Maybe a content-addressable P2P web where everyone has their own cache would be better as a way of distributing packages. It would spare a lot of bandwidth costs for the hosts and maybe make us less dependant on big corporate benefactors.
Are Package Registries Holding Open-Source Hostage?
31–40 of 78 posts
Re: Are Package Registries Holding Open-Source Hostage?
#32FTA: "Ultimately, package registries need to align their incentives with those of maintainers." Putting it all on the registries to come up with a viable business model and provide this to maintainers without any responsibility[1] on the part of the maintainer seems really one-sided. It costs quite a bit of money to run something like Docker Hub or NPM. If you want something aligned software maintainers first and for…
It costs quite a bit of money to run something like Docker Hub or NPM. If you want something aligned software maintainers first and foremost, you want a non-profit / foundation that's got priorities aligned with the larger community and not a for-profit entity that has to justify keeping the lights on.
This is an interesting thought. Linux Foundation has a good corporate backing. FSF traditionally provided the backbone in terms of compilers and userland basics. Maybe their 21st century task (and what keeps the relevant in this age) should be such infrastructure.
Apache Foundation is also an interesting candidate for this. I think they also had a good corporate backing.
Re: Are Package Registries Holding Open-Source Hostage?
#33FTA: "Ultimately, package registries need to align their incentives with those of maintainers." Putting it all on the registries to come up with a viable business model and provide this to maintainers without any responsibility[1] on the part of the maintainer seems really one-sided. It costs quite a bit of money to run something like Docker Hub or NPM. If you want something aligned software maintainers first and for…
"Docker Hub's rate limits seem unlikely to impact most usage of Docker, and people who're pulling 200 images every six hours should either seek to set up their own registry to take the load off Docker Hub or throw some money to help shoulder the costs. Even if the user's only grabbing Alpine images at 5MB per image, 200 in six hours starts to add up!"
Maybe there's something technically wrong with the Docker model?
Re: Are Package Registries Holding Open-Source Hostage?
#34Question: What keeps an organization from hosting it's own package mirror internally and only periodically fetch the diffs from the central registry?
Nothing. We did this when NPM was having issues and it worked very well for us, we also did this for some non-US team mates who had very poor NPM performance.
It runs well, is easy to keep up and working and generally was awesome.
Re: Are Package Registries Holding Open-Source Hostage?
#35FTA: "Ultimately, package registries need to align their incentives with those of maintainers." Putting it all on the registries to come up with a viable business model and provide this to maintainers without any responsibility[1] on the part of the maintainer seems really one-sided. It costs quite a bit of money to run something like Docker Hub or NPM. If you want something aligned software maintainers first and for…
" Docker Hub's rate limits seem unlikely to impact most usage of Docker, and people who're pulling 200 images every six hours should either seek to set up their own registry to take the load off Docker Hub or throw some money to help shoulder the costs. Even if the user's only grabbing Alpine images at 5MB per image, 200 in six hours starts to add up! " Maybe there's something technically wrong with the Docker model?
I was amazed anyone tried to make a free Docker registry. It's like making a CDN, except instead of individual files, it's for a whole app and all of its dependencies. It's a crazy amount of data for storage and bandwidth.
Re: Are Package Registries Holding Open-Source Hostage?
#36The problem with Docker Hub is that they don't let you choose the pricing model. In the end, bandwidth and CPUs are not free, so someone has to pay. For a while it was VCs hoping for growth, but we all know that giving stuff away for free is not sustainable forever. The problem with Docker Hub's pricing model is there are actually two use cases for Docker Hub. One is where some random entity makes some software -- th…
There are publisher pays plans available for Docker Hub, email pricingquestions@docker.com for details.
That's great to hear. I will be reaching out :)
Re: Are Package Registries Holding Open-Source Hostage?
#37FTA: "Ultimately, package registries need to align their incentives with those of maintainers." Putting it all on the registries to come up with a viable business model and provide this to maintainers without any responsibility[1] on the part of the maintainer seems really one-sided. It costs quite a bit of money to run something like Docker Hub or NPM. If you want something aligned software maintainers first and for…
" Docker Hub's rate limits seem unlikely to impact most usage of Docker, and people who're pulling 200 images every six hours should either seek to set up their own registry to take the load off Docker Hub or throw some money to help shoulder the costs. Even if the user's only grabbing Alpine images at 5MB per image, 200 in six hours starts to add up! " Maybe there's something technically wrong with the Docker model?
I wouldn’t call the need for caching to ensure good performance “something technically wrong.”
Re: Are Package Registries Holding Open-Source Hostage?
#38Earlier quoted context omitted.
" Docker Hub's rate limits seem unlikely to impact most usage of Docker, and people who're pulling 200 images every six hours should either seek to set up their own registry to take the load off Docker Hub or throw some money to help shoulder the costs. Even if the user's only grabbing Alpine images at 5MB per image, 200 in six hours starts to add up! " Maybe there's something technically wrong with the Docker model?
I was amazed anyone tried to make a free Docker registry. It's like making a CDN, except instead of individual files, it's for a whole app and all of its dependencies. It's a crazy amount of data for storage and bandwidth.
It's more akin to making and then running a CDN but only charging 10% of customers. I'm sure Docker the company was writing it off as a marketing expense, but if they were running this in one of the public clouds that charge for egress, they were paying out a boatload of money just in egress charges (plus more in storage costs)
Re: Are Package Registries Holding Open-Source Hostage?
#39Earlier quoted context omitted.
" Docker Hub's rate limits seem unlikely to impact most usage of Docker, and people who're pulling 200 images every six hours should either seek to set up their own registry to take the load off Docker Hub or throw some money to help shoulder the costs. Even if the user's only grabbing Alpine images at 5MB per image, 200 in six hours starts to add up! " Maybe there's something technically wrong with the Docker model?
I was amazed anyone tried to make a free Docker registry. It's like making a CDN, except instead of individual files, it's for a whole app and all of its dependencies. It's a crazy amount of data for storage and bandwidth.
Well of course you've got to do that in the first place to get people to sign up to the docker model and become dependent on registries in the first place.
Re: Are Package Registries Holding Open-Source Hostage?
#40For anyone interested in opting out of scarf's analytics when installing NPM packages in any of your environments:
https://github.com/scarf-sh/scarf-js#as-a-user-of-a-package-...