Hacker News Reader

Comment by adrianmsmith | Hacker News Reader

> The first thing docker does is it checks its local registry and tries to find a match for the base image the docker build is requesting. If a matching image is located in the local registry, it uses that one in lieu of downloading the image.

While I agree that this is the way it's supposed to work, I have unfortunately worked at companies with "stateless" build/CI servers that download the Docker image each build.

View on HN

Well, this policy change will force them to be more efficient, and it's a net win for everyone

Or just pony up the $5/mo for Pro... not as fun as re-engineering your CI pipeline, once again.

You have to re-engineer it anyway to authenticate your Pro account.

> While I agree that this is the way it's supposed to work, I have unfortunately worked at companies with "stateless" build/CI servers that download the Docker image each build.

Couldn't they remain stateless but be redirected through a caching proxy? Memoization is not contrary to statelessness.

Sure, now they have to build a proxy...

Artifactory is less bad than most of the tools I have to use all day.

Artifactory is the very definition of expensive (even at an enterprise scale) when it comes to docker images though.

Can you tell me more? How expensive are we talking?

Working for the same sized companies for a while has apparently dulled my senses. At a certain size, the capital that matters is the political capital it takes to get a vendor agreement in place to begin with. The monthly costs of the system are something you only feel through pushback on how big the repo gets, or the rate of traffic (experiencing the latter now with a browser testing SaaS)

Super easy to run a docker cache proxy:

    docker run -d -p 6000:5000 \
    -e REGISTRY_PROXY_REMOTEURL=https://registry-1.docker.io \
    --restart always \
    --name registry registry:2

That's it. Now fetch docker images from the IP that command is running on. Taken from gitlab: https://docs.gitlab.com/runner/install/registry_and_cache_se...

I think this addition to docker/config.json should do the trick to make it hit the proxy?

https://docs.docker.com/registry/recipes/mirror/#configure-t...

Is that going to actually help with the manifest-based rate limits? It sounds like it only caches the layers, the manifest metadata for a tag is not cached.

https://docs.docker.com/registry/recipes/mirror/#what-if-the...

> When a pull is attempted with a tag, the Registry checks the remote to ensure if it has the latest version of the requested content. Otherwise, it fetches and caches the latest content.

Hm you're right. I wonder if there's a way to cache a tag's metadata for a while...

Reply on news.ycombinator.com