Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Docker to rate limit image pulls

docker.com

Post reply on HN
Print view View original

211–220 of 274 posts

Re: Docker to rate limit image pulls

#211

Post by kortex »

LockAndLol wrote: post #142

Yes, good. After reading the comments on their image retention limits [0] talking about simply pulling the images all the time to keep them fresh, this seems like a reasonable response. I'll repeat what I wrote there [1]: If people really think this is a problem, they'd contribute a non-abusive solution. Writing cron jobs to pull periodically in order to artificially reset the timer is abusive. Non-abusive solutions…

> introduce reproducible image builds

This is a great idea in concept, but in practice very challenging.

RUN curl https://www.random.org/integers/?num=1&min=1&max=99999

Docker will cache this after the first invocation. The build is not reproducible. Now what?

Replace "curl random.org" with "nondeterministic and really expensive code build/model training/etc operation".

> extending docker push and pull to allow discovery from different sources that use different protocols like IPFS, TahoeLAFS, or filesharing hosts

This is great, if you can solve the image integrity/trust issues therein, which should be just some signing/merkle tree work.

Re: Docker to rate limit image pulls

#212

Post by judge2020 »

Leo_Verto wrote: post #189
nickjj wrote: post #54

Does anyone have any good ideas on how the Docker Hub could be monetized in a way that's user friendly and makes sense? AWS, GCP, Azure, DigitalOcean and even GitHub / GitLab all have private container registry offerings. If your stack is on X provider, chances are you're going to use their private registry service instead of using the Docker Hub because you've gone all-in with that provider. That means private repos…

Currently the state of Github Packages' Docker UX is terribly and ironically it doesn't integrate well with Github Actions (or at least it didn't when I tried it to months ago).

And the pricing is still horrible. $0.25/gb for storage and $0.50/gb for data transfer is pretty rough since you end up pushing even Docker Hub image layers to GHP.

Re: Docker to rate limit image pulls

#213

Post by manquer »

oppositelock wrote: post #125
hamiltont wrote: post #110

Earlier quoted context omitted.

Do you run a local registry? Any high-quality articles/youtube talks to share? I'm about to set one up for our own little cluster (~5 machines, ~75 containers). I know tons about docker engine, and a fair bit about the registry, but it's always nice to watch a "lessons learned from actually doing this in production" talk to know what mistakes to avoid

I run tens of thousands of docker images in production, or rather, tens of thousands of copies of a few hundred images. If you do something like this, you absolutely MUST have a local registry. Harbor [1], JFrog [2], and Quay [3] would be the first ones that I look at. Harbor is open source, free, and a member of the CNCF. You will need to do a little bit of work to set it up to scale properly. JFrog offers a SaaS re…

Just to add all the major cloud service providers provide registries ACR /ECR/GCR etc . If you run k8s service with one of the them in my experience it is best to use the corresponding registry.

I have pulled and run 20k times a 1GB image in less than 10-15 minutes without breaking a sweat.

Finally GitHub packages offers a registry out of the box . It is great for CI and devs to access . I generally have the tags mirrored from tags GitHub for production to ACR .

Re: Docker to rate limit image pulls

#214

Post by efreak »

spockz wrote: post #81
rhacker wrote: post #80

Ugh, I don't envy their position. There are many ways to reduce the size of a docker image. I'm guilty too. Probably the best thing to do is leverage multi-stage builds. Those have the largest effect on repo size. (Like a 10x reduction often). The problem is, docker, the company behind the repo, has no control over what Open Source Joe and Developer Suzy are committing and the other developers pulling down their imag…

Well, they could use different rate limits depending on the size of the image. Say if the image size (or the size of the added layers) is in line with what we want for dockers you could offer different rates. Unlimited for images Or people will just add a proxy/imagestream in between instead of directly pulling from docker hub.

Or you just do it the easy way and limit the speed based on the amount of data downloaded so far, with the history being 'lost' after 6 hours. This way you also prevent someone from doing dumb things to get around it, like using multiple connections (or in this case, multiple layers for a project that doesn't actually need them)

Re: Docker to rate limit image pulls

#215

Post by megous »

efreak wrote: post #188
hamiltont wrote: post #110

Earlier quoted context omitted.

