Its pretty easy to setup a Github Action that mirrors images to a private registry. We use this to mirror to GCP Artifact registry: https://zuplo.com/blog/2023/03/15/mirroring-docker-images-wi...
Docker is deleting Open Source organisations - what you need to know
461–470 of 764 posts
Re: Docker is deleting Open Source organisations - what you need to know
#462> Start publishing images to GitHub And when GitHub starts similar shenanigans, move out to where? I am old enough to know the we can't trust BigTech and their unpredictable behaviors. Eventually we need to start a Codeberg like alternative using Prototype funds to be self reliant. 1: https://codeberg.org/ 2: https://prototypefund.de/
Maybe we all start hosting this stuff via torrent or something?
Re: Docker is deleting Open Source organisations - what you need to know
#463Earlier quoted context omitted.
I read the travel issues post you linked, but am not seeing the causal link you’re drawing between development of software and visa issues. Was there more to the story?
I may have remembered incorrectly, which post was it. Here[1], in the paragraph titled "Why they deny me?" (unlinkable), Daniel hints at the possibility that this may have been due to development of (lib)curl which is used for malware creation by 3rd parties. There was no proof though. [1] https://daniel.haxx.se/blog/2018/07/28/administrative-purgat...
The most superficial (and likely) reason to me seems to be that he uses haxx.se. I really wonder what kind of investigation they do. If they just start with Google, this one might come up immediately.
Re: Docker is deleting Open Source organisations - what you need to know
#464Profit motive above all else is fundamentally incompatible with the social engine that powers the open source community. It always has been and always will be. I'm no longer surprised, but im still disappointed.
> Profit motive above all else is fundamentally incompatible with the social engine that powers the open source community.
Its not. Freemium format works splendidly in various ecosystems, one of the biggest being WordPress. It enabled WP ecosystem to fund itself without VC or investor money and grow. Real indie growth. So its possible.
Without the funding from its own userbase to sustain itself, Open Source projects just flop eventually. Few remain if they are way too big or if they can get corporate sponsors. Thats not being 'free'. Real freedom is in Open Source being funded by its users without the unreliable mechanism of donations.
Re: Docker is deleting Open Source organisations - what you need to know
#465As an SRE Manager, this is causing me a hell of a headache this morning. In 30 days a bunch of images we depend on may just disappear. We mostly depend on images from relatively large organizations (`alpine`, `node`, `golang`, etc), so one would want to believe that we'll be fine - they're all either in the open source program or will pay. But I can't hang my hat on that. If those images disappear, we lose the abilit…
if you haven't mirrored the docker images your application needs to a private registry, then you are doing it wrong.
Re: Docker is deleting Open Source organisations - what you need to know
#466Please dont forget that you can cache all these images in your own registry! you will still have to worry about how to get updates, but set up a private registry and deal with this on your on time! As a side node, Rancher desktop is good enough. Docker has repeatedly demonstrated that they just where the first ones and not by any means the best ones.
Any tips to running your own registry? e.g. what registry software/package do you use?
I think when I looked into this in the past, I couldn't find anything suitable. A quick search now brings up https://hub.docker.com/_/registry, but considering the content of the article, not sure how I feel about it
Re: Docker is deleting Open Source organisations - what you need to know
#467Earlier quoted context omitted.
It actually sounds reasonable to me? They have an open source program, the article says its open source definition is "too strict" because it says you must have "no pathway to commercialization". I mean why should you expect someone to host gigabytes of docker images for you, for free?
While I have no _expectations_ of free hosting, one example of a project that will be affected is mine – https://hub.docker.com/repository/docker/outlinewiki/outline I have been building this for 5+ years, and offer a community edition for free while the hosted version is paid. Once the community edition starts costing money there will be even less reason to continue supporting it, it already causes a lot of extra wo…
> Once the community edition starts costing money there will be even less reason to continue supporting it
This is exactly the reasoning Docker is using, so it seems reasonable?
Re: Docker is deleting Open Source organisations - what you need to know
#468Docker the tool has been a massive benefit to software development, every now and then I have a moan about the hassle of getting something bootstrapped to run on Docker, but it's still worlds better than the old ways of managing dependencies and making sure everyone on a project is aligned on what versions of things are installed. Unfortunately Docker the company appears to be dying, this is the latest in a long line…
Can't comment specifically on this or that "dying company", but it is a bit disappointing that after, how many, four decades of open source? and the obvious utility of that paradigm, it still seems a major challenge to build sustainable open source ecosystems. This means we can't really move on and imagine grander things that might build on top of each other. Its not clear if that is due to: i) competition from propr…
It's still doing better than it could be. Big tech companies have played way nicer than they had to, focusing more on vague long-term presence than on immediate profits, and imo continue to do so to a lesser extent. There always comes a point when the innovation is done and they lock things down again, but even then they have to fight their own employees.
Re: Docker is deleting Open Source organisations - what you need to know
#469Squatting and the effects of malware and poison images is my primary concern here. One of the things the docker api has going for it is that it is hash based. Aside from the first time, it doesn’t seem far fetched for a docker api client to refuse or warn based on comparing the new download’s hash to the previous hash.
Not a lot of people pull by hash; they pull by tag. Tags are not immutable, so the image I get from "python:3.11" today will almost certainly change due to security updates and I will be none the wiser.
I can see that. A human specifiable name is important.
My proposal is that each time an image is pulled, the hash is recorded and retained even if the underlying container image is removed. When the same image is pulled again, if the files change from the previous hash, either fail or warn the user.
I can see how pinning to a specific patch version is not a great idea and that "python:3.11" keeps people from pinning to an insecure version.
Re: Docker is deleting Open Source organisations - what you need to know
#470Earlier quoted context omitted.
Come on, 30 days notice is a walk in the park. Additionally, OP was the one complaining that changing a few URLs and eventually spinning up a new server. It's quite literally a one day or two job, unless you're at a company the size of Amazon (in which case, luckily for you, you're not the only SRE, so it's still just a few days). > The best I can come up with, at the moment, is waiting for each organization to make…
> Come on, 30 days notice is a walk in the park Sure, maybe in a small business or startup, and even then I'd content not quite as easy as all that. When you're dealing with anything larger, say involving multiple teams, organisations, and priorities, 30 days is an insanely short shrift to look at figuring out what your actual route forwards is (and if you're provisioning something new, making sure you're allowed to…
At this size you should have a local registry that acts as a transparent cache. If you don't, then get one right now. What happens if Docker's servers are down for whatever reason? Does your whole process break?