Docker to rate limit image pulls

Post by dannyw » Tue, Aug 25, 2020, 1:59 AM UTC

bsamuels wrote: post #47

nrmitchi wrote: post #38

Earlier quoted context omitted.

I don't disagree with what you are saying, _but_: > Docker defines pull rate limits as the number of manifest requests to Docker Hub. > For example, if you already have the image, the Docker Engine client will issue a manifest request, realize it has all of the referenced layers based on the returned manifest, and stop. ... ... So an image pull is actually one or two manifest requests, This still implies that even if…

This is an excellent point. Trying to find out if docker build --pull without an accompanying blob download will trigger the rate limiter. If it does, then this will definitely be a reason to riot. It will effectively mean that anyone who wants to do more than 200 builds every 6 hours using the "right" way will have to get a docker pro subscription.

Post by ed25519FUUU » Tue, Aug 25, 2020, 2:04 AM UTC

viraptor wrote: post #154

young_unixer wrote: post #60

Earlier quoted context omitted.

> Redhat made Podman which is a compatible replacement I would actually prefer if they made an incompatible replacement. Docker's CLI is pretty bad in my opinion. I want to use Docker the same way I use a headless virtual machine running an SSH server. I want starting/exiting containers to be independent from their 'main process'. I want to attach/detach whenever I need to and execute arbitrary processes. -- Just use…

> I want to attach/detach whenever I need to and execute arbitrary processes. Isn't "docker exec -ti container-id /arbitrary/command" enough for that?

Post by [deleted] » Tue, Aug 25, 2020, 2:11 AM UTC

userbinator wrote: post #174

nrmitchi wrote: post #38

Earlier quoted context omitted.

I don't disagree with what you are saying, _but_: > Docker defines pull rate limits as the number of manifest requests to Docker Hub. > For example, if you already have the image, the Docker Engine client will issue a manifest request, realize it has all of the referenced layers based on the returned manifest, and stop. ... ... So an image pull is actually one or two manifest requests, This still implies that even if…

I admittedly have only used Docker very little, but how exactly does someone manage to build images once every 108 seconds continuously for 6 hours ? That sounds extreme.

Post by radlad » Tue, Aug 25, 2020, 2:34 AM UTC

swuecho wrote: post #190

hamiltont wrote: post #110

Earlier quoted context omitted.

Do you run a local registry? Any high-quality articles/youtube talks to share? I'm about to set one up for our own little cluster (~5 machines, ~75 containers). I know tons about docker engine, and a fair bit about the registry, but it's always nice to watch a "lessons learned from actually doing this in production" talk to know what mistakes to avoid

https://docs.docker.com/registry/ you can set it up in less 10 min and the only thing required is to add '--insecure-registry' in your client. It is not a issue if all your machine are in private network.

Post by Sherl » Tue, Aug 25, 2020, 2:44 AM UTC

hamiltont wrote: post #110

ViViDboarder wrote: post #107

Earlier quoted context omitted.

It’s not common to need that many pulls nor is it hard to build your own images. If you’re deploying to a cluster with 200 machines, you could easily hit this if you use the public registry though. However, if you’re managing that size cluster you can probably afford the fee, but more importantly, you should probably pull once to a local registry and use that to deploy to your cluster anyway.

Do you run a local registry? Any high-quality articles/youtube talks to share? I'm about to set one up for our own little cluster (~5 machines, ~75 containers). I know tons about docker engine, and a fair bit about the registry, but it's always nice to watch a "lessons learned from actually doing this in production" talk to know what mistakes to avoid