2014-10-06 21:54:52 -04:00
|
|
|
package registry
|
|
|
|
|
|
|
|
import (
|
|
|
|
"encoding/json"
|
2015-01-07 18:42:01 -05:00
|
|
|
"errors"
|
2014-10-06 21:54:52 -04:00
|
|
|
"fmt"
|
|
|
|
"net"
|
|
|
|
"net/url"
|
2015-01-07 18:42:01 -05:00
|
|
|
"strings"
|
2014-10-06 21:54:52 -04:00
|
|
|
|
2015-10-30 20:46:25 -04:00
|
|
|
"github.com/docker/distribution/reference"
|
2015-03-29 17:17:23 -04:00
|
|
|
"github.com/docker/docker/image"
|
2014-10-06 21:54:52 -04:00
|
|
|
"github.com/docker/docker/opts"
|
|
|
|
flag "github.com/docker/docker/pkg/mflag"
|
|
|
|
)
|
|
|
|
|
|
|
|
// Options holds command line options.
|
|
|
|
type Options struct {
|
|
|
|
Mirrors opts.ListOpts
|
|
|
|
InsecureRegistries opts.ListOpts
|
|
|
|
}
|
|
|
|
|
2015-08-04 19:30:00 -04:00
|
|
|
const (
|
|
|
|
// DefaultNamespace is the default namespace
|
|
|
|
DefaultNamespace = "docker.io"
|
|
|
|
// DefaultRegistryVersionHeader is the name of the default HTTP header
|
|
|
|
// that carries Registry version info
|
|
|
|
DefaultRegistryVersionHeader = "Docker-Distribution-Api-Version"
|
|
|
|
|
|
|
|
// IndexServer is the v1 registry server used for user auth + account creation
|
|
|
|
IndexServer = DefaultV1Registry + "/v1/"
|
|
|
|
// IndexName is the name of the index
|
|
|
|
IndexName = "docker.io"
|
|
|
|
|
|
|
|
// NotaryServer is the endpoint serving the Notary trust server
|
|
|
|
NotaryServer = "https://notary.docker.io"
|
|
|
|
|
|
|
|
// IndexServer = "https://registry-stage.hub.docker.com/v1/"
|
|
|
|
)
|
|
|
|
|
2015-01-07 18:42:01 -05:00
|
|
|
var (
|
2015-07-21 15:40:36 -04:00
|
|
|
// ErrInvalidRepositoryName is an error returned if the repository name did
|
|
|
|
// not have the correct form
|
2015-01-07 18:42:01 -05:00
|
|
|
ErrInvalidRepositoryName = errors.New("Invalid repository name (ex: \"registry.domain.tld/myrepos\")")
|
2015-07-21 15:40:36 -04:00
|
|
|
|
|
|
|
emptyServiceConfig = NewServiceConfig(nil)
|
2015-09-16 13:42:17 -04:00
|
|
|
|
|
|
|
// V2Only controls access to legacy registries. If it is set to true via the
|
|
|
|
// command line flag the daemon will not attempt to contact v1 legacy registries
|
|
|
|
V2Only = false
|
2015-01-07 18:42:01 -05:00
|
|
|
)
|
|
|
|
|
2014-10-06 21:54:52 -04:00
|
|
|
// InstallFlags adds command-line options to the top-level flag parser for
|
|
|
|
// the current process.
