Hacker News Reader

Comment by icedchai | Hacker News Reader

Why would any serious company not use a private registry?

You would be surprised on how large a hurdle this is, even inside 'serious companies' when stable external/internal artifacts come up. A lot of developers who cut their teeth on these public repositories complain heavily over the 'friction' of ensuring that they have a reliable place to pull things from. This isn't unique to docker and also includes things like python, ruby, go, node, and other modern packaging systems. The fact that in 3 years from now when they need to update the code the vulnerable/deprecated package is gone/changed URL/whatever seems to be a learned lesson.

Really the most difficult part is mirroring everything, but managing your dependencies without using the latest tag

AWS Docker registry (ECR) is a good middle ground since you don't have to maintain your own registry and you can take advantage of IAM to improve security.

Some CICD services such as GitLab already provide docker image registries per project for free, and enable users to create any number of projects.

Similarly GCP registry if you are on GCP.

I have used them. It isn't that much of a hardship if you are already cloud native.

Companies with legacy or hybrid infrastructure may need to jump through additional hoops.

Similarly there is Azure Container Registry. Only issue I've found with it is that access permissions are not granular enough - for example, you can't specify that a user/service principal should only be able to access particular tags or repos. Not sure how that compares to the AWS and GCP offerings?

This is pretty much a requirement for any serious company, but it still doesn't solve the problem completely as lots of builds depend on public docker hub containers. When the docker hub outage happened earlier this week our production systems were fine, but our dev processes slowed down quite a bit until it was resolved.

Unfortunately though docker hub really is a dumpster fire of a service, otherwise I'd have no problem just using their private repo features. However there are so many problems with that site that it's easier just to jump to AWS ECR or Github's new service.

Same reason they use public apt/rubygems/npm/etc. Same reason they use a secured, but public, Github/Gitlab. Same reason many use hosted CI, bug tracker, APM, etc.

If you follow best practices your containers don't contain secrets; distributing credentials to access a private registry is itself a bit of overhead.

Not everyone makes/uses software where the software itself is secret.

We're talking about fixing the underlaying images to a fixed point, not about baking in secrets into the image.

And there are plenty of uses for using proprietary images. For example, I have done workflows where the properitary code is layered on top of open-source code. (Although if I were to redo those CI/CD pipelines again, I would use the de-facto buildpack standard instead; even then, the buildpack slug itself would be properitary and requires an artifact store of some kind).

Either way, using GCP or AWS registry that integrates with their IAM systems works well. The newer versions of docker contains a plugin system, so both GCP and AWS command line tooling can hook in their own authentication mechanisms in there.

I think the risk in this case is an attacker writing to the registry, not reading it.

If I can push changes to your 'prod' tagged image, I'm going to have a very good time.

Reply on news.ycombinator.com