Skip to content

Commit 380c832

Browse files
unclejacktiborvass
unclejack
authored and
tiborvass
committed
make http usage for registry explicit
Docker-DCO-1.1-Signed-off-by: Cristian Staretu <[email protected]> (github: unclejack) Conflicts: daemon/config.go daemon/daemon.go graph/pull.go graph/push.go graph/tags.go registry/registry.go registry/service.go
1 parent 28af4a1 commit 380c832

8 files changed

Lines changed: 74 additions & 16 deletions

File tree

‎daemon/config.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ type Config struct {
3131
BridgeIface string
3232
BridgeIP string
3333
FixedCIDR string
34+
InsecureRegistries []string
3435
InterContainerCommunication bool
3536
GraphDriver string
3637
GraphOptions []string
@@ -55,6 +56,7 @@ func (config *Config) InstallFlags() {
5556
flag.StringVar(&config.BridgeIP, []string{"#bip", "-bip"}, "", "Use this CIDR notation address for the network bridge's IP, not compatible with -b")
5657
flag.StringVar(&config.BridgeIface, []string{"b", "-bridge"}, "", "Attach containers to a pre-existing network bridge\nuse 'none' to disable container networking")
5758
flag.StringVar(&config.FixedCIDR, []string{"-fixed-cidr"}, "", "IPv4 subnet for fixed IPs (ex: 10.20.0.0/16)\nthis subnet must be nested in the bridge subnet (which is defined by -b or --bip)")
59+
opts.ListVar(&config.InsecureRegistries, []string{"-insecure-registry"}, "Make these registries use http")
5860
flag.BoolVar(&config.InterContainerCommunication, []string{"#icc", "-icc"}, true, "Enable inter-container communication")
5961
flag.StringVar(&config.GraphDriver, []string{"s", "-storage-driver"}, "", "Force the Docker runtime to use a specific storage driver")
6062
flag.StringVar(&config.ExecDriver, []string{"e", "-exec-driver"}, "native", "Force the Docker runtime to use a specific exec driver")

‎daemon/daemon.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -832,7 +832,7 @@ func NewDaemonFromDirectory(config *Config, eng *engine.Engine) (*Daemon, error)
832832
}
833833

834834
log.Debugf("Creating repository list")
835-
repositories, err := graph.NewTagStore(path.Join(config.Root, "repositories-"+driver.String()), g, config.Mirrors)
835+
repositories, err := graph.NewTagStore(path.Join(config.Root, "repositories-"+driver.String()), g, config.Mirrors, config.InsecureRegistries)
836836
if err != nil {
837837
return nil, fmt.Errorf("Couldn't create Tag store: %s", err)
838838
}

‎docs/sources/reference/commandline/cli.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,8 @@ expect an integer, and they can only be specified once.
7070
-g, --graph="/var/lib/docker" Path to use as the root of the Docker runtime
7171
-H, --host=[] The socket(s) to bind to in daemon mode or connect to in client mode, specified using one or more tcp://host:port, unix:///path/to/socket, fd://* or fd://socketfd.
7272
--icc=true Enable inter-container communication
73-
--ip=0.0.0.0 Default IP address to use when binding container ports
73+
--insecure-registry=[] Make these registries use http
74+
--ip=0.0.0.0 Default IP address to use when binding container ports
7475
--ip-forward=true Enable net.ipv4.ip_forward
7576
--ip-masq=true Enable IP masquerading for bridge's IP range
7677
--iptables=true Enable Docker's addition of iptables rules

‎graph/pull.go‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -113,7 +113,9 @@ func (s *TagStore) CmdPull(job *engine.Job) engine.Status {
113113
return job.Error(err)
114114
}
115115

116-
endpoint, err := registry.NewEndpoint(hostname)
116+
secure := registry.IsSecure(hostname, s.InsecureRegistries)
117+
118+
endpoint, err := registry.NewEndpoint(hostname, secure)
117119
if err != nil {
118120
return job.Error(err)
119121
}

‎graph/push.go‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -214,7 +214,9 @@ func (s *TagStore) CmdPush(job *engine.Job) engine.Status {
214214
return job.Error(err)
215215
}
216216

217-
endpoint, err := registry.NewEndpoint(hostname)
217+
secure := registry.IsSecure(hostname, s.InsecureRegistries)
218+
219+
endpoint, err := registry.NewEndpoint(hostname, secure)
218220
if err != nil {
219221
return job.Error(err)
220222
}

