4

I do not have production experience with docker and have several questions regarding a local registry:

A dockerfile is the description (=recipe) of how an image is built(=cooked, e.g. FROM alpine:3.5)

If the image on my Docker Host isn't present, it is pulled from a docker registry. As far as I know is Dockerhub regarding the "offical" images of the distributions "safe":

  • say, I can pull safely the alpine image and indeed get the official image? Or put in another way:

  • As long, as my images are only based on the "official" images, I do not need a local registry?

Additionally:

  • What is the advantage of having a (local) registry with ready images in a deployment scenario over building the image on the host off the baseimage (e.g. alpine) and create a new one on the host with few additional git checkouts of code to deploy? or

  • When does it make sense to pull full images from a (local) registry instead of building on the host? And then: why not using dockerhub private repositories for that?

Is a local registry only a thing of reliability/fallback or is there a gain of "trust" too?

Edit:

Perhaps a split answer makes sense regarding "small setups" (few images in parallel on a single host, "releases" once a week) vs "cloud scale" ( many images in parallel, many hosts, several releases a day) where the reasons are more obvious.

3

A Docker image is identified by:

[owner]/[name]:[tag]

When you get an official image from Docker Hub, the owner is not required.

Example:

alpine:latest

So,

I can pull safely the alpine image and indeed get the official image?

When you pull from the Docker Hub (Official Repository) you will get the official Alpine image.

My images are only based on the "official" images, I do not need a local registry?

Images are just layers. If all your images are based on official public images you will not need use a repository (Docker Hub or on-premise). But, a good practice is create a base image. This image is created from a Official Image plus your enterprise customizations.

Example:

mycompany/alpine-custom:latest

In this particular case, if you want to keep your image private and on-premise. You can use a internal registry. If you want to keep your image private, but on the cloud, Docker Hub private is also an option.

What is the advantage of having a (local) registry with ready images in a deployment scenario over building the image on the host off the baseimage (e.g. alpine) and create a new one on the host with few additional git checkouts of code to deploy?

When a application is ready for deployment, you create a package with all dependencies. You build the application before releasing. Is the same principle. It is better to have a static image prepared to production. It deploys faster and has less chance to download an incompatible dependency version or have a network failure.

When does it make sense to pull full images from a (local) registry instead of building on the host? And then: why not using dockerhub private repositories for that?

The chose between cloud or on-premise repository evolves aspects like: security, performance, reliability, costs, network availability, etc. Each scenario has its own particularities. Usually use DockerHub private is OK for majority of scenarios.

For instance:

  • You have to follow regulations that imposes to not use cloud platforms.
  • You use Docker for private processing and your network does not have access to the Internet.

Is good to thing about the Container Workflow:

Layer one:

  • Pull base
  • Build image-a
  • Push image-a

Layer two:

  • Pull image-a
  • Build image-b
  • Push image-b

Deployment:

  • Pull image-b
  • Run image-b
  • If I understand you correctly, it is good practice to have ready-to-run images prepared. Depending on "regulations" or reliability requirements one does it on premise vs. Dockerhub? My setup would be having as few customizations as possible for the base image (e. g. naked alpine, python, runtime depencies as python packages, actual code) – Thomas Junk Apr 18 '18 at 18:05
  • 2
    Yes, ready-to-run lean imagens with few layers and the minimum dependecies required. Once you pull a image all layers are cached on the host. This is one of the reasons to create your own base image. The base image layers will be cached and only your application layer will be pulled again. Independetly of your registry choice. – Anderson Marques Apr 18 '18 at 18:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.