individually or for container images to be hosted by a non-profit, supported by donations from those willing to contribute.

binfinger 2y ago

Who knew that cramming 6 GB of Debian dependencies over the wire to run a Python script was a terrible idea? Who could have seen this coming? Maybe people wouldn't think bandwidth grows on trees if literally everyone in Silicon Valley hadn't developed software that way for the last 15 years. But idk maybe Docker shouldn't have pulled a bait-and-switch, which is also classical known as a "dick move".

immibis 2y ago
Literally every company offering a free service pulls a bait-and-switch. Fool me once, shame on you. Fool me three dozen times... you can't get fooled again. This was not unexpected. This was completely predictable from the moment anyone in the team asked "what does this command do?" and the answer was "it downloads something from Docker Hub"

Mekoloto 2y ago

The entitlement comes from the status quo. If the power company gave me free energy for 15 years, i would also be pissed. Rightly? No but hey thats not the issue. Also with docker being the status quo for so long, it does hurt the ecosystem / beginners quite a lot.

blitzar 2y ago

The entitlement of ... the VC powered powerplant that reinvented and reimagined electricity, gave out free electricity and put all the comeptitors out of business, succeeded in monopolizing electrity then come looking for a payday so they can pad the accounts and 'exit' passing it off to the next round of suckers. Truly unbelieveable.

fennecbutt 2y ago
That's business, baby. We're all involved in it, like it or not. And especially American tech/developer culture seems to thrive on fyigm gated community stuff. I couldn't give 2 shits whatever Docker does. They're a service, if I wanna use it I'll pay, if not then I'll use something else. Ez pz

ComputerGuru 2y ago

No one is mad merely because there is a capped free service and an unlimited paid service offering. The ire is because of the rug pull. (I presume) you know that. It’s predatory behavior to build an entire ecosystem around your free offering (on the backs of OSS developers) then do the good old switcheroo.

0_gravitas 2y ago
Yea I don't get why this is being ignored, are we just becoming numb to it? Does HN consider this preferred behavior from a business?

hinkley 2y ago

We are all getting a little tired of “Come Into My Parlor,” Said the Spider to the Fly. Of if you want it a little more colorfully: capturing a market with free candy to get us into your van. Or more accurately, this “free until we need something from you” is the moral equivalent of a free meal or ski trip but you are locked into a room to watch a timeshare marketing deck. Open Source is built on a gift economy. When you start charging you break the rules of that socioeconomic model. So most of us make tools that we have a hope of keeping running the way they were designed. Some of us stay at the edges because we know we won’t still be interested in this tool in two years and we don’t want to occupy other people’s head space unfairly or dishonestly. Some of us believe we can persevere and then we find there’s a new programming language that we like so much more than this one that we fuck off and leave a vacuum behind us that others have to scramble to fill (I’m talking about you, TJ). And then there’s these kinds of people who hoover up giant sections of the mindshare using VC money and don’t ever find a new revenue stream, like Mozilla managed. And it’s getting really fucking old. One of the problems with XML is that the schemas aren’t cached by default, and so a build system or a test harness that scans dozens or hundreds of these files per run, or twenty devs running their sandboxes in a tight loop, can eat up ridiculous amounts of bandwidth. But the important difference is that they architected a way to prevent that, it’s just that it is fiddly to get set up and nobody reads the instructions. I found an email chain with the W3c.org webmaster complaining about it, and myself and a couple other people tried to convince him that they needed to add a 100ms delay to all responses. My reasoning was that a human loading a single XML file would never notice this increase, but a human running 100s of unit tests definitely would want to know why they suddenly got slower, and doing something about it wouldn’t just get back that extra 20 seconds, they’d get back 40 (or in our case 5-10minutes) by making the call one more time and putting it into a PR. We only noticed we were doing it because our builds stopped working one day when the internet went down. There’s no build tool I know of that will deal with being 429’d at 10 requests. Especially if you know anything about how layers work. There are tons that would work just fine being traffic shaped to a server with a lower SLA. Dedicate half of your cluster to paying customers and half to the free tier. Or add 250ms delay. It’ll sort itself out. People will install Artifactory or some other caching proxy and you’ll still have the mindshare at a lower cost per use.

boolemancer 2y ago

There's already a rate limit on pulls. All this does is make that rate limit more inconvenient by making it hourly instead of allowing you to amortize it over 6 hours. 10 per hour is slightly lower than 100 per 6 hours, but not in any meaningful way from a bandwidth perspective, especially since image size isn't factored into these rate limits in any way. If bandwidth is the real concern, why change to a more inconvenient time period for the rate limit rather than just lowering the existing rate limit to 60 per 6 hours?

thayne 2y ago

> unless you're in an apartment tower where all your neighbors are software engineers and you're all behind a CGNAT Replace "apartment tower" with "CS department at a university", and you have a relatively common situation.

qwertox 2y ago

Customary law exists for a reason. If Docker explicitly offers a service for free, then users are well within their rights to use it for free. That’s not entitlement, that’s simply accepting an offer as it stands. Of course, Docker has every right to change their pricing model at any time. But until they do, users are not wrong for expecting to continue using the service as advertised. I've seen this "sense of entitlement" argument come up before, and to be clear: users expecting a company to honor its own offer isn’t entitlement, it’s just reasonable.

spockz 2y ago

Until you have this one weird buildpak thing that for some unfathomable reason keeps downloading all the toolchain layers all the time for each build of the app. Then again, good that this measure forces fixing this bad behaviour, but as a user of buildpack you are not always in the know how to fix it.

WhyNotHugo 2y ago

There’s plenty of folks behind a CGNAT, sometimes shared with thousands of others. And this is more common in regions where actually paying for this service is often too expensive. I’ve also seen plenty of docker-compose files which pull out this amount of images (typically small images). I’m not saying that Docker Inc should provide free bandwidth, but let’s not also pretend that this won’t be an issue for a lot of users.

blinded 2y ago

100% Adding auth to pulls is easy. Mirroring images internally is easy. anyone that says otherwise is lazy.

johnnyo 2y ago

My immediate thought was college kids on campus. It’s basically your apartment building example (esp. something like the STEM dorms) When this stuff breaks in the hours leading up to a homework assignment being due, it’s going to discourage the next generation of engineers from using it.

est 2y ago

> I guess people think bandwidth grows on trees. I think Docker started the bloated image mess. Have you ever seen a project with <100MB in size? Guess pack everything with gzip isn't a good idea when size matters. Docker Hub have a traffic problem, so does every intranet image registry. It's slow. The culprit is Docker (and maybe ppl who won't bother to optimize)