Hacker News Reader

Comment by m463 | Hacker News Reader

This is why I wish docker had a way to be more self-contained.

Like a first class way to start with

    FROM scratch

and a way to configure it to pull only from a local, private registry.

It seems docker (the company) has actively worked against this. The redhat versions allow configuring a private registry, but they don't worry about pissing off docker.

View on HN

The closest approach to a first class "FROM scratch" is probably distroless[0].

> and a way to configure it to pull only from a local, private registry.

One can set up an air-gapped environment with access to a private container registry only.

[0] https://github.com/GoogleContainerTools/distroless

What's wrong with "FROM scratch"? As in, if you do not want the dependency resolution, file system layout and backported fixes a distribution gives you - what do you want "FROM scratch" to do? Docker already provides an init - is there something else missing? Libc perhaps?

I'm saying docker hub is hardcoded. Sort of like google devices hardcode 8.8.8.8.

I think they should allow people to configure docker to be local, and allow some safer or maybe less promiscuous ways to use it (and it also goes around the ubuntu firewall)

Docker Hub is not "hardcoded as the only registry you can use" its just the default, you can add stuff from any registry.

Here are the threads I read:

https://stackoverflow.com/questions/33054369/how-to-change-t...

which led to this:

https://github.com/moby/issues/7203

and this comment:

It turns out this is actually possible, but not using the genuine Docker CE or EE version.

You can either use Red Hat's fork of docker with the "--add-registry" flag or you can build docker from source yourself with registry/config.go modified to use your own hard-coded default registry namespace

That is about changing the default config, so that if you put a non fully qualified name it might choose a different registry from Docker Hub. You can always pull a fully qualified name on any version of Docker. Red Hat just wanted their install to pull from a different registry if you did "docker run ubuntu" which is kind of confusing for users. You can always just do docker run mydomain.com/ubuntu or whatever on any version.

Buildah can do "from scratch".

Reply on news.ycombinator.com