Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Docker is deleting Open Source organisations - what you need to know

blog.alexellis.io

Post reply on HN
Print view View original

471–480 of 764 posts

Re: Docker is deleting Open Source organisations - what you need to know

#471

Post by bravetraveler »

softfalcon wrote: post #355
dbingham wrote: post #230

As an SRE Manager, this is causing me a hell of a headache this morning. In 30 days a bunch of images we depend on may just disappear. We mostly depend on images from relatively large organizations (`alpine`, `node`, `golang`, etc), so one would want to believe that we'll be fine - they're all either in the open source program or will pay. But I can't hang my hat on that. If those images disappear, we lose the abilit…

First of all, want to say, that sounds deeply frustrating. Secondly, if this is a serious worry. I would recommend creating your own private docker registry. https://docs.docker.com/registry/deploying/ Then I would download all current versions of the images you use within your org and push them up to said registry. It’s not a perfect solution, but you’ll be able to pull the images if they disappear and considering t…

As someone who maintains the registries we use globally at work, +1.

I know people groan at running infrastructure, but the registry software is really well documented and flexible.

If you don't need to 'push', but only pull - configuring them as pull through caches is nice for availability and reliability -- while also saving from nickle/diming.

They will get things from a configurable upstream, proxy.remoteurl.

Contrary to what the documentation says, this can work with anything speaking the API. Not just Dockerhub.

edit: My one criticism, it's not good from an HTTPS hardening perspective. It's functional, but audits find non-issues.

You'll want nginx or something in front to ensure good HSTS header coverage for non-actionable requests, for example.

Re: Docker is deleting Open Source organisations - what you need to know

#472

Post by grumple »

twblalock wrote: post #447

It was sad to see people defending Docker Desktop changing from free to paid licenses. Now Docker is charging for even more things that used to be free. The defenders are reaping what they have sown. Next time a company starts to charge for things that used to be free, remember not to encourage it, because that will only make it happen more. People don't like this and many of them are not going to trust Docker in the…

Nothing a company does is free to them. To expect them to provide a free service at all, let alone one with high costs associated with it, is not reasonable. They don't owe the world free service, same for any other company.

Re: Docker is deleting Open Source organisations - what you need to know

#473

Post by zxcvbn4038 »

The OP goes through a lot of trouble to obscure they are asking for $35 a month, which honestly I think most people can afford, even if its open source software they develop only out of kindness. So I'm not really buying that argument.

That said I don't really want to reward Docker for writing themselves in as the distribution hub for all things docker and then more or less extorting money from people.

I think the solution is don't give Docker a dime, just run your own registry in Digital Ocean, thats $5/m. If we can front the registry server with a CDN then its potentially free.

Re: Docker is deleting Open Source organisations - what you need to know

#474

Post by chordalkeyboard »

rcme wrote: post #425
Strom wrote: post #408

Earlier quoted context omitted.

There is no real distinction between those two phrases here, because the person using those phrases isn't ultimately in control.

Even if they were fully in control, there still would not be a distinction because whoever is controller this decision could change their mind at a later date.

the difference is that the person in control would be attesting to their state of mind, versus the person out of control attesting to their understanding of the relevant circumstances.

Re: Docker is deleting Open Source organisations - what you need to know

#475

Post by PedroBatista »

The truth is Docker ( the company ) could never capitalize the success of their software. They clearly need the money and I have the impression things have not been "great" in the last couple of years. ( regardless of reasons )

The truth is also the fact that most people/organizations never paid a dime for the software or the service, and I'm talking about Billion dollar organizations that paid ridiculous amounts of money for both "DevOps Managers" and consultants but the actual source of the images they pull are either from "some dude" or some opensource orgs.

I get that there will be many "innocent victims" of the circumstances but most people who are crying now are the same ones who previously only took, never gave and are panicking because as Warren Buffett says: "Only when the tide goes out do you discover who's been swimming naked."

And there are a lot of engineering managers and organizations who like to brag with expressions like "Software supply chains" and we'll find out who has been swimming with their willy out.

Re: Docker is deleting Open Source organisations - what you need to know

#476

Post by TheRealDunkirk »

zxcvbn4038 wrote: post #473

The OP goes through a lot of trouble to obscure they are asking for $35 a month, which honestly I think most people can afford, even if its open source software they develop only out of kindness. So I'm not really buying that argument. That said I don't really want to reward Docker for writing themselves in as the distribution hub for all things docker and then more or less extorting money from people. I think the so…

> I don't really want to reward Docker for writing themselves in as the distribution hub for all things docker and then more or less extorting money from people.

I finally bit the bullet and paid for YouTube Premium. The ad "experience" on YouTube has become so abysmal and unblockable, that to use it at all really forces you into it. I had a hard time expressing why this was so aggravating -- considering that I see literally 5 other streaming services I pay for on the same launch screen -- but this really nails it. It's the same monopolize-for-free-and-then-charge-and-extract-all-rent-forever move at the heart of every digital service now.

Re: Docker is deleting Open Source organisations - what you need to know

#477

Post by jjav »

dbingham wrote: post #230

As an SRE Manager, this is causing me a hell of a headache this morning. In 30 days a bunch of images we depend on may just disappear. We mostly depend on images from relatively large organizations (`alpine`, `node`, `golang`, etc), so one would want to believe that we'll be fine - they're all either in the open source program or will pay. But I can't hang my hat on that. If those images disappear, we lose the abilit…

> If those images disappear, we lose the ability to release and that's not acceptable.

This shines light on why it is so risky (from both availability and security perspectives) to be dependent on any third party for the build pipeline of a product.

I have always insisted that all dependencies must be pulled from a local source even if the ultimate origin is upstream. I am continuously surprised how many groups simply rely on some third party service (or a dozen of them) to be always and perpetually available or their product build goes boom.

Re: Docker is deleting Open Source organisations - what you need to know

#478

Post by Woodi »

friendzis wrote: post #333
dbingham wrote: post #230

As an SRE Manager, this is causing me a hell of a headache this morning. In 30 days a bunch of images we depend on may just disappear. We mostly depend on images from relatively large organizations (`alpine`, `node`, `golang`, etc), so one would want to believe that we'll be fine - they're all either in the open source program or will pay. But I can't hang my hat on that. If those images disappear, we lose the abilit…

> If those images disappear, we lose the ability to release and that's not acceptable. left-pad moment once again. > I mean, 30 days isn't enough time to find alternatives and migrate. Maybe take control of mission critical dependencies and self-host?

> Maybe take control of mission critical dependencies and self-host?

Last few years prove that this option is a no-go - they just don't do such things ! Independence ? Self-sufficiency ? Security ? Local, fast access ? Obviousness ? No payment required ? Avoid at all costs !

Re: Docker is deleting Open Source organisations - what you need to know

#479

Post by sangnoir »

cpitman wrote: post #412
dbingham wrote: post #230

As an SRE Manager, this is causing me a hell of a headache this morning. In 30 days a bunch of images we depend on may just disappear. We mostly depend on images from relatively large organizations (`alpine`, `node`, `golang`, etc), so one would want to believe that we'll be fine - they're all either in the open source program or will pay. But I can't hang my hat on that. If those images disappear, we lose the abilit…

Many of the responses here are talking about how to vendor/cache images instead of depending on an online registry, but remember that you also need access to a supply chain for these images. Base images will continue to be patched/updated, and you need those to keep your own images up to date. Unless the suggestion is to build all images, from the bottom up, from scratch.

It's a stop-gap measure. There are dozens of companies chomping at the bit to replace Docker as THE docker registry: I'd bet someone at Github is very busy at this very moment.
Post reply on HN