6 ms·

It bugs me that this implementation detail of containerd has leaked to such an extent. This should be part of the containerd distribution, and should not be pul

by cmckn 11mo ago

It bugs me that this implementation detail of containerd has leaked to such an extent. This should be part of the containerd distribution, and should not be pulled at runtime. Instead of just swapping out the registry, try baking it into your machine image.

chupasaurus 11mo ago
It's implementation of cri plugin. > This should be part of the containerd distribution containerd is not the only CRI runtime out there.
- cmckn 11mo ago
  > It's implementation of cri plugin. Right, that’s the point. A user of the CRI should not have to care about this implementation detail. > containerd is not the only CRI runtime out there. Any CRI that needs a pause executable should come with one.
  - chupasaurus 11mo ago
    > A user of the CRI should not have to care about this implementation detail. This detail is implemented by K8s, not a container runtime. User has to care about the source of it due to supply chain attacks, though. > Any CRI that needs a pause executable should come with one. Which would introduce a simultaneous update across different projects, which is a problem harder than a line of config.
spwa4 11mo ago
More general one would wish that Kubernetes had a few extra ways to get images, so you could grow on a scale from "minimal infrastructure" to "fully CI/CD". Starting with just sending the image in the RPC itself or even just on local disk (you figure out how to get it there), all the way up to registries with tightly controlled versioning.
- p_l 11mo ago
  It's possible to do that, as kubernetes only passes the image information to CRI. You can also setup a separate service to "push" images directly to your container runtime, someone even demoed one in Show HN post some time ago I think.
kawsper 11mo ago
Relying on an hosted image also caused some disruptions for Nomad (the scheduler from Hashicorp), because the default pause image was hosted at gcr.io which google killed, and it moved to registry.k8s.io. The nomad team made this configurable afterwards.
- verdverm 11mo ago
  That nomad was hit with this after years of notice and deprecation extension, seems a sign of serious maintenance issues
yencabulator 11mo ago
It's almost as if Docker (the company) wants it this way.

by cmckn 11mo ago

chupasaurus 11mo ago

It's implementation of cri plugin. > This should be part of the containerd distribution containerd is not the only CRI runtime out there.

cmckn 11mo ago
> It's implementation of cri plugin. Right, that’s the point. A user of the CRI should not have to care about this implementation detail. > containerd is not the only CRI runtime out there. Any CRI that needs a pause executable should come with one.
- chupasaurus 11mo ago
  > A user of the CRI should not have to care about this implementation detail. This detail is implemented by K8s, not a container runtime. User has to care about the source of it due to supply chain attacks, though. > Any CRI that needs a pause executable should come with one. Which would introduce a simultaneous update across different projects, which is a problem harder than a line of config.

spwa4 11mo ago

More general one would wish that Kubernetes had a few extra ways to get images, so you could grow on a scale from "minimal infrastructure" to "fully CI/CD". Starting with just sending the image in the RPC itself or even just on local disk (you figure out how to get it there), all the way up to registries with tightly controlled versioning.

p_l 11mo ago
It's possible to do that, as kubernetes only passes the image information to CRI. You can also setup a separate service to "push" images directly to your container runtime, someone even demoed one in Show HN post some time ago I think.

kawsper 11mo ago

Relying on an hosted image also caused some disruptions for Nomad (the scheduler from Hashicorp), because the default pause image was hosted at gcr.io which google killed, and it moved to registry.k8s.io. The nomad team made this configurable afterwards.

verdverm 11mo ago
That nomad was hit with this after years of notice and deprecation extension, seems a sign of serious maintenance issues

yencabulator 11mo ago

It's almost as if Docker (the company) wants it this way.