Deprecate non-distributable layers #965

imjasonh · 2022-10-13T18:16:44Z

Microsoft has announced their intention to change their image redistribution policy so that Windows images no longer make use of non-distributable layers: https://techcommunity.microsoft.com/t5/containers/announcing-windows-container-base-image-redistribution-rights/ba-p/3645201

@justincormack says:

Foreign layers in OCI images can now be deprecated

https://twitter.com/justincormack/status/1580536342114492417

This PR updates the spec to note that clients SHOULD NOT create new images with non-distributable layers. They may still need to handle them for old images created pre-this-deprecation however.

Please feel free to suggest better wording. 🚲🏠

Signed-off-by: Jason Hall <[email protected]>

sudo-bmitch

LGTM. If we merge this and someone later complains with a good use case, we can then consider undoing the deprecation.

layer.md

Signed-off-by: Jason Hall <[email protected]>

SteveLasker

Thanks, @imjasonh
LGTM

sajayantony · 2022-10-13T21:27:54Z

Thanks @imjasonh.

I'm seeing a few things worth calling out on this thread since we are waiting from @jonjohnsonjr to reach out to some folks in Red Hat as what I recollect from the call. To me this is -

Deprecating/"Recommending against" using 3 media types going fowrard-

     application/vnd.oci.image.layer.nondistributable.v1.tar
     application/vnd.oci.image.layer.nondistributable.v1.tar+gzip
     application/vnd.oci.image.layer.nondistributable.v1.tar+zstd

Discouraging use of URLs which is typically associated with these mediaTypes but is not strictly tied to non-distributable layers

Descriptors referencing non-distributable layers MAY include urls for downloading these layers directly; however, the presence of the urls field SHOULD NOT be used to determine whether or not a layer is non-distributable.

image-spec/specs-go/v1/descriptor.go

Lines 32 to 33 in 8159c82

    
           // URLs specifies a list of URLs from which this object MAY be downloaded 
        
           URLs []string `json:"urls,omitempty"`

For new client implementations should they continue honoring these? Asking because there might be TOS associated with these and these definitions are kept only for backwards compatability only.

Lastly should we update the comments to the descriptor fields as well or are we continuing to support this but only recommending not using the mediaTypes?

jonjohnsonjr · 2022-10-13T22:17:11Z

Discouraging use of URLs which is typically associated with these mediaTypes but is not strictly tied to non-distributable layers

I'm not sure if I'd go this far.

imjasonh · 2022-10-14T15:33:36Z

cc @dmesser -- Hey Daniel, we're hoping to signal the deprecation of non-distributable layers now that Windows images aren't going to be using them anymore. When we discussed yesterday @jonjohnsonjr mentioned he thought he might have seen some Red Hat images using them. Do you happen to know of any such cases?

If not we'd like to proceed with deprecation, but just in case there are still real world users of them it would be helpful to know.

Signed-off-by: Jason Hall <[email protected]>

imjasonh · 2022-10-14T15:41:12Z

@sajayantony Thanks for mentioning this. I think it would be helpful for folks to see some deprecation signal when they land at https://github.com/opencontainers/image-spec/blob/main/media-types.md as well -- I'll update this PR.

I don't think we should deprecate urls since there may still be use cases where those are used outside of non-distributable layers. If nothing else, I think it should be a separate discussion/decision to deprecate urls taken in isolation.

thecloudtaylor · 2022-10-14T17:03:12Z

I don't think we are in a state to move forward with a depreciation just yet. When we started evaluating that internally we found a number of concerns (mostly around developers pushing images) that I think should be discussed in the community before we commit to a path.

imjasonh · 2022-10-14T17:22:47Z

I don't think we are in a state to move forward with a depreciation just yet. When we started evaluating that internally we found a number of concerns (mostly around developers pushing images) that I think should be discussed in the community before we commit to a path.

Thanks, that's really helpful to hear! Can you enumerate the concerns?

FWIW I don't think the language as written should be interpreted as "clients SHOULD NOT pass along images with non-distributable layers", only that new builder tools SHOULD NOT produce new images with them.

Even that weak advice is unenforceable -- the OCI Police will knock down your door if you do it -- but it gives folks a gentle nudge away from them if they're considering using them in new images, or supporting them in new tools that don't expect to handle old pre-deprecation layers.

