Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Docker to rate limit image pulls

docker.com

Post reply on HN
Print view View original

121–130 of 274 posts

Re: Docker to rate limit image pulls

#121

Post by cpuguy83 »

kinghajj wrote: post #112
eblanshey wrote: post #106

Earlier quoted context omitted.

I was wondering how Docker-in-Docker works, but I couldn't find it dockermented anywhere. If it's using the host's Docker daemon, why do you need to mount the docker socket?

Docker-in-Docker (DinD) doesn't piggy back on the host's Docker daemon, but instead runs a stripped-down Docker daemon inside of the container. The major downside is that I/O is quite slow, since you're going through two virtualization layers (the DinD one, plus the host Docker daemon).

This is not true.

There is, effectively, no "virtualization" layer here. There are some things that if needed can cause overhead... such as the bridge networking (really shouldn't be a bottleneck for majority of people), and the CoW filesystem... which docker won't be (or shouldn't be) running on top of since, for example, overlayfs on top of overlayfs is not supported.

There is also nothing stripped down about the daemon inside of the container.

Re: Docker to rate limit image pulls

#122

Post by sjy »

young_unixer wrote: post #60
Keverw wrote: post #5

I kinda wonder if Docker as a company is struggling. Redhat made Podman which is a compatible replacement, Then there's swarm but apparently that's not recommended and actively developed anymore, then as far as I know they sold off their enterprise clustering product. Seems Kubernetes is the popular thing now even if a bit complex to setup. Wonder what the current business model? Pretty neat idea of using containers,…

> Redhat made Podman which is a compatible replacement I would actually prefer if they made an incompatible replacement. Docker's CLI is pretty bad in my opinion. I want to use Docker the same way I use a headless virtual machine running an SSH server. I want starting/exiting containers to be independent from their 'main process'. I want to attach/detach whenever I need to and execute arbitrary processes. -- Just use…

> I want to use Docker the same way I use a headless virtual machine running an SSH server. I want starting/exiting containers to be independent from their 'main process'.

If you’re running systemd anyway, check out systemd-nspawn. Your ssh command becomes `machinectl shell user@container`. It’s a more VM-like way of managing containers, without Docker’s image distribution features or philosophy that containers should be ephemeral.

Re: Docker to rate limit image pulls

#123

Post by tr-gitlab »

eblanshey wrote: post #115
jpalomaki wrote: post #8

I guess CI services like Github Actions could be easily hitting these limits (100 pulls per IP per 6 hours).

I'm thinking the same thing. GitLab has shared CI runners that probably do a lot of image pulling. Hopefully they have plans to implement their own docker registry cache.

GitLab PM here - we have a feature called the [Dependency Proxy](https://docs.gitlab.com/ee/user/packages/dependency_proxy/) that allows you to cache images from DockerHub. Currently this only works for public projects, but we are working on adding support for private projects now: https://gitlab.com/gitlab-org/gitlab/-/issues/11582.

Re: Docker to rate limit image pulls

#124

Post by sytse »

hamiltont wrote: post #110
ViViDboarder wrote: post #107

Earlier quoted context omitted.

It’s not common to need that many pulls nor is it hard to build your own images. If you’re deploying to a cluster with 200 machines, you could easily hit this if you use the public registry though. However, if you’re managing that size cluster you can probably afford the fee, but more importantly, you should probably pull once to a local registry and use that to deploy to your cluster anyway.

Do you run a local registry? Any high-quality articles/youtube talks to share? I'm about to set one up for our own little cluster (~5 machines, ~75 containers). I know tons about docker engine, and a fair bit about the registry, but it's always nice to watch a "lessons learned from actually doing this in production" talk to know what mistakes to avoid

If you want to run a local registry to stay below the 100 pulls per 6 hours limit please consider GitLab. The Dependency Proxy https://docs.gitlab.com/ee/user/packages/dependency_proxy/ will cache docker images. This way you stay within the limits Docker set and subsequent pulls should be faster as well.

Re: Docker to rate limit image pulls

#125

Post by oppositelock »

hamiltont wrote: post #110
ViViDboarder wrote: post #107

Earlier quoted context omitted.

It’s not common to need that many pulls nor is it hard to build your own images. If you’re deploying to a cluster with 200 machines, you could easily hit this if you use the public registry though. However, if you’re managing that size cluster you can probably afford the fee, but more importantly, you should probably pull once to a local registry and use that to deploy to your cluster anyway.

