undefined | Better HN

0 pointsNathanKP4y ago0 comments

For images on Docker Hub there is a slightly different approach. As of today you can also find many of the top official Docker Hub images being mirrored to ECR Public, so you don't even need a pull through cache for those, you can pull from ECR Public directly:

- ECR Public Gallery: https://gallery.ecr.aws/docker

- Launch blog: https://aws.amazon.com/blogs/containers/docker-official-imag...

0 comments

8 comments · 5 top-level

chrisbolt4y ago· 2 in thread

> As of today you can also find many of the top official Docker Hub images being mirrored to ECR Public, so you don't even need a pull through cache for those, you can pull from ECR Public directly

Is there any benefit to using pull-through caching with ECR Public images? Seems like it would just add extra storage costs.

NathanKPOP4y ago

ECR Public images are technically owned by the third party that uploaded them. Many AWS customers prefer to pull these public images into their own ECR private registry for more secure ownership of the copy.

chrisbolt4y ago

Thanks!

m1keil4y ago· 1 in thread

Why is it the case?

That sounds like a political decision and not a technical one.

Looking at the gallery, the images I'm interested in seem to be built/uploaded by a different entity. Which is not great.

m1keil4y ago

Looks like only official Docker images from Dockerhub will be in the ECR gallery. "Other images are under consideration for the roadmap next year, along with authenticated private registries."

Meh.

X-Istence4y ago

Unfortunately we can't just add this as a registry-mirrors in the docker daemon.json which means we still need to write all our Dockerfile's/build processes/container image selection to use the new ECR image URL, which is a shame.

Google supports this within GCP: https://cloud.google.com/container-registry/docs/pulling-cac... which makes it easy to avoid going all the way to Docker Hub for images.

shitloadofbooks4y ago

This feature is exciting, but ultimately a complete non-starter for us because of no Docker Hub support.

Are there plans to add it in the future?

Niksko4y ago

Wanna kill Dockerhub completely? A mutating admission controller for Kubernetes that would mirror an image the first time it saw it, and the. swap out the Dockerhub image URI for the ECR one would totally cut our reliance on Dockerhub.

If you don't build it, we might build it and open source it ourselves.

j / k navigate · click thread line to collapse