summaryrefslogtreecommitdiff
path: root/registry/registry.go
Commit message (Collapse)AuthorAgeFilesLines
* registry: defaultService: use sync.RWMutexSebastiaan van Stijn2022-03-171-0/+1
| | | | | | | | Most operations only require read access, so change this to use an RWMutex, and some minor refactoring in lookupV2Endpoints() so that we are not constructing tlsconfig multiple times in some cases. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* registry: return "errdefs" compatible error typesSebastiaan van Stijn2022-03-171-5/+4
| | | | | | Adding some small utility functions to make generating them easier. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* registry: remove unused error return from HostCertsDir()Sebastiaan van Stijn2022-03-171-12/+4
| | | | Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* registry: un-export HTTPClient() and NewTransport()Sebastiaan van Stijn2022-03-171-7/+5
| | | | | | They're only used internally. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* distribution: remove use of deprecated dial.DualStackSebastiaan van Stijn2022-02-221-1/+0
| | | | | | | | | | | | | | | | | | | From the field's description [1]: DualStack previously enabled RFC 6555 Fast Fallback support, also known as "Happy Eyeballs", in which IPv4 is tried soon if IPv6 appears to be misconfigured and hanging. Deprecated: Fast Fallback is enabled by default. To disable, set FallbackDelay to a negative value. This field was deprecated in https://github.com/golang/go/commit/efc185029bf770894defe63cec2c72a4c84b2ee9, which is included in Go 1.12beta1 and up. [1]: https://github.com/golang/go/blob/2ebe77a2fda1ee9ff6fd9a3e08933ad1ebaea039/src/net/dial.go#L54-L61 Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* registry: remove unused registry.ErrAlreadyExistsSebastiaan van Stijn2021-10-051-7/+0
| | | | | | | This error was no longer in use after the v1 push code was removed in 53dad9f0274fcc1ec742f9411142382c83d08ff9. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* refactor: move from io/ioutil to io and os packageEng Zer Jun2021-08-271-4/+3
| | | | | | | | The io/ioutil package has been deprecated in Go 1.16. This commit replaces the existing io/ioutil functions with their new definitions in io and os packages. Signed-off-by: Eng Zer Jun <engzerjun@gmail.com>
* registry: fix mtls config dir passingTonis Tiigi2020-05-141-13/+2
| | | Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
* vendor: update buildkit to ae7ff174Tonis Tiigi2020-04-141-11/+21
| | | Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
* Revert "Don't die when daemon cannot read certs.d"Sebastiaan van Stijn2020-02-251-1/+1
| | | | | | | | | | | This reverts commit 2808762b27b9e4e94a705193c8554184f6beb151. This exception was added for rootless mode, but superseded by the follow-up commit f4fa98f583a64d736eea1bb3a8fab755e159fdf4, which uses a different path to look for the certs when running in rootless mode Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* registry: fix goimportsSebastiaan van Stijn2020-01-061-3/+2
| | | | Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* Use certs.dDmitry Sharshakov2019-11-251-1/+16
| | | | | | | from XDG_CONFIG_HOME when in rootless mode Signed-off-by: Dmitry Sharshakov <d3dx12.xx@gmail.com>
* Don't die when daemon cannot read certs.dsh7dm2019-11-251-1/+1
| | | | Signed-off-by: Dmitry Sharshakov <d3dx12.xx@gmail.com>
* Fix base.Dial is deprecated: Use DialContext insteadHuanHuan Ye2019-09-201-6/+1
| | | | | | | | | | | 1.Change base.Dial to base.DailContext. 2.Remove proxyDialer that was previously used to configure a net.Dialer to route proxy.Dialer which will route the connections through the proxy using the connections through a SOCKS proxy. SOCKS proxies are now supported by configuring only http.Transport.Proxy, and no longer require changing http.Transport.Dial. Signed-off-by: HuanHuan Ye <logindaveye@gmail.com>
* registry: use len(via)!=0 instead of via!=nilIskander (Alex) Sharipov2018-12-111-1/+1
| | | | | | | This avoids the corner case where `via` is not nil, but has a length of 0, so the updated code does not panic in that situation. Signed-off-by: Iskander Sharipov <quasilyte@gmail.com>