Do you run a local registry? Any high-quality articles/youtube talks to share? I'm about to set one up for our own little cluster (~5 machines, ~75 containers). I know tons about docker engine, and a fair bit about the registry, but it's always nice to watch a "lessons learned from actually doing this in production" talk to know what mistakes to avoid

Personally, I wish generic caching proxies were still a thing, and easier to set up. I've tried setting up squid several times in the past, and failed miserably every single time--all I want to do is use it as a gateway (ie, make the proxy invisible to the application) for e.g. apt packages, so I just ended up using apt-cache or whatever other appropriate software, but I'd far rather use something generic that just w…

I use nginx to proxy cache the Arch Linux package repository transparently. It's fairly easy to set up, and enables nice features like contacting a secondary mirror if the first one is down, or when multiple requests hit the same resource, all are blocked waiting for a single merged package download, so the proxy will not make the download multiple times if I run pacman -Syu on my 18 machines in parallel. And it's all just 20-30 lines of nginx config.

It's not transparent though.

Re: Docker to rate limit image pulls

#216

Post by spockz »

efreak wrote: post #214
spockz wrote: post #81

Earlier quoted context omitted.

Well, they could use different rate limits depending on the size of the image. Say if the image size (or the size of the added layers) is in line with what we want for dockers you could offer different rates. Unlimited for images Or people will just add a proxy/imagestream in between instead of directly pulling from docker hub.

Or you just do it the easy way and limit the speed based on the amount of data downloaded so far, with the history being 'lost' after 6 hours. This way you also prevent someone from doing dumb things to get around it, like using multiple connections (or in this case, multiple layers for a project that doesn't actually need them)

That is possible but it means distributing the total amount of data to all the nodes. Luckily it doesn’t require correctness but it is more complicated to setup regardless.

Re: Docker to rate limit image pulls

#218

Post by stingraycharles »

boudin wrote: post #93
stingraycharles wrote: post #76

Earlier quoted context omitted.

Surprised to see Docker-in-Docker mentioned so deeply down here. It’s an extremely valid way of doing things, and non-trivial to implement a caching layer for.

Usually docker outside of docker is used, no? If the image is cached on the host, it would be available to any container having access to the docker daemon socket as well since it's the same daemon.

No that’s only the case if you mount the Docker socket into the container, which is not what Docker-in-Docker is.

Re: Docker to rate limit image pulls

#219

Post by zelly »

This is the future of containers:

https://guix.gnu.org/

https://nixos.org/

You can build a Docker-compatible image from a Guix or Nix package. You never have to use Docker or Docker Hub.

The limitation of Docker is that the nice semi-reproducible sandbox you get exists on top of an operating system that was not designed for it, resulting in giant blobs to get it to work. It's inefficient and a band-aid stopgap until we get to the future where the operating system is a pure function (which can be versioned in a tree, diffed, reverted, etc. just like git). If you used NixOS, you wouldn't need Docker. Sure, it's available and you can use it, but you wouldn't need to.

Re: Docker to rate limit image pulls

#220

Post by stjohnswarts »

msla wrote: post #109
rubyn00bie wrote: post #99

I originally came here to ask how folks use that many docker images in six hours (I'm mostly a Docker n00b, and not being facetious); however, after reading the article, I clicked to see how much unlimited is and it's $5 a month. Now my question has changed to: is $5 a month really a deal breaker for folks to get unlimited? Or what are the use cases where the cost is prohibitive? Open source or community projects? In…

$5/month isn't $5/month. It's convincing your boss you need $5/month, because they need to convince their boss, which eventually makes its way up the chain to C-levels, who don't know Docker from yesterday's rotting tuna casserole and view eating either that or the $5/month with the same level of disdain. It isn't about the money, it's about the Mommy-May-I up and down the chain with emails and meetings and careful e…

If you work for a company that disconnected from reality you best be looking for a new job. $5 the guy who decides budget should be angry that you didn't come with him directly for such a tiny amount of money.
Post reply on HN