5 ms·

I don't want to discount the work they are doing, and that it has no value, but a little bit shocking that they expect to go all commercial with this, in the Or

I don't want to discount the work they are doing, and that it has no value, but a little bit shocking that they expect to go all commercial with this, in the Oracle way, while just "packaging" and so relying on open source software that they will not contribute to. Also, I'm a little bit wondering at how much all of this is really copyrightable in the end. Because if you keep it private I understand, but here it is basically for each package just a few lines, recipes to build the components that they don't own. Like trying to copyright the line "make build". And it might be each the single and obvious way to package the thing anyway. And speaking at the built artefacts, usually a binary distribution of third party open source software with common license should preserve the same rights to the user to access the source code, the instructions to build, and the right to redistribute...

nopurpose 1y ago
"Makefile" they have written and copyrighting is very non trivial and there are many man-months of effort. Configuring all sorts of software just with env vars and make it usable is not an easy feat. Have a look at https://github.com/bitnami/containers/tree/main/bitnami/postgresql https://github.com/bitnami/containers/tree/main/bitnami/post... as example. It might be worth a commercial license for some of their current user-base, no doubt.
- tomalbrc 1y ago
  This has to be a joke, right? Months of effort for a makefile? In which world do people live these days
  - WesolyKubeczek 1y ago
    Tell me you haven't ever written even a moderately complex Makefile without telling me you haven't ever written even a moderately complex Makefile.
  - majkinetor 1y ago
    You seriously underestimate this in general case. Build system may be made in weeks, but is polished in months or even years, to account for all the different usage and environment scenarios. Otherwise, it's typically very fragile.
    - formerly_proven 1y ago
      I don't even see any tests in the bitnami repo?
    - jeltz 1y ago
      Which is why I think you should not try to build generic images like this. I looked at the source and it seems like s lot of work had been put into creating a fragile mess. After having been burned several times by images I prefer writing my docker images from scratch (based on the Debian or Alpine images) for production systems. I only use ready-made images for quickly getting something running locally to evaluate it.
  - draw_down 1y ago
    It would only take you a weekend!
    - jeltz 1y ago
      It is a lot of work but it is work that for the most part should not have been done. I took a quick look at the code (since I know PG very well) and I would not recommend anyone to use that mess off Bash code which configures PostgreSQL in an annoying and incorrect way and exposed some arbitrarily select settings in the environment (some very rarely used) while you have to do most in the config file. Better to just write your own Docker image for scratch, or use the official PG image of your needs are simple. This is what happens if you merge every feature request you get and do not have a clear plan or architecture. After reading the code I am happy they are deleting the images, at least if this one is typical. As a PostgreSQL expert I can write a much better image which suits my needs in one day, which I have also done several times. It would be harder for a non-expery but I do not think a non-expert should use this image due to some footguns I spotted. This kind of generic image is a bad idea and very hard to build.
      - hiatus 1y ago
        > but I do not think a non-expert should use this image due to some footguns I spotted Could you elaborate on your findings?
      - bethekidyouwant 1y ago
        Hindsight is 2020, there’s now helm/kubernetes operator under the cloud native umbrella. I’m sure they took in all the mistakes from here. This helm chart is getting long in the tooth, but is still monumental. Imo running psql on kube is a mistake to begin with but here we are.
  - ahoka 1y ago
    In the world where "developers" cannot even wipe their buttocks without AI.
  - noselasd 1y ago
    Wasn't the point of the post you replied to that it isn't just a simple makefile ? That repo contains quite a lot carefully assembled scripts for each image that handles a lot of corner cases.
  - ottah 1y ago
    The effort you put into a work doesn't determine copyright. You can own the copyright to a photograph that took seconds to take. And you can spend every hour of the day keeping a meticulous log of room temperature, and not have a copyright, because a table of facts isn't copyrightable.
    - nopurpose 1y ago
      How maps are copyrightable then?
- ottah 1y ago
  Not everything that's authored and published is eligible for copyright. Copyright applies to only the creative elements of a work that are unique. Things that are facts, or are necessary for function are not copyrightable. They likely hold a copyright on the exact expression of their documentation, but the facts and information in that documentation, and necessary configuration such as port numbers, and dependency selection are not subject to copyright.
- password4321 1y ago
  Surely some of this complexity is self-inflicted, like an SSL cert renewal tool built with InstallBuilder: https://github.com/bitnami/bncert https://github.com/bitnami/bncert
supriyo-biswas 1y ago
What probably carries more value is the helm charts that they provide which are also on their way out. The images themselves have official replacements (for example, looking at https://hub.docker.com/u/bitnami https://hub.docker.com/u/bitnami why wouldn’t I use Node or Postgres images from the official sources instead). I have no idea how many people actually used their helm charts though.
- _cenw 1y ago
  Some other open source projects have also shipped Bitnami software in their own helm charts, i.e. APISIX's etcd instance is the Bitnami chart pulled in as a dependency. Not that it ever worked well, we had to scale it to 1 because the quorum would constantly break into unrecoverable states.
  - jjzhiyuan 1y ago
    [dead]
- progbits 1y ago
  They do keep some of them more up to date, for example the bitnami python image had system packages patched faster than the official one. But if you are willing to pay then chainguard is a better solution.
  - firesteelrain 1y ago
    ChainGuard is $$$$$$$ We talked to them a couple years ago. A lot of what they are doing besides Wolfi is using Alpine which removes alot of findings by default
    - progbits 1y ago
      Alpine helps but it's not perfect. Plenty of outdated packages with known CVEs there for long time. Often they are not exploitable but it's easier to pay chainguard to have a constant zero on our vuln scanner than to deal with distroless builds ourselves. The GPU images are indeed very expensive though.