* Add canonical import commentDaniel Nephin2018-02-051-1/+1
| | | | Signed-off-by: Daniel Nephin <dnephin@docker.com>
* Remove Docker from some functionsVincent Demeester2017-10-251-2/+2
| | | | Signed-off-by: Vincent Demeester <vincent@sbr.pm>
* Fix golint errors.Daniel Nephin2017-08-181-1/+1
| | | | Signed-off-by: Daniel Nephin <dnephin@docker.com>
* Update logrus to v1.0.1Derek McGowan2017-07-311-1/+1
| | | | | | Fixes case sensitivity issue Signed-off-by: Derek McGowan <derek@mcgstyle.net>
* Use system ca pool from tlsconfigDerek McGowan2016-10-311-3/+5
| | | | | | Remove deprecated config from local pkg/tlsconfig. Signed-off-by: Derek McGowan <derek@mcgstyle.net> (github: dmcgowan)
* Fix govet for go1.7 Tonis Tiigi2016-09-021-5/+4
| | | Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
* fix typosallencloud2016-06-021-1/+1
| | | | Signed-off-by: allencloud <allen.sun@daocloud.io>
* Respect ALL_PROXY during registry operationsBrett Higgins2016-04-251-7/+17
| | | | | | | | | | | | | | | Use sockets.DialerFromEnvironment, as is done in other places, to transparently support SOCKS proxy config from ALL_PROXY environment variable. Requires the *engine* have the ALL_PROXY env var set, which doesn't seem ideal. Maybe it should be a CLI option somehow? Only tested with push and a v2 registry so far. I'm happy to look further into testing more broadly, but I wanted to get feedback on the general idea first. Signed-off-by: Brett Higgins <brhiggins@arbor.net>
* Move registry service options to the daemon configuration.David Calavera2016-03-101-7/+0
| | | | | | Allowing to set their values in the daemon configuration file. Signed-off-by: David Calavera <david.calavera@gmail.com>
* Push/pull errors improvement and cleanupAaron Lehmann2016-02-111-49/+0
| | | | | | | | | | | | | | | | | Several improvements to error handling: - Introduce ImageConfigPullError type, wrapping errors related to downloading the image configuration blob in schema2. This allows for a more descriptive error message to be seen by the end user. - Change some logrus.Debugf calls that display errors to logrus.Errorf. Add log lines in the push/pull fallback cases to make sure the errors leading to the fallback are shown. - Move error-related types and functions which are only used by the distribution package out of the registry package. Signed-off-by: Aaron Lehmann <aaron.lehmann@docker.com>
* Respond with 401 when there is an unauthorized error from the registry.David Calavera2016-01-271-1/+0
| | | | Signed-off-by: David Calavera <david.calavera@gmail.com>
* Merge pull request #19057 from dnephin/remove_version_from_registry_pkgTibor Vass2016-01-251-25/+7
|\ | | | | Remove dockerversion from registry package
| * Remove the use of dockerversion from the registry packageDaniel Nephin2016-01-151-25/+7
| | | | | | | | Signed-off-by: Daniel Nephin <dnephin@docker.com>
* | Clarify error message when a .cert file is missing a corresponding keyAaron Lehmann2016-01-201-2/+2
|/ | | | | | | | | | | | | | | The daemon uses two similar filename extensions to identify different kinds of certificates. ".crt" files are interpreted as CA certificates, and ".cert" files are interprted as client certificates. If a CA certificate is accidentally given the extension ".cert", it will lead to the following error message: Missing key ca.key for certificate ca.cert To make this slightly less confusing, clarify the error message with a note that CA certificates should use the extension ".crt". Signed-off-by: Aaron Lehmann <aaron.lehmann@docker.com>
* Merge pull request #18889 from aaronlehmann/v1-fallback-pull-all-tagsPhil Estes2016-01-051-1/+1
|\ | | | | Allow v1 protocol fallback when pulling all tags from a repository unknown to v2 registry
| * Allow v1 protocol fallback when pulling all tags from a repository unknown ↵Aaron Lehmann2015-12-231-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | to v2 registry This is a followup to #18839. That PR relaxed the fallback logic so that if a manifest doesn't exist on v2, or the user is unauthorized to access it, we try again with the v1 protocol. A similar special case is needed for "pull all tags" (docker pull -a). If the v2 registry doesn't recognize the repository, or doesn't allow the user to access it, we should fall back to v1 and try to pull all tags from the v1 registry. Conversely, if the v2 registry does allow us to list the tags, there should be no fallback, even if there are errors pulling those tags. Signed-off-by: Aaron Lehmann <aaron.lehmann@docker.com>
