Live data from Hacker News

Changes to Docker Hub Autobuilds

docker.com

21–30 of 53 posts

Re: Changes to Docker Hub Autobuilds

#21
Maybe it is possible to detect the kind of activity or identify processes that are written to mine crypto? Then abort those ones.

I'm thinking of behavior analysis, such as the one some network firewalls do... not sure if that's even feasible at the process level, though.

Re: Changes to Docker Hub Autobuilds

#22
post #21

Maybe it is possible to detect the kind of activity or identify processes that are written to mine crypto? Then abort those ones. I'm thinking of behavior analysis, such as the one some network firewalls do... not sure if that's even feasible at the process level, though.

My understanding is that it's totally feasible, but ends up being a game of cat-and-mouse (just like most security projects).

The question is whether or not it's worth the effort (for Dockerhub). If they were leading in their space, and had a successful business, then maybe, but in the current situation it would be a large investment in providing something for free.

Remember that this change only applies to the free plans, not to anyone paying.

Re: Changes to Docker Hub Autobuilds

#23
post #20

cryptocurrencies are ruining hardware availability (both GPU and now storage devices), the environment and now free cloud services. When are we gonna admit it? EDIT: typo

By cryptocurrencies do you just mean BitCoin? Most new crypto's use proof of stake which doesn't use up GPUs. Not heard it blamed for using up hard drives before.

Chia coin is using Proof of Space. It is growing really fast and not a really good thing. Even cloud providers are reacting to it. See https://blog.scaleway.com/scaleway-and-chia/

Re: Changes to Docker Hub Autobuilds

#24
post #20

cryptocurrencies are ruining hardware availability (both GPU and now storage devices), the environment and now free cloud services. When are we gonna admit it? EDIT: typo

By cryptocurrencies do you just mean BitCoin? Most new crypto's use proof of stake which doesn't use up GPUs. Not heard it blamed for using up hard drives before.

Bitcoin mining also doesn't use GPUs any more, as far as I know that space is almost entirely custom ASICs.

> Most new crypto's use proof of stake

What (of any substantial volume) uses proof of stake at the moment? That's Ethereum's path, but it's not there yet.

Regarding hard drives, I think it's "Chia" that just purposely uses an insane amount of disk space; "proof of space": https://www.theguardian.com/technology/2021/may/26/new-crypt...

Re: Changes to Docker Hub Autobuilds

#25
Sorry, but not really surprised to see this go (for free accounts).

TBH I'm surprised that they managed to keep this going as long as they have. Giving away free compute is a tricky thing to make financially viable.

Re: Changes to Docker Hub Autobuilds

#26

Docker, the company, is such a sad story. They have such an impactful technology but completely failed to monetize it and lost multiple revenue streams to competitors. Shows how hard "open source companies" are. Others OSS companies have similar problems. It would be nice to find economic models where impact is correlated with revenue.

They are hard for sure. Docker did make some fundamental mistakes early on, especially on community engagement and open stable APIs.

It is a shame since I rooted hard for them in the early days.

Re: Changes to Docker Hub Autobuilds

#28

Docker, the company, is such a sad story. They have such an impactful technology but completely failed to monetize it and lost multiple revenue streams to competitors. Shows how hard "open source companies" are. Others OSS companies have similar problems. It would be nice to find economic models where impact is correlated with revenue.

Agreed. Docker (actually, containers in general but docker tooling) made it so damn easy to get local, reproducible builds. It’s fantastic and made life so much easier for me professionally as a Software Engineer.

I remember the early days when Docker had just released, all devs were super excited but nobody had run containers “in production”. AFAIK I believe it was mesos that was used widely for orchestrating containers in production. Docker swarm/compose just took too long to get there and k8s just rapidly took over and became the standard.

Re: Changes to Docker Hub Autobuilds

#29
post #19
post #5

Earlier quoted context omitted.

It's hard to make more money if all people expect is more free service.

I see the dilemma there. Most people I know of treats Docker.com as some kind of infrastructural service, it's like GitHub/GitHub Action+a Package Manager (Registry). For those who use these kind of service, they're expecting some kind of advanced (feature rich) free package for individuals, and a more advanced version for people who makes money out of the image/product they uploaded. So, I think the nature of the se…

If you learn to program with Node.js, one chapter of your tutorial will be to show that NPM is "THE repository for Node packages".

For me, it is part of what makes some of these technologies leaders of what they do. If Node.js has NPM; Rust has Crates.io; and Debian has their repos, why wouldn't Docker have DockerHub? From my POV of 100% user of these technologies, it just seems natural (or at least that's just what they have made us to expect).

Actually what doesn't seem natural is if NPM suddenly deleted old package versions just mere months after they didn't get any download. I know we're talking about containers, which take more disk space than a NPM package... but still, that policy change from Docker Hub felt odd. Now we have to worry about regularly refresh the containers we care about.

(regarding the mantra "you should rebuild them anyway", well, when you want to reproduce a bug, you don't need to rebuild old packages in other repositories, right?)

Re: Changes to Docker Hub Autobuilds

#30
post #21

Maybe it is possible to detect the kind of activity or identify processes that are written to mine crypto? Then abort those ones. I'm thinking of behavior analysis, such as the one some network firewalls do... not sure if that's even feasible at the process level, though.

Most likely not worth it. The product that is being impacted is free to begin with, so the more a company invests into it to building custom filters, the more net negative they are spending, and they are not helping customers (free or paying) either. (ie the cryptocurrency miners will never become paying customer, because they are exploiting the platform specifically because it's free, so building filters means spending money to filter out people who will never be customers anyway.)

I'd rather docker spend engineering time on improving their paid service to legitimate customers.

Post reply on HN