Docker Desktop no longer free for large companies • Hacker News Board

Re: Docker Desktop no longer free for large companies

#381

Post by mleonhard » Tue, Aug 31, 2021, 10:16 PM UTC

> There's a standards conversion going on where we can trace the provenance of each and every layer of the image, we can start signing those layers, and with that metadata, we can start doing automated decisioning, automated reporting, automated visibility into what's been done to that image at each step of the lifecycle.

Docker's CEO is being disingenuous. When you deploy a Docker container, you specify the image ID. The ID looks like a SHA-256 digest and even starts with the string 'sha256' but it is an arbitrary value generated by the docker daemon on the local machine. The ID is not a hash of the image contents [0, 1]. In other words, docker images are not content-addressed.

Since docker images are not content-addressed, your image registry and image transfer tools can subvert the security of your production systems. The fix is straightforward: make an image ID be the SHA-256 digest of the image contents, which is the same everywhere: on your build system, image registry, test system, and production hosts. This fix will increase supply chain security for all Docker users. It is massive low-hanging fruit.

Now Docker will add image signatures without first making images content-addressed. Their decision makes sense only if their goal is to make money and not make a secure product. I cannot trust a company with such priorities.

[0] https://github.com/moby/moby/issues/39247#issuecomment-49697...

[1] https://github.com/distribution/distribution/issues/1662

EDIT: Added another link.

Re: Docker Desktop no longer free for large companies

#382

Post by nickjj » Tue, Aug 31, 2021, 10:18 PM UTC

zmmmmm wrote: post #376

nickjj wrote: post #371

Earlier quoted context omitted.

> A company could easily have non-employment expenses be 90% of its revenue, so we are talking about $1m or 7-8 person company there on decent salaries Can you give a few real world examples where a $10 million / year revenue company with 7 employees would have difficulty paying $147 a month (or $49 if they went for the $7 / month instead)? With the $7 / month plan (if you only care about DD), the entire annual cost…

Ok, so you're asking about a different point, now, the difficulty of paying. In that case the difficulties arise because of corporate gatekeepers, licensing stewards and general policies governing software licensing. Typically my organisation would not approve this sort of purchase without a business case and justification - not least because we are a not-for-profit and any money not going to our cause is scrutinised…

With Docker, even if 1 dev spent 2 days coming up with a perfect solution that would allow all 7 devs to move away from DD without wasting 1 second of productivity you're still losing out vs sticking with DD at their new annual rates. To me that's a very strong business case.

> Another question: since the price for Docker Desktop already got arbitrarily changed with no notice, why would you believe that it won't go up in the future?

Personally, I'll worry about a future notice when it happens. A meteor could wipe out all of humanity tomorrow but I try not to think of "what ifs".

Re: Docker Desktop no longer free for large companies

#383

Post by [deleted] » Tue, Aug 31, 2021, 10:20 PM UTC

noir_lord wrote: post #223

WhatsName wrote: post #185

Earlier quoted context omitted.

In case you aren't aware, it's easy to explain by that fact that most finance departments are afraid to question your spendings on grounds of looking incompetent. So it's less about 10$ and more about: "I understand what a wireless mouse is and it doesn't look mission critical to me." "No idea what those items on that AWS bill mean, but I'll probably be better off not asking"

“2.4Ghz Laser Based Human Interface Device, $10” seems cheap approved.

[deleted]

Re: Docker Desktop no longer free for large companies

#384

Post by ericpp » Tue, Aug 31, 2021, 10:24 PM UTC

A better strategy to me would've been to keep it free and tightly integrate it with Docker Hub to push people towards Docker Hub services. This software is already installed on most Windows computers that need to use Docker and provides a perfect opportunity to promote Docker Hub and any of their other services.

Re: Docker Desktop no longer free for large companies

#385

Post by rileymichael » Tue, Aug 31, 2021, 10:25 PM UTC

_joel wrote: post #305

techthumb wrote: post #218

Earlier quoted context omitted.