* | Remove usage of pkg sockets and tlsconfig.David Calavera2015-12-291-1/+1
|/ | | | | | | | | - Use the ones provided by docker/go-connections, they are a drop in replacement. - Remove pkg/sockets from docker. - Keep pkg/tlsconfig because libnetwork still needs it and there is a circular dependency issue. Signed-off-by: David Calavera <david.calavera@gmail.com>
* When a manifest is not found, allow fallback to v1Aaron Lehmann2015-12-211-3/+3
| | | | | | | | | | | | | | | | | | | | PR #18590 caused compatibility issues with registries such as gcr.io which support both the v1 and v2 protocols, but do not provide the same set of images over both protocols. After #18590, pulls from these registries would never use the v1 protocol, because of the Docker-Distribution-Api-Version header indicating that v2 was supported. Fix the problem by making an exception for the case where a manifest is not found. This should allow fallback to v1 in case that image is exposed over the v1 protocol but not the v2 protocol. This avoids the overly aggressive fallback behavior before #18590 which would allow protocol fallback after almost any error, but restores interoperability with mixed v1/v2 registry setups. Fixes #18832 Signed-off-by: Aaron Lehmann <aaron.lehmann@docker.com>
* Add missing bounds in ContinueOnErrorAaron Lehmann2015-12-081-0/+3
| | | | | | | | | | | ContinueOnError assumes that something of type errcode.Errors contains at least one error. This is generally true, but might not be true if the remote registry returns an empty error body or invalid JSON. Add the bounds check, and in the case where it fails, allow fallbacks to v1. Fixes #18481 Signed-off-by: Aaron Lehmann <aaron.lehmann@docker.com>
* Check if CertsDir is not emptyMichal Gebauer2015-11-251-1/+1
| | | | Signed-off-by: Michal Gebauer <mishak@mishak.net>
* registry/registry.go: simplify logical expressionAlexander Morozov2015-11-171-3/+1
| | | | Signed-off-by: Alexander Morozov <lk4d4@docker.com>
* Fix for #17168 misleading pull errorAnil Belur2015-11-141-0/+5
| | | | | | | | | | | | | This fix avoids overwritting the previous error messages, ensures the client gets the correct error messages and not just the most recent message during the pull request. For this `var lastErr` replaced with a slice which acts as a temp place holder for the list of returned error messages for every attempt. The slice is later joined and returned to the caller function after searching for the image with diffirent versions(v2,v1,v0). Updated the code with check for no space left on device error occurance and prevent the daemon on falling back to v1,v0. Incorporated the comments from @calavera, @RichardScothern, @cpuguy83 Signed-off-by: Anil Belur <askb23@gmail.com>
* dockerversion placeholder for library importVincent Demeester2015-11-091-3/+3
| | | | | | | - Add a *version* file placeholder. - Update autogen and builds to use it and an autogen build flag Signed-off-by: Vincent Demeester <vincent@sbr.pm>
* Merge pull request #17614 from LK4D4/fix_golintJess Frazelle2015-11-031-6/+6
|\ | | | | Update linting tools to latest versions
| * Fix go vet warningsAlexander Morozov2015-11-021-6/+6
| | | | | | | | Signed-off-by: Alexander Morozov <lk4d4@docker.com>
* | Vendor updated version of docker/distributionAaron Lehmann2015-11-021-1/+1
|/ | | | | | | | | | | | | | | | | | | | | | | | | | | | This updates the vendored docker/distribution to the current master branch. Note the following changes: - The manifest package was split into manifest/schema1. Most references to the manifest package in the engine needed to be updated to use schema1 instead. - Validation functions in api/v2 were replaced by the distribution/reference package. The engine code has been updated to use the reference package for validation where necessary. A future PR will change the engine to use the types defined in distribution/reference more comprehensively. - The reference package explicitly allows double _ characters in repository names. registry_test.go was updated for this. - TestPullFailsWithAlteredManifest was corrupting the manifest JSON, now that the schema1 package unmarshals the correct payload. The test is being changed to modify the JSON without affecting its length, which allows the pull to succeed to the point where digest validation happens. Signed-off-by: Aaron Lehmann <aaron.lehmann@docker.com>
