But First: What’s the News?

So what is this DockerHub? DockerHub is a cloud-based repository where popular Docker images can be published and used by other users for their needs. So far it is the central repository similar to the maven-Central for the Java world.

Access was free, and there were no further restrictions on storage space and duration of storage. This circumstance has led to a large number of open source projects using this repository for their purposes. A whole network of dependencies between these images has built up over the years. So much for the past.

Docker Hub Was in the News Recently for Two Reasons:

• Storage Limits: So far, Docker images were stored on Dockerhub for an unlimited time. On the one hand, this meant that nobody cared about the storage space of their images. On the other hand, this state has been maintained for so long that pretty much everyone has relied on it that it will not change anymore. Unfortunately, that has now changed. The retention period for inactive Docker images has been reduced to six months. What does not sound particularly critical at first, turns out to be quite uncomfortable in detail. When selecting the base images, i.e. the images that were used as the basis for one’s compositions, it was not uncommon for them not to consider that exactly these images would like one day no longer be available.
• Download throttling: Docker has put a limit on the download rate of 100 pulls per six hours for anonymous users, and 200 pulls per six hours for free accounts. The number 200 sounds pretty bearable. However, it makes sense to do a more detailed calculation here. 200 pulls / 6h are 200 pulls / 360min. We’re talking about 0.55 pulls/minute at a constant polling rate. First, many systems do more than one build every 2 minutes. Second, if the limit has been reached, it can take more than half a working day to regain access. The latter is to be viewed as very critical. Usually, limits are given per hour, which then only leads to a delay of a little under an hour. Six hours is a different order of magnitude.

These two points alone are enough to bring some active open source projects to a standstill. And here I am not even starting from a holistic view of what this can do in a global context.

#devops #devsecops #opensource #jfrog #docker images #continious integration #opensource community #dockerhub #jfrog artifactory #contineous delivery