|
2015-05-05 00:18:28 -04:00
|
|
|
func (options *Options) InstallFlags(cmd *flag.FlagSet, usageFn func(string) string) {
|
2014-10-06 21:54:52 -04:00
|
|
|
options.Mirrors = opts.NewListOpts(ValidateMirror)
|
2015-05-05 00:18:28 -04:00
|
|
|
cmd.Var(&options.Mirrors, []string{"-registry-mirror"}, usageFn("Preferred Docker registry mirror"))
|
2014-10-06 21:54:52 -04:00
|
|
|
options.InsecureRegistries = opts.NewListOpts(ValidateIndexName)
|
2015-05-05 00:18:28 -04:00
|
|
|
cmd.Var(&options.InsecureRegistries, []string{"-insecure-registry"}, usageFn("Enable insecure registry communication"))
|
2015-10-06 18:45:32 -04:00
|
|
|
cmd.BoolVar(&V2Only, []string{"-disable-legacy-registry"}, false, "Do not contact legacy registries")
|
2014-10-06 21:54:52 -04:00
|
|
|
}
|
|
|
|
|
|
|
|
type netIPNet net.IPNet
|
|
|
|
|
|
|
|
func (ipnet *netIPNet) MarshalJSON() ([]byte, error) {
|
|
|
|
return json.Marshal((*net.IPNet)(ipnet).String())
|
|
|
|
}
|
|
|
|
|
|
|
|
func (ipnet *netIPNet) UnmarshalJSON(b []byte) (err error) {
|
2015-03-25 21:40:23 -04:00
|
|
|
var ipnetStr string
|
|
|
|
if err = json.Unmarshal(b, &ipnetStr); err == nil {
|
2014-10-06 21:54:52 -04:00
|
|
|
var cidr *net.IPNet
|
2015-03-25 21:40:23 -04:00
|
|
|
if _, cidr, err = net.ParseCIDR(ipnetStr); err == nil {
|
2014-10-06 21:54:52 -04:00
|
|
|
*ipnet = netIPNet(*cidr)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
// ServiceConfig stores daemon registry services configuration.
|
|
|
|
type ServiceConfig struct {
|
|
|
|
InsecureRegistryCIDRs []*netIPNet `json:"InsecureRegistryCIDRs"`
|
|
|
|
IndexConfigs map[string]*IndexInfo `json:"IndexConfigs"`
|
2015-02-12 13:23:22 -05:00
|
|
|
Mirrors []string
|
2014-10-06 21:54:52 -04:00
|
|
|
}
|
|
|
|
|
|
|
|
// NewServiceConfig returns a new instance of ServiceConfig
|
|
|
|
func NewServiceConfig(options *Options) *ServiceConfig {
|
|
|
|
if options == nil {
|
|
|
|
options = &Options{
|
|
|
|
Mirrors: opts.NewListOpts(nil),
|
|
|
|
InsecureRegistries: opts.NewListOpts(nil),
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// Localhost is by default considered as an insecure registry
|
|
|
|
// This is a stop-gap for people who are running a private registry on localhost (especially on Boot2docker).
|
|
|
|
//
|
|
|
|
// TODO: should we deprecate this once it is easier for people to set up a TLS registry or change
|
|
|
|
// daemon flags on boot2docker?
|
|
|
|
options.InsecureRegistries.Set("127.0.0.0/8")
|
|
|
|
|
|
|
|
config := &ServiceConfig{
|
|
|
|
InsecureRegistryCIDRs: make([]*netIPNet, 0),
|
|
|
|
IndexConfigs: make(map[string]*IndexInfo, 0),
|
2015-02-12 13:23:22 -05:00
|
|
|
// Hack: Bypass setting the mirrors to IndexConfigs since they are going away
|
|
|
|
// and Mirrors are only for the official registry anyways.
|
|
|
|
Mirrors: options.Mirrors.GetAll(),
|
2014-10-06 21:54:52 -04:00
|
|
|
}
|
|
|
|
// Split --insecure-registry into CIDR and registry-specific settings.
|
|
|
|
for _, r := range options.InsecureRegistries.GetAll() {
|
|
|
|
// Check if CIDR was passed to --insecure-registry
|
|
|
|
_, ipnet, err := net.ParseCIDR(r)
|
|
|
|
if err == nil {
|
|
|
|
// Valid CIDR.
