Just to repeat what I mentioned a while before on the investigation ticket.

Toolbx still uses registry.fedoraproject.org for its fedora-toolbox images. From Fedora 39 onwards these images are produced by Fedora's nightly composes.

We are open to moving to quay.io but we need some migration period because the URL to the image is baked into the toolbox RPM, and we can't change it without knowing exactly what it would be.

FWIW, IMHO, we should try and redirect existing registry.fedoraproject.org to quay.io if tools will understand that. Or I guess proxy them if not. At least initially. This will allow us to 'fail back' if there's problems or we need to down the road. But I am not sure the details on if thats possible.

So, there is some question about how we want to do things.

I personally think we should keep things pointed to the registry.fedoraproject.org, and then that redirects them to quay.io for the actual image.
The advantage of this is that we control it, and can repoint it somewhere else if we like, or run our own registry for some part of it and redirect other things.
It also means we can change it in our infra and it immediately would take effect.

If on the other hand, we change everything to say 'use quay.io', there's the advantage that we don't have to redirect and it's all on them.
But the downside is that if ever we need to change it again, we will have to change it in all the places it's currently set (documentation, podman, toolbox, etc).
Any changes will take rebuilding things and pushing out updates and be a long and slow process.

Can folks chime in with their thoughts on this so we can decide how to approach it?

So, there is some question about how we want to do things.

I personally think we should keep things pointed to the registry.fedoraproject.org, and then that redirects them to quay.io for the actual image.
The advantage of this is that we control it, and can repoint it somewhere else if we like, or run our own registry for some part of it and redirect other things.
It also means we can change it in our infra and it immediately would take effect.

If on the other hand, we change everything to say 'use quay.io', there's the advantage that we don't have to redirect and it's all on them.
But the downside is that if ever we need to change it again, we will have to change it in all the places it's currently set (documentation, podman, toolbox, etc).
Any changes will take rebuilding things and pushing out updates and be a long and slow process.

Yes, I am with you on this one, assuming that the underlying technical realities let us use registry.fedoraproject.org as a front.

A hard switch to quay.io can be done later once things have settled and we are confident about it. Until then, the possibly of a revert and all the associated churn, makes it wise to continue pointing the clients to registry.fedoraproject.org.

So, there is some question about how we want to do things.

I personally think we should keep things pointed to the registry.fedoraproject.org, and then that redirects them to quay.io for the actual image.
The advantage of this is that we control it, and can repoint it somewhere else if we like, or run our own registry for some part of it and redirect other things.
It also means we can change it in our infra and it immediately would take effect.

If on the other hand, we change everything to say 'use quay.io', there's the advantage that we don't have to redirect and it's all on them.
But the downside is that if ever we need to change it again, we will have to change it in all the places it's currently set (documentation, podman, toolbox, etc).
Any changes will take rebuilding things and pushing out updates and be a long and slow process.

Yes, I am with you on this one, assuming that the underlying technical realities let us use registry.fedoraproject.org as a front.

A hard switch to quay.io can be done later once things have settled and we are confident about it. Until then, the possibly of a revert and all the associated churn, makes it wise to continue pointing the clients to registry.fedoraproject.org.

I am also +1 to this approach of keeping registry.fp.o as a front and then redirecting. I still would want to check out the latency situation after the redirect. Any chance you can give us a timeline for testing?

I personally think we should keep things pointed to the registry.fedoraproject.org, and then that redirects them to quay.io for the actual image.
The advantage of this is that we control it, and can repoint it somewhere else if we like, or run our own registry for some part of it and redirect other things.
It also means we can change it in our infra and it immediately would take effect.

Oh, this is indeed a good idea. We started "migrating" to quay.io images in Fedora CoreOS land but this looks like a better approach if this works well.

May I ask what's the official place for Fedora containers now?

A documentation https://docs.fedoraproject.org/en-US/containers/#_where_to_find_the_containers points to registry.fedoraproject.org where the images were not updated since November 2023 https://registry.fedoraproject.org/repo/fedora/tags/.

Most of the projects hosted on registry.fp.o either moved or moving to quay.io. There is a Fedora organization on quay.io, where you should find most of the images.

Yes, but note... IMHO we should just keep using registry.fedoraproject.org and have it redirect, so in that case we shouldn't need to change any docs.

May I ask what's the official place for Fedora containers now?

Yes, just keep using registry.fedoraproject.org. :)

To clarify, are we saying that registry.fp.o should still be the canonical repo and that Quay.io is an implementation detail, or that the redirect is more of a backcompat thing but that the expectation is that eventually we shut down registry.fp.o? Clearly, the quay.io repos have already gone around and been documented quite some time now, so I don't know how realistic it is to consider it an implementation detail at this point.

A downside I raised in https://github.com/coreos/fedora-coreos-config/pull/2988 is that using registry.fp.o means that service is now also in your dependency path. Being dependent on less things being up is very valuable in a CI context.

Yeah, I guess I was imagining that we would keep registry.fedoraproject.org for a while redirecting to quay.io and make sure there were not any big issues that would cause us to roll back.
If we did have to roll back we just change dns, instead of updaing a bunch of packages, etc.

You do make a good point that it adds another 'hop' in there and also makes us a dependency...

Yeah, I guess I was imagining that we would keep registry.fedoraproject.org for a while redirecting to quay.io

I think it's fine to keep the redirector, but maybe we don't promote it? i.e. if people are using registry.fedoraproject.org then it would keep working.. but our docs and things all get updated to the new location?