Docker Hub's upcoming 100 pulls per user/IP limit

[Johannes Ziemke]

Hi everyone,

as mentioned in chat yesterday, Docker will limit the number of layers a user can pull within 6 hours:

https://www.docker.com/blog/scaling-docker-to-serve-millions-more-developers-network-egress

This will certainly cause problems for people pulling our images from the Docker Hub. Especially in Kubernetes scenarios where ImagePullPolicy=Always is common practice and often even enforced by running the AlwaysPullImages admission controller. This will likely lead to outages in dynamic environments (autoscaling, spot instances etc). I'd expect especially the node-exporter to be affected since it's probably the thing people run the most instances of in their infrastructure.

There is not much we can do. We could beg Docker to void the limits for us but I think the best option we have is to let our users know about the limitation and suggest using quay.io instead. I've already submitted a PR[1] to remove all references to Docker Hub from the node-exporter repo (We already used quay in our README example). I suggest we do the same for all other components.

1) https://github.com/prometheus/node_exporter/pull/1825

[Julius Volz]

On Wed, Aug 26, 2020 at 10:16 AM Johannes Ziemke <fi...@freigeist.org> wrote:

Hi everyone,

as mentioned in chat yesterday, Docker will limit the number of layers a user can pull within 6 hours:

https://www.docker.com/blog/scaling-docker-to-serve-millions-more-developers-network-egress

This will certainly cause problems for people pulling our images from the Docker Hub. Especially in Kubernetes scenarios where ImagePullPolicy=Always is common practice and often even enforced by running the AlwaysPullImages admission controller. This will likely lead to outages in dynamic environments (autoscaling, spot instances etc). I'd expect especially the node-exporter to be affected since it's probably the thing people run the most instances of in their infrastructure.

There is not much we can do. We could beg Docker to void the limits for us

I mean as the article states "Finally, as part of Docker’s commitment to the open source community, before November 1 we will be announcing availability of new open source plans. To apply for an open source plan, please complete the short form here.".

I wonder when exactly "before November 1" will be and how much time that will give us to decide things. In case their OSS plans allow unlimited pulls again, then we should be fine?

But also fine switching to quay.io everywhere. But the general problem is services that are expensive to run, but offered for free... wondering if something similar will happen to quay.io at some point. But now that it belongs to Red Hat, err, IBM, they might be big enough to not care about the costs it produces.

[Bartłomiej Płotka]

Nothing I am aware of happening with quay.io soon but double-checking internally as well now. Will let you know. (: 

Kind Regards,

Bartek Płotka (@bwplotka)

--
You received this message because you are subscribed to the Google Groups "Prometheus Developers" group.
To unsubscribe from this group and stop receiving emails from it, send an email to prometheus-devel...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/prometheus-developers/CA%2BT6Yoy6qBfYQdEyidbs3MsAbvnKJZ6bDDr54Ha_rFLi%3DYP4ZQ%40mail.gmail.com.

[Ben Kochie]

Yes, we should apply and get more details on the new FOSS plans.

Anyone volunteer to take that on?

--

[Julius Volz]

For a start, I filled out dummy answers (without submitting) to get to see all the subsequent pages of the application form. You can see all the questions they ask here:

https://docs.google.com/document/d/123fdfSGk5_tjdXAE0G1CeVcIpMBy9JBthwG0lwYjMXc/edit?usp=sharing

I could fill it out to the best of my ability, but want to give people a chance to see the questions in case they have opinions on some of them.

[Bartłomiej Płotka]

Quay does not plan anything like this, so we could go for quay if we want.

Kind Regards,

Bartek Płotka (@bwplotka)

To view this discussion on the web visit https://groups.google.com/d/msgid/prometheus-developers/CA%2BT6YoyqdwOFRY5qgbzsVzb3idp8xw8UbnP8T734mXpycNytbQ%40mail.gmail.com.

[Bjoern Rabenstein]

On 26.08.20 12:07, Julius Volz wrote:
> For a start, I filled out dummy answers (without submitting) to get to see all
> the subsequent pages of the application form. You can see all the questions
> they ask here:
>
> https://docs.google.com/document/d/123fdfSGk5_tjdXAE0G1CeVcIpMBy9JBthwG0lwYjMXc
> /edit?usp=sharing
>
> I could fill it out to the best of my ability, but want to give people a chance
> to see the questions in case they have opinions on some of them.

The questions seem mostly harmless.

What I'm more wondering if the open-source plans will actually allow
anonymous our free-riding users to pull our images without limits. I
got the impression, Docket Hub is not so much trying to limit how
often a particular image is pulled (or images from a particular
project) but more how often a particular user or IP number pulls any
images.

If their plan is to "incentivize" users to create a paid user account,
they won't be keen on allowing unlimited access to images from popular
open-source projects (because those are probably the most frequently
pulled images in the first place).

--
Björn Rabenstein
[PGP-ID] 0x851C3DA17D748D03
[email] bjo...@rabenste.in

[Bjoern Rabenstein]

On 26.08.20 15:58, Bartłomiej Płotka wrote:
> Quay does not plan anything like this, so we could go for quay if we want.

I hope the Quay plans won't change once most of the universe has
switched from Docker Hub to Quay and the resulting huge traffic
increase raises the attention of some people higher up the ranks at
Bluehat...

[Julius Volz]

Yeah, good point. Really curious to see what OSS plans they are going to announce.

I'll just fill out the survey for now, as it seems harmless indeed :) (no idea what to answer for some of the questions - how many users, haha - but shouldn't matter)