Hacker News Reader

Comment by donatj | Hacker News Reader

I don't do a ton with Docker outside dev tooling, but I have never understood why private container registries even exist? It just smells like rent seeking. What real advantage does it provide over say just generating some sort of image file you manage yourself, as you please?

View on HN

You don't have to use it. You can use docker save and docker import:

    docker save alpine:3.19 > alpine.tar
    docker load < alpine.tar

But now I have to manage that tar file, have all my systems be aware of where it is, how to access it, etc. Or, I could just not re-invent the wheel and use what docker already has provided.

You will probably have images that you will not share to the world. Said images will probably be made available to your infrastructure (k8s clusters, CI/CD runners etc). So you have to either build your own registry or pay someone to do it for you.

Of course, if you use images for dev only, all of that are worthless and you just store your images on your dev machine

Also if your infrastructure is within AWS, you want your images to also be within AWS when the infrastructure wants them. That doesn't necessarily imply a private registry, but it's a lot less work that way.

Why have a code repository instead of just emailing files around?

Because you want a central store someplace with all the previous versions that is easily accessible to lots of consumers.

I don't want to build my app and then have to push it to every single place that might run it. Instead, I'll build it and push it to a central repo and have everything reference that repo.

> It just smells like rent seeking.

You don't need to pay someone to host a private repo for you. There are lots of tools out there so you can self-host.

Private (cloud) registries are very useful when there are mandatory AuthN/AuthZ things in the project related to the docker images. You can terraform/bicep/pulumi everything per environment.

and how do you manage them? you use the same tooling that exists for all public images by running a container registry.

Integration with vulnerability scanning utilities and centralized permissions for orgs are nice benefits.

Companies send young engineers (and older engineers who should know more but don't) to AWS and Microsoft for "cloud certification". They learn how to operate cloud services because thats what benefits AWS and MS, so thats what their solutions use.

It's a difficult uphill battle to get people interested in how things work under the hood, which is what you need in order to know you can do things like easily host your own package repositories.

This is a odd assessment. I agree certifications aren't all that, but having people learn them isn't about that. It's more that people don't feel like reinventing the wheel at every company, so they can focus on the real work, like shipping the application they've written. So companies like AWS, Docker etc, write things, abstract things away, so someone else doesn't have to redo the whole thing.

Yes I can host my packages and write tooling around it to make it easy. But JFrog already has all the tooling around it, and it integrates with current tooling. Why would I write the whole thing again?

I am responding to this part of the parent comment:

> I don't do a ton with Docker outside dev tooling, but I have never understood why private container registries even exist?

You know the options and have made a conscious choice:

> Yes I can host my packages and write tooling around it to make it easy. But JFrog already has all the tooling around it, and it integrates with current tooling. Why would I write the whole thing again?

So presumably you are not the kind of people I was talking about.

EDIT: I'm also assuming by the rent seeking part that the parent is referring to paid hosted services like ECR etc.

Reply on news.ycombinator.com