Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Docker to rate limit image pulls

docker.com

Post reply on HN
Print view View original

221–230 of 274 posts

Re: Docker to rate limit image pulls

#221

Post by [deleted] »

radlad wrote: post #198
Spivak wrote: post #165

Earlier quoted context omitted.

You’re missing the point. If there’s a news source that you occasionally read then it’s far more cost effective for you to just buy the paper at the stand for 50¢ the few times you want it. Same with magazines. If you read every newspaper then getting lower cost and delivery in return for the paper getting consistent revenue is a good deal for both parties. If you get your news like most people, via link aggregators…

It would be neat if news sites would start offering 50 cent day passes instead of difficult to cancel subscriptions.

[deleted]

Re: Docker to rate limit image pulls

#222

Post by stjohnswarts »

zelly wrote: post #219

This is the future of containers: https://guix.gnu.org/ https://nixos.org/ You can build a Docker-compatible image from a Guix or Nix package. You never have to use Docker or Docker Hub. The limitation of Docker is that the nice semi-reproducible sandbox you get exists on top of an operating system that was not designed for it, resulting in giant blobs to get it to work. It's inefficient and a band-aid stopgap until…

It works fine though and a lot of companies have valuable time and process built on top of it. However I'm all for natural selection, if these are better products may the the best container win

Re: Docker to rate limit image pulls

#223

Post by swuecho »

radlad wrote: post #197
swuecho wrote: post #190

Earlier quoted context omitted.

https://docs.docker.com/registry/ you can set it up in less 10 min and the only thing required is to add '--insecure-registry' in your client. It is not a issue if all your machine are in private network.

Isn't there no authentication on that registry? I guess that's fine if you don't believe in zero-trust architecture.

you are right. That is what you can get in minutes.

Re: Docker to rate limit image pulls

#224

Post by ztjio »

manquer wrote: post #213
oppositelock wrote: post #125

Earlier quoted context omitted.

I run tens of thousands of docker images in production, or rather, tens of thousands of copies of a few hundred images. If you do something like this, you absolutely MUST have a local registry. Harbor [1], JFrog [2], and Quay [3] would be the first ones that I look at. Harbor is open source, free, and a member of the CNCF. You will need to do a little bit of work to set it up to scale properly. JFrog offers a SaaS re…

Just to add all the major cloud service providers provide registries ACR /ECR/GCR etc . If you run k8s service with one of the them in my experience it is best to use the corresponding registry. I have pulled and run 20k times a 1GB image in less than 10-15 minutes without breaking a sweat. Finally GitHub packages offers a registry out of the box . It is great for CI and devs to access . I generally have the tags mir…

Looking at doing GitHub Packages for direct-to-dev and mirroring into ECR over here. Seems sound. But also considering other options as ECR is a pain to work with.

That said, word of warning for anyone looking at GitHub Packages for docker registry: it's broken with containerd and some other similar tools. They (GitHub) are currently working on a fix: https://github.com/containerd/containerd/issues/3291

Re: Docker to rate limit image pulls

#225

Post by threeseed »

manquer wrote: post #213
oppositelock wrote: post #125

Earlier quoted context omitted.

I run tens of thousands of docker images in production, or rather, tens of thousands of copies of a few hundred images. If you do something like this, you absolutely MUST have a local registry. Harbor [1], JFrog [2], and Quay [3] would be the first ones that I look at. Harbor is open source, free, and a member of the CNCF. You will need to do a little bit of work to set it up to scale properly. JFrog offers a SaaS re…

Just to add all the major cloud service providers provide registries ACR /ECR/GCR etc . If you run k8s service with one of the them in my experience it is best to use the corresponding registry. I have pulled and run 20k times a 1GB image in less than 10-15 minutes without breaking a sweat. Finally GitHub packages offers a registry out of the box . It is great for CI and devs to access . I generally have the tags mir…

Github Docker Registry is a mess and should be avoided at all costs.

1) It is broken and unusable on Kubernetes and Docker Swarm.

2) It is flaky often returning 500 type errors.

3) It is expensive as the amount of pull bandwidth is very limited.

Re: Docker to rate limit image pulls

#226

Post by stingraycharles »

stevebmark wrote: post #126

This is good, just like pruning old images. What's bad, and what Docker isn't saying, is it was a mistake to ever allow unlimited free plans. Independent of scale. Setting up an expectation of unlimited free hosting and bandwidth at any point of a business is bad. Tuning knobs of paid hosting and services at all tier levels, with a limited free tier, should have been baked in from the beginning, and would have led to…

I don’t think it was a mistake per se, it was part of their growth strategy. Their biggest problem is that they never really managed to capitalize on the market (and kubernetes happened), so now their plan B is to effectively reduce costs of docker hub or get some money out of the people using it.

Completely understandable imho.

Re: Docker to rate limit image pulls

#227

Post by pjmlp »

Spivak wrote: post #165
pjmlp wrote: post #132

Earlier quoted context omitted.

Mind blowing, imagine paying $5 for each newspaper one wants to read.

You’re missing the point. If there’s a news source that you occasionally read then it’s far more cost effective for you to just buy the paper at the stand for 50¢ the few times you want it. Same with magazines. If you read every newspaper then getting lower cost and delivery in return for the paper getting consistent revenue is a good deal for both parties. If you get your news like most people, via link aggregators…

My daily newspaper costs 2€ at the newsstand, not cents. With a monthly subscription of 5€. Pretty much worth it.

I have been subscribing valuable information sources since 1995, so I do get the point.

Re: Docker to rate limit image pulls

#228

Post by pjmlp »

ironmagma wrote: post #161
pjmlp wrote: post #132

Earlier quoted context omitted.

Mind blowing, imagine paying $5 for each newspaper one wants to read.

Except it’s not $5, it’s $5 to sign up, then an email and a phone call and your firstborn dog to unsubscribe. If it were microtransactions, that’d be one thing...

If the service doesn't play ball there is always the consumer protection agency.

Re: Docker to rate limit image pulls

#230

Post by terom »

userbinator wrote: post #174
nrmitchi wrote: post #38

Earlier quoted context omitted.

I don't disagree with what you are saying, _but_: > Docker defines pull rate limits as the number of manifest requests to Docker Hub. > For example, if you already have the image, the Docker Engine client will issue a manifest request, realize it has all of the referenced layers based on the returned manifest, and stop. ... ... So an image pull is actually one or two manifest requests, This still implies that even if…

I admittedly have only used Docker very little, but how exactly does someone manage to build images once every 108 seconds continuously for 6 hours ? That sounds extreme.

Easily with CI. Every pull request on the GitHub project will build a dozen Docker images whenever a PR is opened, updated or merged.

Granted, there's only a couple base images involved, so CI pipelines will need updating to be more efficient in terms of `docker build --pull` usage.

Post reply on HN