* Revert "dockerversion placeholder for library-import"Brian Goff2015-10-271-3/+3
| | | | | | | | | This reverts commit d5cd032a86617249eadd7142227c5355ba9164b4. Commit caused issues on systems with case-insensitive filesystems. Revert for now Signed-off-by: Brian Goff <cpuguy83@gmail.com>
* dockerversion placeholder for library-importVincent Demeester2015-10-271-3/+3
| | | | | | | - Move autogen/dockerversion to version - Update autogen and "builds" to use this package and a build flag Signed-off-by: Vincent Demeester <vincent@sbr.pm>
* Prevent push and pull to v1 registries by filtering the available endpoints.Richard Scothern2015-09-251-0/+4
| | | | | | | | | | | | | | | | | | | | | | Add a daemon flag to control this behaviour. Add a warning message when pulling an image from a v1 registry. The default order of pull is slightly altered with this changset. Previously it was: https v2, https v1, http v2, http v1 now it is: https v2, http v2, https v1, http v1 Prevent login to v1 registries by explicitly setting the version before ping to prevent fallback to v1. Add unit tests for v2 only mode. Create a mock server that can register handlers for various endpoints. Assert no v1 endpoints are hit with legacy registries disabled for the following commands: pull, push, build, run and login. Assert the opposite when legacy registries are not disabled. Signed-off-by: Richard Scothern <richard.scothern@gmail.com>
* Windows: Fix certificate directory for registryJohn Howard2015-08-051-1/+1
| | | | Signed-off-by: John Howard <jhoward@microsoft.com>
* Merge pull request #14970 from tiborvass/windows-registry-endpointTibor Vass2015-07-301-0/+1
|\ | | | | registry: Change default endpoint on windows to a windows-specific one
| * registry: Change default endpoint on windows to a windows-specific oneTibor Vass2015-07-301-0/+1
| | | | | | | | Signed-off-by: Tibor Vass <tibor@docker.com>
* | registry: allow fallback on unknown errorsTibor Vass2015-07-301-1/+8
|/ | | | | | | | | | | | | This patch fixes a bug where a user specifies a v1 mirror for --registry-mirror and pull an image from the Hub. It used to not fallback because of an unexpected error returned when trying to JSON marshal nginx output. We now ensure that any unexpected error falls back to the next endpoint in the list. Signed-off-by: Tibor Vass <tibor@docker.com>
* Fix login and search TLS configurationDerek McGowan2015-07-281-0/+17
| | | | | | | Currently login and search do not load per registry certificates. This is a regression caused by the last refactor since this was recently fixed. Signed-off-by: Derek McGowan <derek@mcgstyle.net> (github: dmcgowan)
* Use notary library for trusted image fetch and signingDerek McGowan2015-07-241-0/+52
| | | | | | | | | | | | | | | | | | | | Add a trusted flag to force the cli to resolve a tag into a digest via the notary trust library and pull by digest. On push the flag the trust flag will indicate the digest and size of a manifest should be signed and push to a notary server. If a tag is given, the cli will resolve the tag into a digest and pull by digest. After pulling, if a tag is given the cli makes a request to tag the image. Use certificate directory for notary requests Read certificates using same logic used by daemon for registry requests. Catch JSON syntax errors from Notary client When an uncaught error occurs in Notary it may show up in Docker as a JSON syntax error, causing a confusing error message to the user. Provide a generic error when a JSON syntax error occurs. Catch expiration errors and wrap in additional context. Signed-off-by: Derek McGowan <derek@mcgstyle.net> (github: dmcgowan)
View Lorry Controller Status