|
|
|
|
config.InsecureRegistryCIDRs = append(config.InsecureRegistryCIDRs, (*netIPNet)(ipnet))
|
|
|
|
} else {
|
|
|
|
// Assume `host:port` if not CIDR.
|
|
|
|
config.IndexConfigs[r] = &IndexInfo{
|
|
|
|
Name: r,
|
|
|
|
Mirrors: make([]string, 0),
|
|
|
|
Secure: false,
|
|
|
|
Official: false,
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// Configure public registry.
|
2015-07-21 15:40:36 -04:00
|
|
|
config.IndexConfigs[IndexName] = &IndexInfo{
|
|
|
|
Name: IndexName,
|
2015-02-12 13:23:22 -05:00
|
|
|
Mirrors: config.Mirrors,
|
2014-10-06 21:54:52 -04:00
|
|
|
Secure: true,
|
|
|
|
Official: true,
|
|
|
|
}
|
|
|
|
|
|
|
|
return config
|
|
|
|
}
|
2015-01-07 18:42:01 -05:00
|
|
|
|
|
|
|
// isSecureIndex returns false if the provided indexName is part of the list of insecure registries
|
|
|
|
// Insecure registries accept HTTP and/or accept HTTPS with certificates from unknown CAs.
|
|
|
|
//
|
|
|
|
// The list of insecure registries can contain an element with CIDR notation to specify a whole subnet.
|
|
|
|
// If the subnet contains one of the IPs of the registry specified by indexName, the latter is considered
|
|
|
|
// insecure.
|
|
|
|
//
|
|
|
|
// indexName should be a URL.Host (`host:port` or `host`) where the `host` part can be either a domain name
|
|
|
|
// or an IP address. If it is a domain name, then it will be resolved in order to check if the IP is contained
|
|
|
|
// in a subnet. If the resolving is not successful, isSecureIndex will only try to match hostname to any element
|
|
|
|
// of insecureRegistries.
|
|
|
|
func (config *ServiceConfig) isSecureIndex(indexName string) bool {
|
|
|
|
// Check for configured index, first. This is needed in case isSecureIndex
|
|
|
|
// is called from anything besides NewIndexInfo, in order to honor per-index configurations.
|
|
|
|
if index, ok := config.IndexConfigs[indexName]; ok {
|
|
|
|
return index.Secure
|
|
|
|
}
|
|
|
|
|
|
|
|
host, _, err := net.SplitHostPort(indexName)
|
|
|
|
if err != nil {
|
|
|
|
// assume indexName is of the form `host` without the port and go on.
|
|
|
|
host = indexName
|
|
|
|
}
|
|
|
|
|
|
|
|
addrs, err := lookupIP(host)
|
|
|
|
if err != nil {
|
|
|
|
ip := net.ParseIP(host)
|
|
|
|
if ip != nil {
|
|
|
|
addrs = []net.IP{ip}
|
|
|
|
}
|
|
|
|
|
|
|
|
// if ip == nil, then `host` is neither an IP nor it could be looked up,
|
|
|
|
// either because the index is unreachable, or because the index is behind an HTTP proxy.
|
|
|
|
// So, len(addrs) == 0 and we're not aborting.
|
|
|
|
}
|
|
|
|
|
|
|
|
// Try CIDR notation only if addrs has any elements, i.e. if `host`'s IP could be determined.
