Signed-off-by: Akihiro Suda [email protected]

This commit sets containerd.io/image.remote.ref label to images and corresponding snapshots.
e.g. docker.io/library/alpine:latest.
(Note that "image reference" differs from "image name": https://godoc.org/github.com/containerd/containerd/remotes#Resolver)

Future version MAY set containerd.io/image.remote.resolver explicitly as well, although we haven't decided any convention for resolver identifier string.
Note that we won't set any registry credential as labels.

Usecase: continuity snapshotter plugin with lazy-pull feature

I'm working on a project that uses continuity manifest (== info for getdents(2) and stat(2)) as an image layer, instead of legacy tar balls.
On initial client.Pull() and image.Unpack(), only the continuity manifest is pulled and unpacked.
This enables running containers without pulling the whole rootfs blobs, and lazily pulling blobs on demand.

• POC (raw rootfs mounter without any containerd stuff): https://github.com/akihirosuda/filegrain
• Presentation at ContainerCon (OpenSource Summit) North America 2017: https://www.slideshare.net/AkihiroSuda/filegrain-transportagnostic-finegrained-contentaddressable-container-image-layout

@stevvooe suggested me to implement this as a containerd snapshotter (and differ and contentstore) plugin, and I found that such a plugin would need to get remote reference information (containerd.io/image.remote.ref) from the client.

Note that the plugin can resolve the registry credential by itself in its own way, probably via plugin-specific entries in /etc/containerd/config.toml:

# executes `docker-crendial-foobar get` for resolving the credential
[plugins.continuity]
    dockerAuthResolvingMethod = "docker-credential-plugin"
    dockerConfigJSON = "/root/.docker/config.json"

cc @stevvooe @dmcgowan @tonistiigi