Skip to content

Commit 71c1dc6

Browse files
fuweidfuweid
authored
Merge pull request #5676 from dmcgowan/update-for-distribution-spec-1.0
2 parents 0573e22 + a7ad6b3 commit 71c1dc6

4 files changed

Lines changed: 75 additions & 15 deletions

File tree

‎README.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,14 @@ your system. See more details in [Checkpoint and Restore](#checkpoint-and-restor
6868

6969
Build requirements for developers are listed in [BUILDING](BUILDING.md).
7070

71+
72+
## Supported Registries
73+
74+
Any registry which is compliant with the [OCI Distribution Specification](https://github.com/opencontainers/distribution-spec)
75+
is supported by containerd.
76+
77+
For configuring registries, see [registry host configuration documentation](docs/hosts.md)
78+
7179
## Features
7280

7381
### Client

‎docs/hosts.md‎

Lines changed: 27 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,14 @@ Configuring registries will be done by specifying (optionally) a `hosts.toml` fi
55
each desired registry host in a configuration directory. **Note**: Updates under this directory
66
do not require restarting the containerd daemon.
77

8+
## Registry API Support
9+
10+
All configured registry hosts are expected to comply with the [OCI Distribution Specification](https://github.com/opencontainers/distribution-spec).
11+
Registries which are non-compliant or implement non-standard behavior are not guaranteed
12+
to be supported and may break unexpectedly between releases.
13+
14+
Currently supported OCI Distribution version: **[v1.0.0](https://github.com/opencontainers/distribution-spec/tree/v1.0.0)**
15+
816
## Specifying the Configuration Directory
917

1018
### Using Host Namespace Configs with CTR
@@ -235,8 +243,10 @@ client = [["/etc/certs/client.cert", "/etc/certs/client.key"],["/etc/certs/clien
235243

236244
## skip_verify field
237245

238-
`skip_verify` set this flag to `true` to skip the registry certificate
239-
verification for this registry host namespace. (Defaults to `false`)
246+
`skip_verify` skips verifications of the registry's certificate chain and
247+
host name when set to `true`. This should only be used for testing or in
248+
combination with other method of verifying connections. (Defaults to `false`)
249+
240250
```
241251
skip_verify = false
242252
```
@@ -264,6 +274,17 @@ or
264274
x-custom-1-2 = "another custom header"
265275
```
266276

277+
## override_path field
278+
279+
`override_path` is used to indicate the host's API root endpoint is defined
280+
in the URL path rather than by the API specification. This may be used with
281+
non-compliant OCI registries which are missing the `/v2` prefix.
282+
(Defaults to `false`)
283+
284+
```
285+
override_path = true
286+
```
287+
267288
## host field(s) (in the toml table format)
268289

269290
`[host]."https://namespace"` and `[host].http://namespace` entries in the
@@ -300,6 +321,10 @@ for this registry host namespace:
300321
301322
[host."https://test-3.registry"]
302323
client = ["/etc/certs/client-1.pem", "/etc/certs/client-2.pem"]
324+
325+
[host."https://non-compliant-mirror.registry/v2/upstream"]
326+
capabilities = ["pull"]
327+
override_path = true
303328
```
304329

305330
**Note**: Recursion is not supported in the specification of host mirror

‎remotes/docker/config/hosts.go‎

Lines changed: 22 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -54,8 +54,6 @@ type hostConfig struct {
5454

5555
header http.Header
5656

57-
// TODO: API ("docker" or "oci")
58-
// TODO: API Version ("v1", "v2")
5957
// TODO: Add credential configuration (domain alias, username)
6058
}
6159

@@ -283,19 +281,34 @@ type hostFileConfig struct {
283281
// - push
284282
Capabilities []string `toml:"capabilities"`
285283

286-
// CACert can be a string or an array of strings
284+
// CACert are the public key certificates for TLS
285+
// Accepted types
286+
// - string - Single file with certificate(s)
287+
// - []string - Multiple files with certificates
287288
CACert interface{} `toml:"ca"`
288289

289-
// TODO: Make this an array (two key types, one for pairs (multiple files), one for single file?)
290+
// Client keypair(s) for TLS with client authentication
291+
// Accepted types
292+
// - string - Single file with public and private keys
293+
// - []string - Multiple files with public and private keys
294+
// - [][2]string - Multiple keypairs with public and private keys in separate files
290295
Client interface{} `toml:"client"`
291296

297+
// SkipVerify skips verification of the server's certificate chain
298+
// and host name. This should only be used for testing or in
299+
// combination with other methods of verifying connections.
292300
SkipVerify *bool `toml:"skip_verify"`
293301

302+
// Header are additional header files to send to the server
294303
Header map[string]interface{} `toml:"header"`
295304

296-
// API (default: "docker")
297-
// API Version (default: "v2")
298-
// Credentials: helper? name? username? alternate domain? token?
305+
// OverridePath indicates the API root endpoint is defined in the URL
306+
// path rather than by the API specification.
307+
// This may be used with non-compliant OCI registries to override the
308+
// API root endpoint.
309+
OverridePath bool `toml:"override_path"`
310+
311+
// TODO: Credentials: helper? name? username? alternate domain? token?
299312
}
300313

301314
func parseHostsFile(baseDir string, b []byte) ([]hostConfig, error) {
@@ -367,16 +380,12 @@ func parseHostConfig(server string, baseDir string, config hostFileConfig) (host
367380
}
368381
result.scheme = u.Scheme
369382
result.host = u.Host
370-
// TODO: Handle path based on registry protocol
371-
// Define a registry protocol type
372-
// OCI v1 - Always use given path as is
373-
// Docker v2 - Always ensure ends with /v2/
374383
if len(u.Path) > 0 {
375384
u.Path = path.Clean(u.Path)
376-
if !strings.HasSuffix(u.Path, "/v2") {
385+
if !strings.HasSuffix(u.Path, "/v2") && !config.OverridePath {
377386
u.Path = u.Path + "/v2"
378387
}
379-
} else {
388+
} else if !config.OverridePath {
380389
u.Path = "/v2"
381390
}
382391
result.path = u.Path

‎remotes/docker/config/hosts_test.go‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -104,6 +104,13 @@ ca = "/etc/path/default"
104104
105105
[host."https://test-3.registry"]
106106
client = ["/etc/certs/client-1.pem", "/etc/certs/client-2.pem"]
107+
108+
[host."https://noncompliantmirror.registry/v2/namespaceprefix"]
109+
capabilities = ["pull"]
110+
override_path = true
111+
112+
[host."https://noprefixnoncompliant.registry"]
113+
override_path = true
107114
`
108115
var tb, fb = true, false
109116
expected := []hostConfig{
@@ -159,6 +166,17 @@ ca = "/etc/path/default"
159166
{filepath.FromSlash("/etc/certs/client-2.pem")},
160167
},
161168
},
169+
{
170+
scheme: "https",
171+
host: "noncompliantmirror.registry",
172+
path: "/v2/namespaceprefix",
173+
capabilities: docker.HostCapabilityPull,
174+
},
175+
{
176+
scheme: "https",
177+
host: "noprefixnoncompliant.registry",
178+
capabilities: allCaps,
179+
},
162180
{
163181
scheme: "https",
164182
host: "test-default.registry",

0 commit comments

Comments
 (0)