nopurpose 1y ago

"Makefile" they have written and copyrighting is very non trivial and there are many man-months of effort. Configuring all sorts of software just with env vars and make it usable is not an easy feat. Have a look at https://github.com/bitnami/containers/tree/main/bitnami/postgresql https://github.com/bitnami/containers/tree/main/bitnami/post... as example. It might be worth a commercial license for some of their current user-base, no doubt.

tomalbrc 1y ago
This has to be a joke, right? Months of effort for a makefile? In which world do people live these days
- WesolyKubeczek 1y ago
  Tell me you haven't ever written even a moderately complex Makefile without telling me you haven't ever written even a moderately complex Makefile.
- majkinetor 1y ago
  You seriously underestimate this in general case. Build system may be made in weeks, but is polished in months or even years, to account for all the different usage and environment scenarios. Otherwise, it's typically very fragile.
  - formerly_proven 1y ago
    I don't even see any tests in the bitnami repo?
  - jeltz 1y ago
    Which is why I think you should not try to build generic images like this. I looked at the source and it seems like s lot of work had been put into creating a fragile mess. After having been burned several times by images I prefer writing my docker images from scratch (based on the Debian or Alpine images) for production systems. I only use ready-made images for quickly getting something running locally to evaluate it.
- draw_down 1y ago
  It would only take you a weekend!
  - jeltz 1y ago
    It is a lot of work but it is work that for the most part should not have been done. I took a quick look at the code (since I know PG very well) and I would not recommend anyone to use that mess off Bash code which configures PostgreSQL in an annoying and incorrect way and exposed some arbitrarily select settings in the environment (some very rarely used) while you have to do most in the config file. Better to just write your own Docker image for scratch, or use the official PG image of your needs are simple. This is what happens if you merge every feature request you get and do not have a clear plan or architecture. After reading the code I am happy they are deleting the images, at least if this one is typical. As a PostgreSQL expert I can write a much better image which suits my needs in one day, which I have also done several times. It would be harder for a non-expery but I do not think a non-expert should use this image due to some footguns I spotted. This kind of generic image is a bad idea and very hard to build.
    - hiatus 1y ago
      > but I do not think a non-expert should use this image due to some footguns I spotted Could you elaborate on your findings?
    - bethekidyouwant 1y ago
      Hindsight is 2020, there’s now helm/kubernetes operator under the cloud native umbrella. I’m sure they took in all the mistakes from here. This helm chart is getting long in the tooth, but is still monumental. Imo running psql on kube is a mistake to begin with but here we are.
- ahoka 1y ago
  In the world where "developers" cannot even wipe their buttocks without AI.
- noselasd 1y ago
  Wasn't the point of the post you replied to that it isn't just a simple makefile ? That repo contains quite a lot carefully assembled scripts for each image that handles a lot of corner cases.
- ottah 1y ago
  The effort you put into a work doesn't determine copyright. You can own the copyright to a photograph that took seconds to take. And you can spend every hour of the day keeping a meticulous log of room temperature, and not have a copyright, because a table of facts isn't copyrightable.
  - nopurpose 1y ago
    How maps are copyrightable then?
ottah 1y ago
Not everything that's authored and published is eligible for copyright. Copyright applies to only the creative elements of a work that are unique. Things that are facts, or are necessary for function are not copyrightable. They likely hold a copyright on the exact expression of their documentation, but the facts and information in that documentation, and necessary configuration such as port numbers, and dependency selection are not subject to copyright.
password4321 1y ago
Surely some of this complexity is self-inflicted, like an SSL cert renewal tool built with InstallBuilder: https://github.com/bitnami/bncert https://github.com/bitnami/bncert

supriyo-biswas 1y ago

What probably carries more value is the helm charts that they provide which are also on their way out. The images themselves have official replacements (for example, looking at https://hub.docker.com/u/bitnami https://hub.docker.com/u/bitnami why wouldn’t I use Node or Postgres images from the official sources instead). I have no idea how many people actually used their helm charts though.

_cenw 1y ago
Some other open source projects have also shipped Bitnami software in their own helm charts, i.e. APISIX's etcd instance is the Bitnami chart pulled in as a dependency. Not that it ever worked well, we had to scale it to 1 because the quorum would constantly break into unrecoverable states.
- jjzhiyuan 1y ago
  [dead]
progbits 1y ago
They do keep some of them more up to date, for example the bitnami python image had system packages patched faster than the official one. But if you are willing to pay then chainguard is a better solution.
- firesteelrain 1y ago
  ChainGuard is $$$$$$$ We talked to them a couple years ago. A lot of what they are doing besides Wolfi is using Alpine which removes alot of findings by default
  - progbits 1y ago
    Alpine helps but it's not perfect. Plenty of outdated packages with known CVEs there for long time. Often they are not exploitable but it's easier to pay chainguard to have a constant zero on our vuln scanner than to deal with distroless builds ourselves. The GPU images are indeed very expensive though.