Hacker News Reader

Comment by john-shaffer | Hacker News Reader

> [Google] contracted with a company called Bitnami to create a bunch of “click to deploy” solutions, or perhaps I should write “solutions”, because they don’t solve a fucking thing. They’re just there as checkboxes, as marketing filler, and Google never gave a shit whether any of them worked from Day One.

I've had similar experiences with broken Bitnami images that makes it seem like they aren't even tested before being released [1][2]. Their WordPress images do work, but the way file permissions are configured doesn't play well with the way they have WordPress set up [3]. Have I just had bad luck, or is this a common experience?

[1] https://community.bitnami.com/t/cant-authenticate-to-fauxton... [2] https://community.bitnami.com/t/couchdb-server-log-gives-wro... [3] https://github.com/WP2Static/wp2static/issues/598

View on HN

Bitnami broke their MongoDB Helm chart. We're careful to pin versions, and hadn't anticipated someone would re-write history and break published code.

Can't get too upset, we don't pay them anything. Not in a rush to use them again though.

Have you reached out to (community) support? My colleagues there tend to do their best to help the community.

EDIT Disclaimer: I work for Bitnami; not in that team though. I reached out internally to see if this is a known issue, but it's Saturday...

EDIT 2: does the downvote mean bitnami community support is so bad or did my wording offend anybody?

There are lots of random downvotes for no real reason. Sometimes perfectly ordinary posts are dead. I try to upvote gray posts if they're not worthless.

That said, my take (and that of siblings) is that I'm much better off building my own containers than serving as unpaid Q&A for Bitnami. It would be smart to use containers built by people more expert than I am. Containers that are broken by default do not meet that criteria. So, "reach out to community support" is not helpful to people that have already decided to ditch Bitnami.

> We're careful to pin versions, and hadn't anticipated someone would re-write history and break published code.

This is exactly the kind of thing that will make me ditch a company forever and never look back.

It's not clear what happened though.

We use immutable tags like "4.2.8-debian-10-r50" which we never overwrite.

Then we have "semantic versioned" moving tags, like "4.2.8", "4.2", ... which resolve to the latest image matching that prefix.

Moving tags are what they are; I'm personally not a fan; all major popular images have that (https://hub.docker.com/_/golang, https://hub.docker.com/_/python, ...)

You can read more about Bitnami tagging scheme at: https://docs.bitnami.com/tutorials/understand-rolling-tags-c...

If you want to pin your image you should either use the most specific tag or just use the digest:

    $ crane digest bitnami/mongodb:4.2
    sha256:8650c2d92eea97732eae359a140ee86ee3923a2a19b19443e1dc01ec20d5387d
    $ docker run bitnami/mongodb:4.2@sha256:8650c2d92eea97732eae359a140ee86ee3923a2a19b19443e1dc01ec20d5387d

Now, we might have introduced a regression between some version of a container and the next minor version; shit happens; it's hard to tell without more specific information though.

> > We're careful to pin versions, and hadn't anticipated someone would re-write history and break published code.

> This is exactly the kind of thing that will make me ditch a company forever and never look back.

On the other hand, assuming that instead of a misunderstanding, what you saw is actually the image behind an immutable tag such as 4.2.8-debian-10-r50 being replaced, this is a serious security issue; somebody could have hacked docker hub, or crafted a valid certificate for docker hub and MitM'd you,

I'd also ditch a company forever and never look back if they honestly don't care about that problem, which I assure you it's not the case.

We'd greatly appreciate reporting such cases to security@bitnami.com / security@vmware.com .

I've used the Bitnami images to set up Wordpress a few times and won't again. It takes less time to do it from scratch once you know how, because of the exact issues you mention - you keep getting bitten by details that end up taking longer than just starting from scratch.

In fact at this point it's easier to use AWS Lightsail.

Reminds me when we were implementing Bitnami's OpenEdx and it was crashing due to a Python file importing newrelic (reporting SDK of that product) but it was not installed. Seems they didnt test that release ran at all.

Reply on news.ycombinator.com