But obviously if you've got insights from actual users then that would be really helpful to include here as well.

dmesser · 2022-10-17T07:45:35Z

cc @dmesser -- Hey Daniel, we're hoping to signal the deprecation of non-distributable layers now that Windows images aren't going to be using them anymore. When we discussed yesterday @jonjohnsonjr mentioned he thought he might have seen some Red Hat images using them. Do you happen to know of any such cases?

Thanks for reaching out @imjasonh - I don't know of such cases, as an open source company Red Hat doesn't use licenses that prohibit permanent binary storage.

imjasonh · 2022-11-16T21:32:59Z

@thecloudtaylor gentle ping

Thanks, that's really helpful to hear! Can you enumerate the concerns?

thecloudtaylor · 2022-11-16T21:57:28Z

@NAWhitehead from our team is driving a discussion on the windows-container repo.

https://github.com/microsoft/Windows-Containers/discussions/287

…ds and config Non-distributable artifacts (foreign layers) were introduced in commit 05bd043 to accommodate Windows images, for which the EULA did not allow layers to be distributed through registries other than those hosted by Microsoft. The concept of foreign / non-distributable layers was adopted by the OCI distribution spec in [oci#233]. These restrictions were relaxed later to allow distributing these images through non-public registries, for which a configuration was added in the daemon in 67fdf57. In 2022, Microsoft updated the EULA and [removed these restrictions altogether][1], and the OCI distribution spec deprecated the functionality in [oci#965]. In 2023, Microsoft [removed the use of foreign data layers][2] for their images, making this functionality obsolete. This patch: - Deprecates the `--allow-nondistributable-artifacts` daemon flag and corresponding `allow-nondistributable-artifacts` field in `daemon.json`. Setting either option will no longer take an effect, but a deprecation warning log is added to raise awareness about the deprecation. This warning is planned to become an error in the next release. - Deprecates the `RegistryConfig.AllowNondistributableArtifactsCIDRs` and `RegistryConfig.AllowNondistributableArtifactsHostnames` fields in the `GET /info` API response. For API version v1.48 and lower, the fields are still included in the response, but always `null`. In API version v1.49 and higher, the field will be omitted entirely. - Deprecates the `api/types/registry/ServiceConfig.AllowNondistributableArtifactsCIDRs` field. - Deprecates the `api/types/registry/ServiceConfig.AllowNondistributableArtifactsHostnames` field. - Deprecates the `registry.ServiceOptions.AllowNondistributableArtifacts` field. [oci#233]: opencontainers/image-spec#233 [oci#965]: opencontainers/image-spec#965 [1]: https://techcommunity.microsoft.com/blog/containers/announcing-windows-container-base-image-redistribution-rights-change/3645201 [2]: https://techcommunity.microsoft.com/blog/containers/announcing-removal-of-foreign-layers-from-windows-container-images/3846833 Signed-off-by: Sebastiaan van Stijn <[email protected]>

Non-distributable artifacts (also called foreign layers) were introduced in docker v1.12 to accommodate Windows images for which the EULA did not allow layers to be distributed through registries other than those hosted by Microsoft. The concept of foreign / non-distributable layers was adopted by the OCI distribution spec in [oci#233]. These restrictions were relaxed later to allow distributing these images through non-public registries, for which a configuration was added in Docker v17.0.6.0. In 2022, Microsoft updated the EULA and [removed these restrictions][msft-3645201], followed by the OCI distribution specification deprecating foreign layers in [oci#965]. In 2023, Microsoft [removed the use of foreign data layers][msft-3846833] for their images, making this functionality obsolete. Docker v28.0 deprecates the `--allow-nondistributable-artifacts` daemon flag and corresponding `allow-nondistributable-artifacts` field in `daemon.json`. Setting either option no longer takes an effect, but a deprecation warning log is added to raise awareness about the deprecation. This warning is planned to become an error in the Docker v29.0. Users currently using these options are therefore recommended to remove this option from their configuration to prevent the daemon from starting when upgrading to Docker v29.0. The `AllowNondistributableArtifactsCIDRs` and `AllowNondistributableArtifactsHostnames` fields in the `RegistryConfig` of the `GET /info` API response are also deprecated. For API version v1.48 and lower, the fields are still included in the response but always `null`. In API version v1.49 and higher, the field will be omitted entirely. [oci#233]: opencontainers/image-spec#233 [oci#965]: opencontainers/image-spec#965 [msft-3645201]: https://techcommunity.microsoft.com/blog/containers/announcing-windows-container-base-image-redistribution-rights-change/3645201 [msft-3846833]: https://techcommunity.microsoft.com/blog/containers/announcing-removal-of-foreign-layers-from-windows-container-images/3846833 Signed-off-by: Sebastiaan van Stijn <[email protected]>

imjasonh requested review from cyphar, jonboulle, jonjohnsonjr, sajayantony, stevvooe, sudo-bmitch and vbatts as code owners October 13, 2022 18:16

