Away from docker.io
rgaudin opened this issue · comments
Docker Hub announced that all non-paying organizations will see their data deleted on April 14th (see this article). Turns out they won't delete existing public images (all our images are public) but we won't be able to publish new ones.
This has two important consequences:
- We won't be able to push to docker.io anymore
and our images won't be hosted there anymore. That would be the result of not switching to a Paid Plan. - We won't be able to build any image depending on source ones hosted on docker.io which would also be affected by this change: ie. using Free Teams Plan.
Should we pay?
No. This would only sort the first issue, which is the easiest to address and is probably a good move anyway.
Also, we don't want to support Docker Hub and their aggressive behaviors (it's the the first rude move from their part).
What needs to be done for publication?
- All our images must push to ghcr.io only.
- READMEs must be updated to point to
ghcr.iofor links and examples. - READMEs must be updated to badges independent of docker.io
- We need to communicate (social media?) that we migrated all our images to ghcr.io
- We need to delete our organization accounts (
kiwix,openzim) on docker.io.
Update docker workflow
Most of our repos uses our docker-publish-action.
- Use
uses: openzim/docker-publish-action@v10. This now defaults toghcr.ioonly. If update not wanted, setregistries: ghcr.io - Remove the
DOCKERIO_*lines incredentials. Not mandatory but cleaner as not used anymore.
Update badges
img.shields.io doesnt have ghcr.io badges (because it requires API autehnticated/quota requests) yet. In the mean time, we have two alternatives:
Images using latest only
Use a static badge
[](https://ghcr.io/kiwix/borg-backup)Versioned images
Use (temporarily) an external service that will most likely not handle traffic at some point
[](https://ghcr.io/openzim/wikihow)What needs to be done for building?
While docker stated that public images won't be deleted, some people (🙄) proactively delete their images from docker.io…
We probably shouldn't worry about that affecting us but it's an opportunity to assess our dependencies.
We should thus Identify all source (it can be chained) images used in all our Dockerfile for their status:
- Is an Official Docker Image? Those are safe.
- Is from a paid account or a personal or OSS one? Safe for now but heck whether available on another registry. Maybe open a ticket.
- Is from a Free Team Organization? Create a ticket to follow-up: find out migration strategy: to another registry? ghcr ? to a personnal docker.io account?
- Should it be updated (too old)? Maybe open a ticket.
| Repo / image | Publication | Build Sources | Ticket |
|---|---|---|---|
| offspot/container-images | |||
base-httpd |
✅ | ✅ alpine:3 (DOI) |
|
captive-portal |
✅ | ✅ alpine:3.16 (DOI) |
|
dashboard |
✅ | ✅ caddy:2.6.1-alpine (DOI) |
|
edupi |
✅ | ✅ python:3.8.14-slim-bullseye (DOI) |
|
file-browser |
✅ | ✅ caddy:2.6.1-alpine (DOI) |
|
hwclock |
✅ | ✅ alpine:3.16 (DOI) |
|
kiwix-serve |
✅ | ✅ debian:bullseye-slim alpine:3 (DOI) |
|
reverse-proxy |
✅ | ✅ caddy:2.6.1-alpine (DOI) |
|
wikifundi |
✅ | ✅ debian:bullseye-slim (DOI) |
|
| offspot/cardshop | |||
manager |
✅ | tiangolo/uwsgi-nginx:python3.8 (CU) |
|
scheduler |
✅ | tiangolo/uwsgi-nginx:python3.8 (CU) |
|
worker |
✅ | rgaudin/python-ubuntu:3.8-18.04 (CU) ubuntu:18.04 (DOI) |
|
| offspot/kiwix-hotspot | - | ✅ mcr.microsoft.com/windows/servercore:ltsc2019 |
|
| offspot/content-filter | ✅ | ✅ python:3.8-slim-buster (DOI) |
|
| offspot/mediawiki-docker | ✅ | ✅ nginx:1.21.3 (DOI) |
|
| offspot/wikifundi-{en,es,fr} | ✅ | ✅ ghcr.io/offspot/mediawiki:1.36.1 |
|
| kiwix/kiwix-js | ✅ | ❌ emscripten/emsdk:2.0.25 (CO) |
kiwix/kiwix-js#980 |
| kiwix/kiwix-build | ✅ | ✅ alpine:3.16 ubuntu:bionic fedora:35 ubuntu:focal |
|
| kiwix/libkiwix | - | ✅ ghcr.io/kiwix/kiwix-build_ci_* |
|
| kiwix/kiwix-desktop | - | ✅ ghcr.io/kiwix/kiwix-build_ci_* |
|
