Hacker News Reader

Comment by ljm | Hacker News Reader

Good time to point out that if you’re depending on public docker images, use the SHA reference. Named tags are mutable and you can’t depend on your layer cache for stability. Any and all of that can change under your nose on a new build and you won’t know how to debug it without wasting a few hours sourcing the bug. The SHA protects you from that because there can only be one version of it.

(e.g I’ve had a few where a ruby image switched from Debian 9 to Debian 10, on most of the labels. It broke a lot of stuff and you just had to guess that they kept the old version on its own label, because Docker Hub didn’t say anything about it.)

View on HN

I haven't done a ton of Docker DevOps at scale, but shouldn't teams be pulling images, vetting, and then hosting on their own hub?

That'd probably be ideal but in reality most people don't do that.

Worse, I've had people scoff at the idea.

And then things like the Docker Hub outage this week happen and people wonder why their pipelines grind to a halt.

How hard is it to set up your own hub for private use ?

basically a docker run, but if you need it in production, there's a couple other things you need to do.

https://docs.docker.com/registry/configuration/

It's easy. You can host a Docker registry yourself (e.g. Harbor or Portus), or use a managed one, like Google Cloud Registry if you use GCP / GKE. To publish an image to your own registry, you just need to pull from Docker Hub, re-tag the image, and push to your own repo. It's three commands. You can add some automated and/or manual steps to check the images for security flaws before publishing them.

can you imagine a team volunteering for that? Nah, they’ll hope for the best from the public registry.

The way people tackle their dependencies inside docker is utterly irresponsible.

They are supposed to. But as far as I remember among the bad practices perpetrated by the Docker developers there is even an unshakeable stance against adding an option to the mainline Docker so it doesn't try to connect to DockerHub when searching for the image to download.

Reply on news.ycombinator.com