Deprecate non-distributable layers

2cdbef2

Signed-off-by: Jason Hall <[email protected]>

imjasonh force-pushed the foreign branch from 56ad21e to 2cdbef2 Compare October 13, 2022 18:17

sudo-bmitch previously approved these changes Oct 13, 2022

View reviewed changes

justincormack previously approved these changes Oct 13, 2022

View reviewed changes

SteveLasker reviewed Oct 13, 2022

View reviewed changes

layer.md Outdated Show resolved Hide resolved

even fewer words

9b4e6c0

Signed-off-by: Jason Hall <[email protected]>

imjasonh dismissed stale reviews from justincormack and sudo-bmitch via 9b4e6c0 October 13, 2022 19:39

SteveLasker previously approved these changes Oct 13, 2022

View reviewed changes

sudo-bmitch previously approved these changes Oct 13, 2022

View reviewed changes

justincormack previously approved these changes Oct 13, 2022

View reviewed changes

mention deprecation in media-types.md

ccb86b9

Signed-off-by: Jason Hall <[email protected]>

imjasonh dismissed stale reviews from justincormack, sudo-bmitch, and SteveLasker via ccb86b9 October 14, 2022 15:40

sudo-bmitch approved these changes Oct 14, 2022

View reviewed changes

thaJeztah mentioned this pull request Oct 15, 2022

registry: allow "allow-nondistributable-artifacts" for Docker Hub moby/moby#44305

Merged

sajayantony mentioned this pull request Nov 2, 2022

feat: improve the error message if non-distributable(foreign) layer is not supported oras-project/oras-go#319

Closed

This was referenced Nov 7, 2022

Add support for zstd compression google/go-containerregistry#1487

Merged

Allow URL pointers in manifest list opencontainers/distribution-spec#362

Open

sajayantony approved these changes Jan 10, 2023

View reviewed changes

jonboulle approved these changes Jan 23, 2023

View reviewed changes

sudo-bmitch merged commit 2fb9968 into opencontainers:main Jan 26, 2023

vbatts mentioned this pull request Jan 30, 2023

specs-go/v1/*.go: align the deprecation style #1003

Merged

thaJeztah mentioned this pull request Dec 11, 2024

remove support for configuring pushing non-distributable artifacts and deprecate API fields and config moby/moby#49065

Merged

thaJeztah mentioned this pull request Jan 3, 2025

Deprecate configuration for pushing non-distributable artifacts docker/cli#5724

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Deprecate non-distributable layers #965

Deprecate non-distributable layers #965

Uh oh!

imjasonh commented Oct 13, 2022

Uh oh!

sudo-bmitch left a comment

Uh oh!

Uh oh!

SteveLasker left a comment

Uh oh!

sajayantony commented Oct 13, 2022

Uh oh!

jonjohnsonjr commented Oct 13, 2022

Uh oh!

imjasonh commented Oct 14, 2022

Uh oh!

imjasonh commented Oct 14, 2022

Uh oh!

thecloudtaylor commented Oct 14, 2022

Uh oh!

imjasonh commented Oct 14, 2022

Uh oh!

dmesser commented Oct 17, 2022

Uh oh!

imjasonh commented Nov 16, 2022

Uh oh!

thecloudtaylor commented Nov 16, 2022

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

9 participants

Deprecate non-distributable layers #965

Deprecate non-distributable layers #965

Uh oh!

Conversation

imjasonh commented Oct 13, 2022

Uh oh!

sudo-bmitch left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

SteveLasker left a comment

Choose a reason for hiding this comment

Uh oh!

sajayantony commented Oct 13, 2022

Uh oh!

jonjohnsonjr commented Oct 13, 2022

Uh oh!

imjasonh commented Oct 14, 2022

Uh oh!

imjasonh commented Oct 14, 2022

Uh oh!

thecloudtaylor commented Oct 14, 2022

Uh oh!

imjasonh commented Oct 14, 2022

Uh oh!

dmesser commented Oct 17, 2022

Uh oh!

imjasonh commented Nov 16, 2022

Uh oh!

thecloudtaylor commented Nov 16, 2022

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

9 participants