Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Docker pull fails in Spain due to football Cloudflare block

news.ycombinator.com

Post reply on HN
Print view View original

371–380 of 444 posts

Re: Tell HN: Docker pull fails in Spain due to football Cloudflare block

#371

Post by ClikeX »

micw wrote: post #299
utrack wrote: post #4

They block the whole of Cloudflare R2, I believe the Docker hub is just (heh) a collateral. When the La Liga match starts, everything that's proxied via CF (including zero access reverse tunnels) stops working. There's even a website made for checking if the match is on: https://hayahora.futbol/ You can check if your host is affected: https://hayahora.futbol/#comprobador&domain=docker-images-pr...

Who exactly is blocking and on what legal base? If it's Spanish ISPs and they are massively over blocking, why are there no legal actions against them? (E.g. for not fulfilling their contracts)

The wacky thing is. It's blocked due to legal action.

Re: Tell HN: Docker pull fails in Spain due to football Cloudflare block

#372

Post by cryptonym »

lukan wrote: post #355
cryptonym wrote: post #347

Earlier quoted context omitted.

If cloudflare is providing services to illegal websites, they very much are in full control of the situation. They knowingly choose to keep hosting that content, and have legal customers exposed to that risk. You may like that the platform is open by default to everybody, but that's the obvious consequence.

Does cloudflare refuse a court order to take down a site? I don't think so.

Are blocking unlawful? I don't think so. Their country their rules.

Business-wise it's risky to deliver your service from IPs that also serves dirty content. Technical solutions exists, even if you want to stay on Cloudflare.

Re: Tell HN: Docker pull fails in Spain due to football Cloudflare block

#373

Post by dnnddidiej »

pajamasam wrote: post #365
isodev wrote: post #363

Very good example as to why using a single, centralised proxy globally by all services is a bad idea. Docker would never have a reason to block anything if they were simply running their own. For everyone else, small and big, this is the weekly reminder to not use Cloudflare for user-facing access to anything.

There are multiple good reasons to use a CDN though. What’s your suggestion for an alternative?

All the other ones. I wonder can you just set up fallback to origin in DNS

Re: Tell HN: Docker pull fails in Spain due to football Cloudflare block

#374

Post by dnnddidiej »

mrvaibh wrote: post #39

This is a great example of why blanket IP blocking is such a terrible enforcement mechanism. Cloudflare hosts hundreds of thousands of services behind shared IP ranges — blocking one IP to stop a piracy stream takes out everything else on that IP, including Docker registries, API endpoints, and CDNs that have nothing to do with football. The real fix on your end until Spain sorts this out: set up a pull-through regis…

Just use a VPN at that point?

Re: Tell HN: Docker pull fails in Spain due to football Cloudflare block

#375

Post by matt_kantor »

egeres wrote: post #348

I wasn't able to pull some images and I lost 1h trying to diagnose network problems in my setup, but it didn't occur to me that "la liga" was the root cause . My workaround was to add "registry-mirrors": [" https://mirror.gcr.io "] in my /etc/docker/daemon.json

Depending on your use case, you may not require a hosted registry at all. You could instead push images to your servers from wherever they're built.

I use a little script[0] to automate that when deploying some personal projects, but really it could be as simple as `docker save`/`scp`/`docker load` (especially for a one-off situation or when the images are small).

[0]: https://github.com/mkantor/docker-pushmi-pullyu

Re: Tell HN: Docker pull fails in Spain due to football Cloudflare block

#376

Post by gempir »

isodev wrote: post #363

Very good example as to why using a single, centralised proxy globally by all services is a bad idea. Docker would never have a reason to block anything if they were simply running their own. For everyone else, small and big, this is the weekly reminder to not use Cloudflare for user-facing access to anything.

The amount of traffic that must go through the docker hub, must be insane, the images go into the gigabytes and everyone expects it to be super fast.

Cloudflare is one of the few companies who can handle that for relatively cheap, Docker could not just "run their own" and have it even be compareable.

Re: Tell HN: Docker pull fails in Spain due to football Cloudflare block

#377

Post by matt_kantor »

yangm97 wrote: post #316
tabwidth wrote: post #241

Earlier quoted context omitted.

This isn't really about centralization. ISPs are blocking at the IP level, not Docker Hub specifically. You could self-host a registry behind Cloudflare and still run into the same thing.

Self-hosting a registry is objectively “less bad” than relying entirely on docker hub but, unless all your Dockerfiles start with `FROM scratch` you’ll still need access to Docker Hub to pull the base images and their updates, and that’s true regardless of how many people are running their own registries. If instead of relying on a centralized registry, which just so happens to also depend on a centralized CDN, you c…

I posted another comment[0] about this, but if you already have the images locally then you can push them directly to the target server without needing a separate registry.

[0]: https://news.ycombinator.com/item?id=47750927

Re: Tell HN: Docker pull fails in Spain due to football Cloudflare block

#378

Post by drob518 »

bombcar wrote: post #219
embedding-shape wrote: post #93

Earlier quoted context omitted.

> This is precisely the situation that the internet was designed to prevent Right, but on the other hand, our constitution and laws are supposed to give us the rights to access a internet where the government cannot block entire companies who host websites, because a few bad websites are hosted there. Not to mention all us freelancers, contractors and just in general computing users, who sometimes want to continue wo…

I’d love for a way to put all my sites behind Cloudflare only during La Liga matches.

Why?

Re: Tell HN: Docker pull fails in Spain due to football Cloudflare block

#380

Post by stingraycharles »

isodev wrote: post #363

Very good example as to why using a single, centralised proxy globally by all services is a bad idea. Docker would never have a reason to block anything if they were simply running their own. For everyone else, small and big, this is the weekly reminder to not use Cloudflare for user-facing access to anything.

Ah come on surely you’re not blaming Cloudflare for refusing to block individual websites without a court order? And surely you’re not blaming Cloudflare for the decision of the Spanish government to block all of Cloudflare during LaLiga?

Docker must be handling absolute massive amounts of traffic on their (free) docker hub, Cloudflare is one of the only companies in the world willing to handle that is able to handle that cheaply. It’s no secret that Docker is struggling financially. So surely you’re not blaming Docker as well for using Cloudflare?

Post reply on HN