registry.k8s.io VS devenv

If you stop to think about, what AWS is selling here, it's quite funny. Most of the infrastructure behind registry.k8s.io is hosted on AWS (and also GCP). So AWS essentially tells you: Don't trust the upstream registry, it might go down, cache it on your own registry, hosted also by us.

For example: if you only allow cluster autoscaler and metrics server from registry.k8s.io you can pull those images through the cache as someone who has create repo IAM privileges. If someone without create repo privileges tries to pull a new image it will fail because they can't create the initial repo.

https://registry.k8s.io (the root url at /) redirects you to https://github.com/kubernetes/registry.k8s.io where we have an issue tracker.

❗ This container is having trouble accessing https://registry.k8s.io

Hosting a forwarding / redirect server instead of actually hosting images is probably a decent idea.

The K8s proxy is redirecting from only hosting on GCR to community-owned registries - https://kubernetes.io/blog/2023/03/10/image-registry-redirec...

You can view the code here - https://github.com/kubernetes/registry.k8s.io

But because everyone is already pointing at gcr.io (just like many openfaas users point at docker.io/) - they're having to do a huge campaign to announce the new URL - the same would apply with the author's solution here.

I wrote some automation for hosting (not redirects) in arkade with the OSS registry - Get a TLS-enabled Docker registry in 5 minutes - https://blog.alexellis.io/get-a-tls-enabled-docker-registry-...

The registry is also something you can run on a VM if you so wish, and have act as a pull through cache.

Apart from reliability - GitHub's container registry is the current next best option - but we have to ask ourselves, what happens when they start charging or the outages start to last longer or are more frequent than 1-2 times per week as we've seen in Q1 2023.

One annoyance with how docker images are specified is they include the location where they are stored. So if you want to change where you store you image you break everyone.

I wonder if what regsitry.k8s.io does could be generalized:

https://github.com/kubernetes/registry.k8s.io/blob/main/cmd/...

The idea is the depending on which cloud you are pulling the image from, they will use the closest blob store to service the request. This also has the effect that you could change the source of truth for the registry without breaking all Dockerfiles.

If you are using updated helm charts then most of them have already replaced with registry.k8s.io, for example nginx ingress so not really breaking change.

Sounds like nix using devenv[1] also would solve this problem.

https://devenv.sh/

It works on MacOS/Windows, unlike systemd. Therefore it's well suited for development environment setups for polyglot teams.

https://devenv.sh/ is one example that uses it to do just that.

I gave devenv multiple tries, and I am sorry to say there are multiple annoying issues that forced me to give up every time.

Some of these 200+ issues are unsolved for a fairly long time.

https://github.com/cachix/devenv/issues

Software developers often want to customize:

1. their home environments: for packages (some reach for brew on MacOS) and configurations (dotfiles, and some reach for stow).

2. their development shells: for build dependencies (compilers, SDKs, libraries), tools (LSP, linters, formatters, debuggers), and services (runtime, database). Some reach for devcontainers here.

3. or even their operating systems: for development, for CI, for deployment, or for personal use.

Nix provision all of the above in the same language, with Nixpkgs, NixOS, home-manager, and devShells such as https://devenv.sh/. What's more, Nix is (https://nixos.org/):

- reproducible: what works on your dev machine also works in CI in prod,

- declarative: you version control and review your configurations and infrastructure as code, at a reasonable level of abstraction,

- reliable: all changes are atomic with easy roll back.

https://devenv.sh/ and nix in general are great for setting up dev environments.

> but worried that the development is not moving forward

There is an open v1.0 PR: https://github.com/cachix/devenv/pull/1005

2) A way to run services apps depend on (databases, job runners, cache etc).

I am going to suggest one of the Nix based tools that do those things:

  - https://devenv.sh/ (I use this at work)

Yup, I haven’t tried it but there is https://devenv.sh which is built on top of nix and makes it simple.

Although Guix reads better than Nix (after all, it's Lisp), I found the support and resources available for learning severely lacking.

Plus, you have to jump through hoops to install non-free software, which goes against the ethos of Guix anyway.

IMHO, Nix is clearly "the winner" here and we'll see more and more adoption as it improves. Lots of folks are doing exciting work (see https://determinate.systems/, https://devenv.sh/, https://flakehub.com/). And the scale and organization around nixpkgs is damn impressive.

I don't think you can ever get Nix as simple as PNPM, simply because native libraries are sometimes annoying, need to be configured at build time to a greater degree and because the problem space it attacks is so much larger than PNPM, which only deals with the JS/Node.js ecosystem.

However, I do think that there exist reasonable levels of abstraction that sacrifice some expressive power for simplicity and such systems could maybe expose a PNPM-like CLI. One example that comes to mind is devenv.nix [1]. While it doesn't yet have a CLI, its configuration file is YAML and relatively simple. I think there's more to be done in this space and I hope for tools that are easier to grasp in the future.

> Nix package files evaluate down to configuration for the Nix package manager, but I haven’t ever seen a good explanation for the basic essentials underneath all the abstraction. Every guide I’ve learned from and all the package defs I’ve read seem to cargo cult many layers of mysterious config composing config. Without easy to learn essentials it’s difficult to grok the system as a whole.

To me it sounds like the essential that you're referring to is the 'derivation' primitive, which is almost always hidden behind the mkDerivation abstraction from nixpkgs. This [2] blog post is an exploration of what exactly that means.

I'd also love for the documentation situation to be much better, in particular in terms of official, curated resources. But I'm not convinced that you actually need to know the difference between derivation and mkDerivation to make effective use of Nix, because in practice you would always use the latter. That said, mkDerivation and the whole of nixpkgs is essentially a huge DSL (I believe this is what you meant when you said 'config composing config') that you do need to know and is woefully underdocumented.

> I would love to adopt Nix for developer tooling for Notion’s engineers, but today it’s about infinity times easier to work around the limitations mentioned of Docker+Ubuntu+NPM than to work around the limitations of Nix.

One approach I have taken to is to specify the environment in Nix, but then generate Docker devcontainers from it, so most people don't come into contact with Nix if they don't want to.

[1] https://devenv.sh

[2] https://ianthehenry.com/posts/how-to-learn-nix/derivations/