Docker is deleting Open Source organisations - what you need to know • Hacker News Board

Re: Docker is deleting Open Source organisations - what you need to know

#141

Post by 5e92cb50239222b » Wed, Mar 15, 2023, 1:20 PM UTC

JeremyNT wrote: post #125

FlyingSnake wrote: post #31

> Start publishing images to GitHub And when GitHub starts similar shenanigans, move out to where? I am old enough to know the we can't trust BigTech and their unpredictable behaviors. Eventually we need to start a Codeberg like alternative using Prototype funds to be self reliant. 1: https://codeberg.org/ 2: https://prototypefund.de/

It actually seems pretty reasonable to let BigTech host stuff, so long as you know the rug pull is going to come. Let the VCs light money on fire hosting the stuff we use for free, then once they stop throwing money at it figure out a plan B. Of course you should have a sketch of your plan B ready from the start so you are prepared. If you view all of this "free" VC subsidized stuff as temporary/ephemeral you can sti…

This is how I've been living for many years and it has saved me many thousands of dollars, which is a significant amount of money here. The various "cloud" free tiers cost them at least $600 for the past year alone. Same for free CI offerings, etc. Thank you VCs and BigCo for not cutting out regions that are probably net negative for you overall (I guess it may be serious money for me, but doesn't even register on the radar at their scale).

Re: Docker is deleting Open Source organisations - what you need to know

#142

Post by Anarch157a » Wed, Mar 15, 2023, 1:21 PM UTC

jacooper wrote: post #62

spicyusername wrote: post #35

Earlier quoted context omitted.

ideally a coop of some variety This is the role I feel like podman, the tool developed by Red Hat, is filling.

Its not as easy nor as simple as docker + docker compose.

podman + podman-compose is as easy.

Re: Docker is deleting Open Source organisations - what you need to know

#143

Post by mikepurvis » Wed, Mar 15, 2023, 1:22 PM UTC

wvh wrote: post #131

londons_explore wrote: post #36

Earlier quoted context omitted.

Docker should have been a neat tool made by one enthusiast, just like curl is. Instead it has a multi-million dollar company behind it, and VC's who demand profits from a thing that shouldn't have ever had a business plan.

In all fairness, curl is purely a software tool. Docker is arguably more like a service. As such, it creates costs for and direct dependency on the entity behind it.

Lots of orgs figure out how to piggy back the “service” part of whatever they’re doing on free or sponsored infrastructure, though. Homebrew, for example, has been doing a lot of the same stuff on Travis and GH Actions since forever.

Re: Docker is deleting Open Source organisations - what you need to know

#144

Post by numbsafari » Wed, Mar 15, 2023, 1:22 PM UTC

You don't go to war with the army you want, you go to war with a menagerie images built and generated by random strangers on the internet your team found in stack overflow posts.

Re: Docker is deleting Open Source organisations - what you need to know

#145

Post by roydivision » Wed, Mar 15, 2023, 1:22 PM UTC

Docker should never have become a business. There’s virtually nothing there to make a business around, it’s a suite of useful utilities that should have remained a simple open source project. I switched to podman a while ago and haven’t looked back.

Re: Docker is deleting Open Source organisations - what you need to know

#146

Post by schneems » Wed, Mar 15, 2023, 1:24 PM UTC

martypitt wrote: post #139

I think it's an interesting challenge with FOSS infrastructure in general, and I'm surprised it isn't more of an issue. Docker's storage is heavier than most, but what about other repositories like maven central, and npm? There must be significant costs associated with running those. These tools are all the backbone of modern software dev, and need a business model. It's reasonable that consumers should pay for the b…

RubyCentral pays the bills for rubygems.org. It’s a non-profit (501c3, not a 501c9). I believe you can buy an individual subscription to Ruby Central. Also profits from their conferences: RailsConf and RubyConf go towards funding infra (and paying people to wear the pager too).

Re: Docker is deleting Open Source organisations - what you need to know

#147

Post by pimterry » Wed, Mar 15, 2023, 1:25 PM UTC

shaunn wrote: post #86

pimterry wrote: post #29

Earlier quoted context omitted.

Unlike Docker Inc, GitHub (via Microsoft) do have very deep pockets & their own entire cloud platform, so they can afford to do this forever if they choose. And their entire marketing strategy is built around free hosting for public data, so it'd take a major shift for this to disappear. Not to say it's impossible, but it seems like the best bet of the options available. Is it practical to set up a redirect in front…

I like where your head is at; I found this [1] and it makes a case that an attack vector may be created. [1] https://stackoverflow.com/a/67351972

That's different - that's about changing the _client_ configuration. I'm looking to change the server instead, so that the client can use an unambiguous reference to an image, but end up at different registries depending on the server configuration. In a perfect world, Docker Hub would let you do this to migrate community projects away, but even just being able to manually change references now to a registry-agnostic URL would be a big help.

Shouldn't be any security risk there AFAICT. Just hard to tell if it's functionally supported by typical registry clients or if there are other issues that'd appear.

Re: Docker is deleting Open Source organisations - what you need to know

#148

Post by CGamesPlay » Wed, Mar 15, 2023, 1:25 PM UTC

JonChesterfield wrote: post #52

My first thought on this was good riddance. The dev model of "we've lost track of our dependencies so ship Ubuntu and a load of state" never sat well. However it looks like the main effect is going to be moving more of open source onto GitHub, aka under Microsoft's control, and the level of faith people have in Microsoft not destroying their competitor for profit is surreal.

What state are you thinking of? The containers are ephemeral and the dependencies are well specified in it. You can complain about shipping Ubuntu, but the rest of this doesn’t make sense.

Re: Docker is deleting Open Source organisations - what you need to know

#149

Post by mikepurvis » Wed, Mar 15, 2023, 1:26 PM UTC

javajosh wrote: post #129

windexh8er wrote: post #101

Earlier quoted context omitted.

Podman is interesting. I like the architecture problems it solves with respect to Docker but the way they went about it was typical big business Red Hat. Dan Walsh, Podman's BDFL it seems, basically stood in front of RHEL / OpenShift customers for years bashing Docker even when a majority of the things he was claiming were less than half baked. RHEL made sly moves like not supporting the Docker runtime, even at a tim…

>I don't want to live in Red Hat's world, with their tooling that they can just lock out of other platforms once they feel like it Explain please. This sounds like you're accusing RH of sabotaging Docker, or planning to. That's a very serious accusation requiring proof.

Some of it also sounds a bit like leftover angst from Red Hat winning the systemd war too.

Turns out hanging out in someone else’s cathedral can have some pretty big benefits.

Re: Docker is deleting Open Source organisations - what you need to know

#150

Post by acdha » Wed, Mar 15, 2023, 1:26 PM UTC

nrvn wrote: post #118

After Docker announced rate limiting for the hub this was an anticipated move. Was just the matter of time. The only recommendation to everyone: move away or duplicate. One of the strategies I am yet to test is the synchronization between gitlab and github for protected branches and tags and relying on their container registries. Thus (at least) you provide multiple ways to serve public images for free and with relat…

> Mirroring images is the primary way, reproducing is the fallback option and also helps to verify the integrity.

I suspect the latter will become more common over time. I can count on no fingers the number of open source projects which I’ve encountered which have production-grade container images. Once you need to think about security you need to build your own containers anyway and once you’ve done that you’ve also removed the concern of a public registry having issues at an inopportune moment.