Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Docker to rate limit image pulls

docker.com

Post reply on HN
Print view View original

111–120 of 274 posts

Re: Docker to rate limit image pulls

#111

Post by lights0123 »

bsamuels wrote: post #39
jtsiskin wrote: post #33

Earlier quoted context omitted.

What is the issue here? Is the torrent checksum (provided by docker) not enough?

Let's say someone hacks a maintainer for the Ubuntu base image. The hacker publishes a new version of the base image with a backdoor. When the backdoor is detected, you now need a revocation system so the distribution of the malicious image will die. You can theoretically do this on the tracker level, but people may build other trackers that may not propagate the changes.

You still would have a centralized manifest system though, right? It shouldn't hurt Docker much at all to host a few KBs of data describing the hash of each layer, which is still fetched every time, just big downloads are done over torrents.

Re: Docker to rate limit image pulls

#112

Post by kinghajj »

eblanshey wrote: post #106
pbalau wrote: post #95

Earlier quoted context omitted.

Isn't Docker-in-Docker actually using the host's Docker daemon? I am mounting the docker socket in all my Docker-in-Docker containers, thus all the build tasks running on the same host can share the caches. I guess one could have docker containers that actually run docker, but I don't see a reason to do that...

I was wondering how Docker-in-Docker works, but I couldn't find it dockermented anywhere. If it's using the host's Docker daemon, why do you need to mount the docker socket?

Docker-in-Docker (DinD) doesn't piggy back on the host's Docker daemon, but instead runs a stripped-down Docker daemon inside of the container. The major downside is that I/O is quite slow, since you're going through two virtualization layers (the DinD one, plus the host Docker daemon).

Re: Docker to rate limit image pulls

#113

Post by msla »

klodolph wrote: post #103
rubyn00bie wrote: post #99

I originally came here to ask how folks use that many docker images in six hours (I'm mostly a Docker n00b, and not being facetious); however, after reading the article, I clicked to see how much unlimited is and it's $5 a month. Now my question has changed to: is $5 a month really a deal breaker for folks to get unlimited? Or what are the use cases where the cost is prohibitive? Open source or community projects? In…

I don’t think anyone who’s adopted systemd can call themselves a curmudgeon :)

Sometimes, curmudgeonliness is measured in resistance to changing the default:

"Stock CentOS was good enough before and it's good enough now!"

Re: Docker to rate limit image pulls

#115

Post by eblanshey »

jpalomaki wrote: post #8

I guess CI services like Github Actions could be easily hitting these limits (100 pulls per IP per 6 hours).

I'm thinking the same thing. GitLab has shared CI runners that probably do a lot of image pulling. Hopefully they have plans to implement their own docker registry cache.

Re: Docker to rate limit image pulls

#116

Post by lights0123 »

jpalomaki wrote: post #8

I guess CI services like Github Actions could be easily hitting these limits (100 pulls per IP per 6 hours).

I would imagine that GitHub would work out something with Docker to either pay themselves or have some way of caching images themselves.

They could just inject their own TLS certificates into their VMs and then intercept Docker requests for images with their own cache.

Re: Docker to rate limit image pulls

#117

Post by eblanshey »

kinghajj wrote: post #112
eblanshey wrote: post #106

Earlier quoted context omitted.

I was wondering how Docker-in-Docker works, but I couldn't find it dockermented anywhere. If it's using the host's Docker daemon, why do you need to mount the docker socket?

Docker-in-Docker (DinD) doesn't piggy back on the host's Docker daemon, but instead runs a stripped-down Docker daemon inside of the container. The major downside is that I/O is quite slow, since you're going through two virtualization layers (the DinD one, plus the host Docker daemon).

Will mounting the socket, as the person I replied to suggested, make it use the host's docker daemon?

Re: Docker to rate limit image pulls

#118

Post by paxys »

rubyn00bie wrote: post #99

I originally came here to ask how folks use that many docker images in six hours (I'm mostly a Docker n00b, and not being facetious); however, after reading the article, I clicked to see how much unlimited is and it's $5 a month. Now my question has changed to: is $5 a month really a deal breaker for folks to get unlimited? Or what are the use cases where the cost is prohibitive? Open source or community projects? In…

Anything is a deal breaker if the user expects to pay nothing. That is why going from free to $1/month will have a much larger user dropoff than, say, $1 to $10.

Re: Docker to rate limit image pulls

#119

Post by mm89 »

temikus wrote: post #105
rubyn00bie wrote: post #99

I originally came here to ask how folks use that many docker images in six hours (I'm mostly a Docker n00b, and not being facetious); however, after reading the article, I clicked to see how much unlimited is and it's $5 a month. Now my question has changed to: is $5 a month really a deal breaker for folks to get unlimited? Or what are the use cases where the cost is prohibitive? Open source or community projects? In…

It may be general resistance to a concept. More and more services are becoming subscription based, so 5$ here, 5$ there and the cost creeps further.

Exactly.

It's hard enough to save money as it is.

News websites blow my mind with this - if I forked over $5 to every news outlet I occasionally like to read, I'd be spending at least $500 maybe more per year JUST to get access to some random person's biased recant of what's happening in the world. If there were a news source that did the opposite of this, and basically provided a bullet list of objective, non-biased events boiled down to exactly what I need to know, that might be something I'd pay for. Hell, it would save you time over filtering the opinionated BS out.

Re: Docker to rate limit image pulls

#120

Post by cpuguy83 »

pbalau wrote: post #95
stingraycharles wrote: post #76

Earlier quoted context omitted.

Surprised to see Docker-in-Docker mentioned so deeply down here. It’s an extremely valid way of doing things, and non-trivial to implement a caching layer for.

Isn't Docker-in-Docker actually using the host's Docker daemon? I am mounting the docker socket in all my Docker-in-Docker containers, thus all the build tasks running on the same host can share the caches. I guess one could have docker containers that actually run docker, but I don't see a reason to do that...

No Docker-in-Docker would generally refer to running a new dockerd inside of a container.
Post reply on HN