When I want a very specific version if the image, I use the SHA to pull/run $ docker pull hello-world@sha256:7d91b69e04a9029b99f3585aaaccae2baa80bcf318f4a5d2165a9898cd2dc0a1

Or you could tag a little more optimally.

Tags are mutable, digests aren't.

Re: Docker Desktop no longer free for large companies

#386

Post by thegagne » Tue, Aug 31, 2021, 10:25 PM UTC

mfer wrote: post #61

Rancher Desktop is an open source container management and Kubernetes desktop app. https://rancherdesktop.io/ Disclosure: I work on Rancher Desktop. Feedback welcome.

Feedback:

1. There's very little "getting started" info here, you seem to assume everyone already runs kube everywhere else and already has workloads ready to go.

2. Not sure if this is feasible, but I'm looking for something that solves the Docker Desktop problem! I want something that can port map to a local port for testing, I want something that I can map a local folder to in order to store job input/output.

3. I tried starting it, and I'm already running Docker Desktop. It didn't seem to start a healthy kube cluster, and actually did nothing for me but just said it was waiting for the cluster. It might have been attempting to connect to old Docker kube clusters that I'm no longer running. Did I just need to wait longer? It wasn't clear.

Re: Docker Desktop no longer free for large companies

#387

Post by flemhans » Tue, Aug 31, 2021, 10:26 PM UTC

Received an unsolicited mail from them outlining the new terms, with no way to unsubscribe.

Re: Docker Desktop no longer free for large companies

#388

Post by roguecoder » Tue, Aug 31, 2021, 10:27 PM UTC

qeternity wrote: post #130

So many people in this thread don’t understand how enterprise decisions get made. The business license costs $21/month, probably less in reality. Do you really think that businesses are going to jeopardize the workflows of their $250k/year assets over a very core piece of software for $250/year? Any alternative has switching costs and risks. Companies will just pay this. I see so many people saying “just do these 10…

That price is per person, not total. The highest total I've heard so far is going to cost that company $108k a month, for a development tool.

VCs are shooting themselves in the foot here: it is very obvious that we should never adopt any technical tool backed by VC, because they will eventually try to make us an offer we can't refuse and then go out of business shortly thereafter when their extortion attempt doesn't work.

Re: Docker Desktop no longer free for large companies

#389

Post by bspammer » Tue, Aug 31, 2021, 10:31 PM UTC

mleonhard wrote: post #381

> There's a standards conversion going on where we can trace the provenance of each and every layer of the image, we can start signing those layers, and with that metadata, we can start doing automated decisioning, automated reporting, automated visibility into what's been done to that image at each step of the lifecycle. Docker's CEO is being disingenuous. When you deploy a Docker container, you specify the image ID…

The fact that images are not content-addressed is very surprising to me. I just always assumed they were because… why wouldn’t they be? I bet a large proportion of other devs assumed the same.

Re: Docker Desktop no longer free for large companies

#390

Post by wintermutestwin » Tue, Aug 31, 2021, 10:36 PM UTC

namdnay wrote: post #158

qeternity wrote: post #130

So many people in this thread don’t understand how enterprise decisions get made. The business license costs $21/month, probably less in reality. Do you really think that businesses are going to jeopardize the workflows of their $250k/year assets over a very core piece of software for $250/year? Any alternative has switching costs and risks. Companies will just pay this. I see so many people saying “just do these 10…

That’s assuming some kind soul in engineering management has the patience and leverage to guide this through 10 layers of purchasing, procurement, finance, legal etc… Another likely outcome is that it’s “easier” for teams to switch to another tool (easier in that at least they’re not waiting on a third party for approval) and everyone loses a lot of time Big corporations are not the most efficient beasts for this kin…

OpEx is much easier to get vs CapX. That's why so many things are subscription now. (also Sarbaines Oxley pushed vendors into subscription models)