‎graph/tags.go‎

Lines changed: 13 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -23,10 +23,11 @@ var (
2323
)
2424

2525
type TagStore struct {
26-
path string
27-
graph *Graph
28-
mirrors []string
29-
Repositories map[string]Repository
26+
path string
27+
graph *Graph
28+
mirrors []string
29+
InsecureRegistries []string
30+
Repositories map[string]Repository
3031
sync.Mutex
3132
// FIXME: move push/pull-related fields
3233
// to a helper type
@@ -54,18 +55,19 @@ func (r Repository) Contains(u Repository) bool {
5455
return true
5556
}
5657

57-
func NewTagStore(path string, graph *Graph, mirrors []string) (*TagStore, error) {
58+
func NewTagStore(path string, graph *Graph, mirrors []string, insecureRegistries []string) (*TagStore, error) {
5859
abspath, err := filepath.Abs(path)
5960
if err != nil {
6061
return nil, err
6162
}
6263
store := &TagStore{
63-
path: abspath,
64-
graph: graph,
65-
mirrors: mirrors,
66-
Repositories: make(map[string]Repository),
67-
pullingPool: make(map[string]chan struct{}),
68-
pushingPool: make(map[string]chan struct{}),
64+
path: abspath,
65+
graph: graph,
66+
mirrors: mirrors,
67+
InsecureRegistries: insecureRegistries,
68+
Repositories: make(map[string]Repository),
69+
pullingPool: make(map[string]chan struct{}),
70+
pushingPool: make(map[string]chan struct{}),
6971
}
7072
// Load the json file if it exists, otherwise create it.
7173
if err := store.reload(); os.IsNotExist(err) {

‎registry/registry.go‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -213,6 +213,55 @@ func ResolveRepositoryName(reposName string) (string, string, error) {
213213
return hostname, reposName, nil
214214
}
215215

216+
// this method expands the registry name as used in the prefix of a repo
217+
// to a full url. if it already is a url, there will be no change.
218+
func ExpandAndVerifyRegistryUrl(hostname string, secure bool) (endpoint string, err error) {
219+
if strings.HasPrefix(hostname, "http:") || strings.HasPrefix(hostname, "https:") {
220+
// if there is no slash after https:// (8 characters) then we have no path in the url
221+
if strings.LastIndex(hostname, "/") < 9 {
222+
// there is no path given. Expand with default path
223+
hostname = hostname + "/v1/"
224+
}
225+
if _, err := pingRegistryEndpoint(hostname); err != nil {
226+
return "", errors.New("Invalid Registry endpoint: " + err.Error())
227+
}
228+
return hostname, nil
229+
}
230+
231+
// use HTTPS if secure, otherwise use HTTP
232+
if secure {
233+
endpoint = fmt.Sprintf("https://%s/v1/", hostname)
234+
} else {
235+
endpoint = fmt.Sprintf("http://%s/v1/", hostname)
236+
}
237+
_, err = pingRegistryEndpoint(endpoint)
238+
if err != nil {
239+
//TODO: triggering highland build can be done there without "failing"
240+
err = fmt.Errorf("Invalid registry endpoint '%s': %s ", endpoint, err)
241+
if secure {
242+
err = fmt.Errorf("%s. If this private registry supports only HTTP, please add `--insecure-registry %s` to the daemon's arguments.", err, hostname)
243+
}
244+
return "", err
245+
}
246+
return endpoint, nil
247+
}
248+
249+
// this method verifies if the provided hostname is part of the list of
250+
// insecure registries and returns false if HTTP should be used
251+
func IsSecure(hostname string, insecureRegistries []string) (secure bool) {
252+
secure = true
253+
for _, h := range insecureRegistries {
254+
if hostname == h {
255+
secure = false
256+
break
257+
}
258+
}
259+
if hostname == IndexServerAddress() {
260+
secure = true
261+
}
262+
return
263+
}
264+
216265
func trustedLocation(req *http.Request) bool {
217266
var (
218267
trusteds = []string{"docker.com", "docker.io"}

‎registry/service.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ func (s *Service) Auth(job *engine.Job) engine.Status {
4040
job.GetenvJson("authConfig", authConfig)
4141
// TODO: this is only done here because auth and registry need to be merged into one pkg
4242
if addr := authConfig.ServerAddress; addr != "" && addr != IndexServerAddress() {
43-
endpoint, err := NewEndpoint(addr)
43+
endpoint, err := NewEndpoint(addr, true)
4444
if err != nil {
4545
return job.Error(err)
4646
}

0 commit comments

Comments
 (0)