cloudstack-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Sebastien Goasguen <>
Subject Re: [DISCUSS] CloudStack Marketplace Update
Date Wed, 19 Dec 2012 19:28:12 GMT

On Dec 19, 2012, at 7:10 PM, Jie Feng <> wrote:

> Thanks Sebastian for trying to bring it to consensus. I like to separate each item and
make sure we have consensus on all of them. I am also including the user community (in addition
to dev) per Alex's recommendation.
> Here is the wiki site for the Marketplace Proposal:
> Here are items we need consensus on:
> 1. Separation of the marketplace code from the listing repository.
> We have reached consensus on this one. 
> 2. The community will not run an Apache listing repository.
> We have reached consensus on this one. I will modify the Wiki shortly. 
> 3. Place marketplace code in source code tree.
> There are people supporting this, and there are people not supporting this when we talked
about Marketplaceplace as a whole. When we separate marketplace code from the listing repository,
majority of the folks responded seems to be ok with this.

I had not made the distinction, I thought marketplace = listing repo. IMHO, the marketplace
is a functionality very different than the CloudStack orchestration.
There are possible comparison out there: Usharesoft has a marketplace, Amysta is a third party
metering system etc…they extend CloudStack and bring value to the users but they do not
enhance the core orchestration.

So I would vote -1 on this 

> 4. Disable Marketplace by default or not including any listing repository by default.
> The community in general seems to be concerned about including a third party listing
repository by default. My question is if third parties do run a listing repository, how do
we make CloudStack admins and users aware of this? And in general, how do we help folks who
build value-added offerings on top of CloudStack to reach the admins and users of the CloudStack
community? In my opinion, for an open source project to be successful, an ecosystem is very
important. My original goal is to design the Marketplace in such a way that the listings are
very easily accessible by admins and users, and have place for the ecosystem to participate
(think iPhone and iPhone apps). 

The many marketplaces that may develop from your code (by grabbing it from github for instance)
will be part of the ecosystem and bring value to the users. But IMHO we cannot show bias towards
one or the other.  There is also a huge security issue underlying all of this, and speaking
for myself, I certainly would not want to see a user come back with his lawyers and say "You
Apache CloudStack have this marketplace enabled by default, we used an image from this marketplace
and it was the source of a $1B loss for our company". Security, audit, provenance are missing
from your proposal.

What we could do I think is list CloudStack compatible marketplaces on our website and let
the users choose. I don't want to push something on the users, they should pull it understanding
the risks.

From a practical standpoint, I would love to see a working marketplace out there (starting
with just images) and a CloudStack patch for the marketplace client.
The client side I believe would be as welcome as things like the many storage backends integration
that have been submitted or even the nicira integration.

+1 on disabling by default and not including default repos.


> Jie
>> -----Original Message-----
>> From: sebgoa []
>> Sent: Wednesday, December 19, 2012 8:02 AM
>> To:
>> Subject: Re: [DISCUSS] CloudStack Marketplace Update
>> Hi,
>> I would like to help bring this thread to consensus.
>> I re-read the wiki:
>> ketplace+Proposal
>> The biggest issues that I believe drew concerns are:
>> 1-Mention of an Apache CloudStack listing repository 2-Mention of including
>> a listing repository in the source code.
>> To keep it short, we don't want to become liable for any image that a
>> CloudStack user would run on its cloud. We also don't want the source code
>> to contain anything that would be seen as product placement from any
>> vendors.
>> That said if the wiki page was modified to remove the mention of "an apache
>> cloudstack listing repository" and "inclusion in source code" and geared more
>> towards contributing a plugin that would enable cloudstack users to link to a
>> third party marketplace if they so desired. Then this would be agreeable.
>> I also believe this should be "disabled" by default with empty "listing
>> repositories".
>> If this is agreeable, Jie Feng and co. could run a marketplace on their own and
>> Cloudstack users could link to it. I could also work with the opennebula folks
>> to make the plugin generic enough to tie to their marketplace.
>> Thoughts ? (not too many flames, it's christmas soon :) )
>> -Sebastien
>> On Dec 13, 2012, at 10:56 PM, Joe Brockmeier wrote:
>>> On Fri, Dec 14, 2012 at 02:08:00PM +0000, Hugo Trippaers wrote:
>>>> Getting a bit late into the discussion here, but i agree with Chip here.
>>>> I'm already uncomfortable with the idea for a marketplace inside
>>>> CloudStack, but providing just the features allow some external party
>>>> (or parties) to set something up should be ok. But neither the ASF
>>>> nor we as a community should maintain such a marketplace. We as a
>>>> community are responsible for maintaining and distributing the
>>>> CloudStack source code, initiatives like a market place seem better
>>>> suited to a commercial entity or another group that is not directly
>>>> related to maintaining the source code of CloudStack.
>>> +1
>>> Best,
>>> jzb
>>> --
>>> Joe Brockmeier
>>> Twitter: @jzb

View raw message