| kiwix/borg-backup | ✅ | ✅ debian:bullseye-slim (DOI) |
|
| kiwix/kiwix-tools | ✅ | ✅ ghcr.io/kiwix/kiwix-build_ci_* alpine:3.16 (DOI) |
|
| kiwix/kiwix-js-windows | ✅ | ✅ nginx:latest (DOI) |
|
| kiwix/metrics | ✅ | ✅ debian:buster-slim |
|
| kiwix/container-images | |||
dropbox |
✅ | ✅ debian:11-slim (DOI) |
|
mirrorbrain |
✅ | ✅ httpd:2.4.43 (DOI) |
|
matomo |
✅ | ✅ matomo:4.13.3-fpm (DOI) |
|
matomo-log-analytics |
✅ | ✅ debian:bullseye-slim (DOI) |
|
openzim/surfer |
✅ | ✅ node:16-bullseye (DOI) |
|
bittorrent-tracker |
✅ | ✅ debian:buster-slim (DOI) |
|
netdata |
✅ | ✅ ghcr.io/netdata/netdata:v1.38 |
(was netdata/netdata:v1.35) |
| kiwix/k8s | - | ✅ docker.io/alpine:3 docker.io/mongo:4.2.9 docker.io/mariadb:10.4 docker.io/nginx:1.21 docker.io/postgres:10.4 docker.io/postgres:11 docker.io/mysql:8-debian docker.io/bitnami/minideb docker.io/bitnami/nginx:1.21 docker.io/bash:5-alpine3.15 docker.io/varnish:7.1-alpine (DOI) docker.io/gimoh/pureftpd:latest (CU) docker.io/vimagick/rsyncd:latest (CU) ❌ docker.io/kiwix/watcherbot:latest |
|
| openzim/zim-tools | ✅ | ✅ alpine:3 (DOI) |
|
| openzim/javascript-libzim | - | ❌ emscripten/emsdk:3.1.12 (CO) |
openzim/javascript-libzim#46 |
| openzim/wp1 | ✅ | ✅ mysql:5.7 mysql:8.0.30 redis node:lts-alpine nginx:stable-alpine python:3.9 mariadb:10.1 (DOI) jwilder/nginx-proxy jrcs/letsencrypt-nginx-proxy-companion (CU) ✅ ghcr.io/kiwix/borg-backup:latest |
|
| openzim/zimfarm | ✅ | ✅ python:3.8-buster alpine:edge python:3.10-alpine node:14-alpine library/nginx:mainline-alpine rgaudin/uwsgi-nginx:python3.8 (CU) ✅ ghcr.io/netdata/netdata:v1.38 (CO) |
|
| openzim/mwoffliner | ✅ redis redis:7 (DOI) ✅ ghcr.io/openzim/node-redis:18-7 |
||
| openzim/phet | ✅ | ✅ node:18 (DOI) |
|
| openzim/kolibri | ✅ | ✅ python:3.11-bullseye (DOI) |
|
| openzim/gutenberg | ✅ | ✅ python:3.11-bullseye (DOI) |
|
| openzim/nautilus | ✅ | ✅ python:3.8 (DOI) |
|
| openim/zimit | ✅ | ❌ webrecorder/browsertrix-crawler:0.8.1 (CO) |
webrecorder/browsertrix-crawler#260 |
| openzim/cms | ✅ | ✅ node:14-alpine library/nginx:mainline-alpine (DOI) tiangolo/uvicorn-gunicorn:python3.10-slim (CU) |
|
| openzim/sotoki | ✅ | ✅ redis:6.2.4-buster python:3.8-slim |
|
| openzim/openedx | ✅ | ✅ python:3.8 |
|
| openzim/ted | ✅ | ✅ python:3.8 (DOI) |
|
| openzim/ifixit | ✅ | ✅ python:3.8-slim (DOI) |
|
| openzim/youtube | ✅ | ✅ python:3.8 (DOI) |
|
| openzim/wikihow | ✅ | ✅ python:3.8-slim (DOI) |
|
| openzim/librechef | ✅ | ✅ python:3.8 (DOI) |
|
| openzim/education-numerique | ✅ | ✅ ubuntu:20.04 (DOI) |
|
| openzim/zimit-frontend | ✅ | ✅ node:14-alpine (DOI) tiangolo/uwsgi-nginx:python3.8 (CU) |
What's Next?
This is all in reaction to DockerHub's erratic behavior. We'll have all our images stored on GHCR but still depends a lot on docker.io to function… but it's still a major part of the Docker ecosystem and it's unlikely to go away suddenly.
Archiving is a concerned. @kelson42 mentioned on Slack that he is “not convinced there is value in past Docker images”. It means that we wont transfer any docker.io-only image to ghcr.io.
I'd like @kelson42 to use this opportunity to lay out a general Docker image policy for the versioned repos. If we believe past images are useless, then we should be responsible registry users and delete them.
We could integrate that into the docker-publish-action so it's effortless. It could be a combination of age and number of more recent versions for instance.
- We're now solely publishing all our images to ghcr.io and documentations have been adapted.
- We've removed all our images from docker.io and our two profiles now point to We're on GHCR.io.
- Most images depends on Docker Official Images
- 10 images depends on Images belonging to Community User accounts (personal accounts)
- 3 images depends on Community Organization
- zimit:
webrecorderwhich planned on converting to a personal account (probably wont do it now) - kiwix-js and kiwix-js-windows:
emscriptenfor some non essential scripts.
- zimit:
- docker.io back-pedaled and canceled the whole change.