Provide alternate image registry to dockerhub

[onedr0p]

Hello 👋🏼

In order to combat dockerhub's imposed rate limits it would be great to host these images on ghcr (github container registry) or quay.io.

[Fusion]

It is currently under investigation. Several considerations here:

1. It looks like Github itself has some limitations. I am particularly concerned about the "Data transfer out" of 1 GB: https://github.com/features/packages#pricing
2. Quay.io appears to be free: https://access.redhat.com/articles/quayio-help#:~:text=Can%20I%20use%20Quay%20for,what%20we%20can%20to%20help! and seems like an overall better home for FOSS project
3. I also looked into gcr but it seems like it would be difficult to keep costs under control

Note that, ideally, we would need to also host the images we rely on in the same location. If a single dependency is still pulled from Docker hub, Quay or Github builds would also fail, being on the receiving end of the rate limiter.

[onedr0p]

I'm not sure what Github is really limiting there, I've had no issues using GHCR with millions of pulls on open source projects. It's probably something you will never experience pain with.

[Fusion]

GHCR is part of GitHub Packages.
According to this page (https://docs.github.com/en/billing/managing-billing-for-github-packages/about-billing-for-github-packages):

Maybe this does not apply the way I think it does?

[onedr0p]

I'm not entirely sure but if you look around you'll see a ton of OSS using GHCR for free and hosting their images without a problem.

[onedr0p]

Given the recent dockerhub announcement of removing free team orgs, I'm wondering if the current org will be affected? And if so perhaps this could have a high priority?

docker/hub-feedback#2314

[onedr0p]

@Fusion sorry, not to poke too much but according to Docker you have 28 days from now to either pay Docker the $300/year cost or migrate the container elsewhere.

[Fusion]

Well, things got significantly worse.

This now needs to be two conversations:

• Clearly, you are correct, we are going to prioritize making images available on Github or elsewhere
• In addition, we would originally have kept making images available in docker hub.

If the latter is not possible anymore, then the ramifications are manifold.
Beyond the questions already being asked, such as "what if my organization is deleted and some malicious actor takes over?" I can also envision a scenario where the images are still available, but frozen in time. This will create an interesting drift for any existing pipeline that pulls the :latest tag.