 I argue we (#curl) should NOT pay docker. Not give in to extortion. This might mean that someone else soon suddenly will register our name and can serve whatever image they want there. 5 *billion* pulls indicate there's a user or two that might fall victim for this. That's on docker, not us. 67 comments
 @bagder Well, at least for podman users, we can ensure an official shortname matches wherever you want to go: https://github.com/containers/shortnames 😉 And have you looked at where to move the official images for curl yet? I've been using quay.io for my personal images and it's quite nice. 😀 @Conan_Kudo we have had discussions already before on how to do this better, but eventually @jimfuller is our main docker image guy and he knows much more about this than I do. I'm mostly just following this a little from afar.  @bagder @Conan_Kudo upcoming changes to curl docker will see us distributing image from many other registries  @Conan_Kudo @bagder Quay.io randomly banned my account, but other than that it's good.  @bagder i thought you meant about the fact that without curl, docker things will break. instead, it's much worse. it's kind of like a bait and switch. either way, both outcomes are bad for the docker registry, so docker might have to make an exception for the popular images (while allowing less popular images to die). @jacksonchen666 yeah, several people have mentioned that maybe docker will block/reserve some names to avoid the worst possible outcomes. I guess we will see... @bagder What's this about? I know about the Docker change, but what do you mean with victim users? @AlgorithmWolf if they delete our account someone else can register that name and offer new images using the existing name. Presumably. @bagder Thank you for explaining. Apparently I didn't know about the recent Docker change indeed https://blog.alexellis.io/docker-is-deleting-open-source-images/ This is strange, because their pricing page specifically lists this being free for individuals and open source projects? Unlimited repositories? https://www.docker.com/pricing/ Usually, when some company pulled off some shitty scheme, GitLab would pick up. Will they pick up this time, considering GitLab has a container registry? @AlgorithmWolf @bagder technically you can already host your images on gitlab and set them public. You can set the pull to public if you want to. Same goes for their package repository. @bagder @AlgorithmWolf for what it’s worth, the Docker CTO has been saying they will not be releasing namespaces. Who knows how long that’ll last for though? @bagder Totally agree with not giving in. @antondollmaier ah thanks for pointing this out. Then at least that is not an issue. @bagder Funny, I have been asked why I don't like docker.. This bs that they are pulling is 1 example. @bagder on the one hand I can understand that running such a platform „for free“ is hard. On the other hand they already charge users for using the platform. By also charging the „content providers“ (and hence scaring them away) they will also loose the users in the long run. Why pay if your favourite images are not available any more? Not to mention all the other issues (e.g. bad actors claiming previously well known account names etc). This seems like giant footgun.  @raph @bagder Nothing is stopping projects from moving, but container registries exist in large part to allow other projects to automatically get images from them. Communicating to those projects that the image has moved is very difficult, and there's no evidence that the DockerHub will take the necessary steps to make things easier. I also believe that DockerHub is the default registry used by Docker, exacerbating the problem. @raph @bagder Basically: people (and automated scripts) are going to be looking on DockerHub for images that are no longer there. In the best case scenario, this will break a ton of scripts and be a huge hassle for a long time as people slowly update where they're getting images from. In the worst case scenario, you'll have malicious namespace squatting in the deleted accounts. (DockerHub's said they'll keep namespaces safe/reserved but there's not a lot of trust right now for obvious reasons.)  @bagder Do you have the resources to beat Docker in court? No? I argue that you need a revenue model to cover the costs while you rebuild around another tool. @bagder i created + ran freepository for 17 yrs - lots of paid accounts but TONS of free ones. i never did anything like this + even when i sunsetted the service, i gave everyone six months notice + the ability to download full repos. not everyone who provides a free service behaves this way.   @bagder @bagder this can become the biggest industrial catastrophe.. But I read on github that they will forbid squating... (I don't really trust them..) I recomend people to forbid their registry and ask their package maintainer to use a different one.  @blacklight @yesbait @bagder docker only downloads the parts of an image you are missing, so, if you already have an alpine image from a different container, docker reuses it and only downloads the additional files required to run curl @bagder
What's happening? I can't find anything about this but it seems like it'd be an interesting discussion. @bagder there's going to be a lot of squatting of Docker names soon. Docker images may become the main vector for delivering malware. And it's all on them, all self-inflicted. I *WANT* people to do a docker pull of curl and install malware instead. I want it with all of my heart because I want people to figure out that Docker is an unreliable company that builds an unreliable product, and that those who slap the FOSS community after relying on them to grow deserve to get nothing but shitware. @bagder Apparently, Docker's CTO commented informally on Twitter that they will shut down accounts that do not pay up, and not allow anyone else to take over the name.... Hopefully they keep their word. @bagder on some free software project, we asked to become part of Docker-Sponsored Open Source program yesterday, and where accepted early this morning. You should probably do the same, if nothing but to protect the namespace @a000d4f7a91939d0e71df1646d7a48 I believe we are already part of that. The name space is supposedly protected though, many people have pointed this out after my initial toot on this.  @bagder apparently, accounts/organization names are not made available to new registers. I suppose it will mitigate the risk of squatting? (source: https://twitter.com/justincormack/status/1635706522419200004) Ok so I didn't follow the story, so Docker company ask for fees now for namespace on docker hub if I understand well. @bagder I see you are a "Sponsored OSS" on Docker Hub. Does that not prevent the organization being deleted?
   |
Gregory's Server
@bagder Maybe you can pay docker by licensing curl to them?
Oh.