Do you run a local registry? Any high-quality articles/youtube talks to share? I'm about to set one up for our own little cluster (~5 machines, ~75 containers). I know tons about docker engine, and a fair bit about the registry, but it's always nice to watch a "lessons learned from actually doing this in production" talk to know what mistakes to avoid

I run tens of thousands of docker images in production, or rather, tens of thousands of copies of a few hundred images.

If you do something like this, you absolutely MUST have a local registry.

Harbor [1], JFrog [2], and Quay [3] would be the first ones that I look at.

Harbor is open source, free, and a member of the CNCF. You will need to do a little bit of work to set it up to scale properly. JFrog offers a SaaS registry, but you will pay big $$ based on pull traffic. Their commercial site license is about $3k/year. Quay is older than either of them, stable, and high quality. I'd start with Harbor these days.

[1] https://goharbor.io/ [2] https://www.jfrog.com/confluence/display/JFROG/JFrog+Artifac... [3] https://quay.io/

Re: Docker to rate limit image pulls

#126

Post by stevebmark »

This is good, just like pruning old images. What's bad, and what Docker isn't saying, is it was a mistake to ever allow unlimited free plans. Independent of scale. Setting up an expectation of unlimited free hosting and bandwidth at any point of a business is bad. Tuning knobs of paid hosting and services at all tier levels, with a limited free tier, should have been baked in from the beginning, and would have led to a much stronger business.

Re: Docker to rate limit image pulls

#127

Post by yjftsjthsd-h »

user5994461 wrote: post #41
Crazyontap wrote: post #19

Honest question, but why can't docker use something like bittorrent to download images? Most of us download our OS via torrents only, so we may as well download the images too if there was support for it.

How would bittorrent work in companies? Only HTTP traffic is allowed and often only when going through the company proxy.

> How would bittorrent work in companies? Only HTTP traffic is allowed and often only when going through the company proxy.

1. Only some companies work like that.

2. I'd expect it to work like a webtorrent; try to download by p2p, but if that fails then fall back to HTTP.

Re: Docker to rate limit image pulls

#128

Post by tr-gitlab »

ArchOversight wrote: post #42
mikepurvis wrote: post #22

Earlier quoted context omitted.

No they don't, but if you do something silly like spin up a bare VM build node, and then pull your environment every time, then obviously you won't get any caching.

Github Actions? Gitlab CI? Many of those don't do any caching because of the chance of poisoning a tag in the local registry, and don't have a good way to do caching per project. I can imagine that this affects those sorts of operations.

You can use the GitLab Dependency Proxy for caching images from DockerHub, it's pretty straightforward to pull cached images:

https://docs.gitlab.com/ee/user/packages/dependency_proxy/

Re: Docker to rate limit image pulls

#129

Post by cpuguy83 »

young_unixer wrote: post #60
Keverw wrote: post #5

I kinda wonder if Docker as a company is struggling. Redhat made Podman which is a compatible replacement, Then there's swarm but apparently that's not recommended and actively developed anymore, then as far as I know they sold off their enterprise clustering product. Seems Kubernetes is the popular thing now even if a bit complex to setup. Wonder what the current business model? Pretty neat idea of using containers,…

> Redhat made Podman which is a compatible replacement I would actually prefer if they made an incompatible replacement. Docker's CLI is pretty bad in my opinion. I want to use Docker the same way I use a headless virtual machine running an SSH server. I want starting/exiting containers to be independent from their 'main process'. I want to attach/detach whenever I need to and execute arbitrary processes. -- Just use…

There is a key sequence for detaching from the container... default is ctrl-p+q.

But if you want to not deal with attach/detach, perhaps `docker exec` is what you want. It doesn't affect the main process (unless of course your command you run kills the main process).

Re: Docker to rate limit image pulls

#130

Post by forty »

verdverm wrote: post #20
pm90 wrote: post #9

I’m hoping GCP/AWS steps up and creates a limitless docker registry. Considering the size of their infrastructure operations, I suspect this would be a small cost but bring a lot of goodwill. One thing this is bound to do is to make the process of using docker a bit more complex. Explicit registries will probably start to be used everywhere, which is something I welcome. But it seems like a really poor decision by do…

They have registries already which work with docker after an auth setup. They are generally private to you. Yes, docker is a struggling company which sold some lines of business and is now trying to reinvent itself again towards developers. Given other recent moves, I'm not sure the new leadership understands how to do this.

They have registries but at least AWS' one is not free at all...
Post reply on HN