We wanted to clarify how recent changes to the Docker Hub affect OpenFaaS users.

I published an article last week in response to Docker Inc’s move to delete free open source organisations and their associated images from the Docker Hub. The response was overwhelming, with over 105k page views, hundreds of Hacker News comments and community Tweets being shared as people came to terms with the proposed changes and in particular - the style of delivery.

You can read up on the full story here, including a link to Docker’s later press-release: Docker is deleting Open Source organisations - what you need to know

TL;DR

The following may only affect OpenFaaS Community Edition (CE) or “free users” who haven’t updated their systems in over two years. There is no change for OpenFaaS Standard/Enterprise customers.

Note: in the OpenFaaS CE, Pro charts and for faasd - we continue to make use of Prometheus and NATS images which are hosted on the Docker Hub. We do not have control over where these images are hosted, and recommend buying a Docker Hub account to avoid running into rate-limits. Alternatively, you could mirror these images to your own registry.

What does this mean for OpenFaaS?

In October 2020, I wrote up a similar article when Docker Inc introduced restrictive rate-limits on the Docker Hub for free, public images. At the time, my advice was to pay Docker for a Pro account and my advice focused on how to configure the required authentication.

How to prepare for the Docker Hub Rate Limits

I even wrote an Open Source Kubernetes Operator which is still by a number of companies today to replicate their Docker Hub paid account credentials through their cluster - alexellis/registry-creds.

At the time, we made a decision in the community to stop publishing images to the Docker Hub, and to migrate to GitHub’s Container Registry (ghcr.io). The main reason was that any user of OpenFaaS CE would need to pay for A Docker Hub account before they could use the project.

Even if they did manage to pull the images, if they needed to do an update, they may have run into the limit. We didn’t want that barrier to entry.

We’ve deleted images from the Docker Hub

Since 2020 images have been published to ghcr.io instead of the Docker Hub. That means that if you are using images from well over two years ago in production, that you’ve made yourself vulnerable to a significant amount of risk by not updating.

I would have rather left the images available, however with Docker’s threat to delete them within 30 days, we were left with very few options.

We’ve made concerted efforts to encourage commercial users, even Fortune 500s to sponsor OpenFaaS for the value they receive from the Community Edition, however this has been in vain. At time of writing, OpenFaaS receives around 700 USD / mo in total via GitHub Sponsors, possibly less since GitHub removed the option for payment via PayPal. We simply cannot justify taking on Docker’s 420 USD / year bill for the OpenFaaS organisation.

What about Docker’s OSS program?

As I explain in the article. Docker’s OSS program is out of touch. They will not allow any project to join if there is a way to pay for a better level of service, additional features, or for commercial support.

How do we maintain the project without funding from commercial users?

The Community Edition of OpenFaaS is already provides a large amount of value, which presents a challenge to monetization, especially in the middle of a global downturn. However, since 2019, we’ve focused on an open-core and support model, and existing customers of OpenFaaS Ltd, are not affected by this change.

What about Docker Swarm?

Support for Docker Swarm was formally deprecated 2 years and 3 months ago. The code is available on GitHub, but with the deletion of images from the Docker Hub, there are currently no container images available for OpenFaaS CE on Swarm.

If you were still using OpenFaaS with Docker Swarm, so long after the deprecation, we would recommend making a move to OpenFaaS CE with K3s, or the simpler faasd project, which runs on a single VM.

I wrote a manual for faasd called Serverless For Everyone Else which is based around practical examples written in Node.js - such as connecting to a database, managing secrets, monitoring, adding cron-schedules, custom domains and hosting functions on cloud VMs.

Find out when to use OpenFaaS CE on Kubernetes vs faasd

What do we need to do - going forward?

There is no change for CE and Pro users who have deployed OpenFaaS over the past two years. You will continue to receive updates and new features as they are released through images on GitHub’s container registry (ghcr.io).

If you have custom OpenFaaS templates, check and make sure the “FROM” for the OpenFaaS watchdog point to GHCR and not docker.io. A lack of a prefix also uses the Docker Hub.

-FROM --platform=${BUILDPLATFORM:-linux/amd64} openfaas/of-watchdog:0.8.0 as watchdog
+FROM --platform=${BUILDPLATFORM:-linux/amd64} ghcr.io/openfaas/of-watchdog:0.8.0 as watchdog

This isn’t necessary unless you forked templates or created your own custom ones over two years ago.

Summary

Whilst there was very vocal opposition to the way the changes were made by Docker Inc and the short time-line given, we had already migrated to ghcr.io for images in 2020, and we’ve been using it for all new releases since then.

The deletion of our deprecated images from the Docker Hub will affect a number of users who haven’t updated their systems in a very long time, however, using images that are so old is a huge risk to your business or to your employer.

For OpenFaaS CE aka “free users” - simply update the images in your chart to the equivalents on ghcr.io, or install the chart again over the top of an existing installation to upgrade to the latest version.

We hold a weekly Office Hours calls for OpenFaaS users, if you’d like to talk to us about your options, feel free to join. Or send us a note about your use-case to the ADOPTERS.md file.

If you are a commercial user of OpenFaaS CE, and haven’t updated your system in a very long time, it may be worth seeing what we now offer in a paid subscription: OpenFaaS comparison

If you want to support our Open Source work on OpenFaaS CE and faasd, you can do so via GitHub Sponsors which goes towards the salaries of full-time staff working on the project.

Alex Ellis

Founder of @openfaas.