|
|
|
|
for _, addr := range addrs {
|
|
|
|
for _, ipnet := range config.InsecureRegistryCIDRs {
|
|
|
|
// check if the addr falls in the subnet
|
|
|
|
if (*net.IPNet)(ipnet).Contains(addr) {
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return true
|
|
|
|
}
|
|
|
|
|
|
|
|
// ValidateMirror validates an HTTP(S) registry mirror
|
|
|
|
func ValidateMirror(val string) (string, error) {
|
|
|
|
uri, err := url.Parse(val)
|
|
|
|
if err != nil {
|
|
|
|
return "", fmt.Errorf("%s is not a valid URI", val)
|
|
|
|
}
|
|
|
|
|
|
|
|
if uri.Scheme != "http" && uri.Scheme != "https" {
|
|
|
|
return "", fmt.Errorf("Unsupported scheme %s", uri.Scheme)
|
|
|
|
}
|
|
|
|
|
|
|
|
if uri.Path != "" || uri.RawQuery != "" || uri.Fragment != "" {
|
|
|
|
return "", fmt.Errorf("Unsupported path/query/fragment at end of the URI")
|
|
|
|
}
|
|
|
|
|
2015-05-15 20:48:20 -04:00
|
|
|
return fmt.Sprintf("%s://%s/", uri.Scheme, uri.Host), nil
|
2015-01-07 18:42:01 -05:00
|
|
|
}
|
|
|
|
|
|
|
|
// ValidateIndexName validates an index name.
|
|
|
|
func ValidateIndexName(val string) (string, error) {
|
|
|
|
// 'index.docker.io' => 'docker.io'
|
2015-07-21 15:40:36 -04:00
|
|
|
if val == "index."+IndexName {
|
|
|
|
val = IndexName
|
2015-01-07 18:42:01 -05:00
|
|
|
}
|
2015-05-13 02:23:13 -04:00
|
|
|
if strings.HasPrefix(val, "-") || strings.HasSuffix(val, "-") {
|
|
|
|
return "", fmt.Errorf("Invalid index name (%s). Cannot begin or end with a hyphen.", val)
|
|
|
|
}
|
2015-01-07 18:42:01 -05:00
|
|
|
// *TODO: Check if valid hostname[:port]/ip[:port]?
|
|
|
|
return val, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
func validateRemoteName(remoteName string) error {
|
2015-05-29 10:22:33 -04:00
|
|
|
|
|
|
|
if !strings.Contains(remoteName, "/") {
|
2015-01-07 18:42:01 -05:00
|
|
|
|
|
|
|
// the repository name must not be a valid image ID
|
2015-05-29 10:22:33 -04:00
|
|
|
if err := image.ValidateID(remoteName); err == nil {
|
|
|
|
return fmt.Errorf("Invalid repository name (%s), cannot specify 64-byte hexadecimal strings", remoteName)
|
2015-01-07 18:42:01 -05:00
|
|
|
}
|
|
|
|
}
|
2015-05-29 10:22:33 -04:00
|
|
|
|
2015-10-30 20:46:25 -04:00
|
|
|
_, err := reference.WithName(remoteName)
|
|
|
|
return err
|
2015-01-07 18:42:01 -05:00
|
|
|
}
|
|
|
|
|
|
|
|
func validateNoSchema(reposName string) error {
|
|
|
|
if strings.Contains(reposName, "://") {
|
|
|
|
// It cannot contain a scheme!
|
|
|
|
return ErrInvalidRepositoryName
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// ValidateRepositoryName validates a repository name
|
|
|
|
func ValidateRepositoryName(reposName string) error {
|
|
|
|
var err error
|
|
|
|
if err = validateNoSchema(reposName); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
indexName, remoteName := splitReposName(reposName)
|
|
|
|
if _, err = ValidateIndexName(indexName); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
return validateRemoteName(remoteName)
|
|
|
|
}
|
|
|
|
|
|
|
|
// NewIndexInfo returns IndexInfo configuration from indexName
|
|
|
|
func (config *ServiceConfig) NewIndexInfo(indexName string) (*IndexInfo, error) {
|
|
|
|
var err error
|
|
|
|
indexName, err = ValidateIndexName(indexName)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
// Return any configured index info, first.
|
|
|
|
if index, ok := config.IndexConfigs[indexName]; ok {
|
|
|
|
return index, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// Construct a non-configured index info.
|
|
|
|
index := &IndexInfo{
|
|
|
|
Name: indexName,
|
|
|
|
Mirrors: make([]string, 0),
|
|
|
|
Official: false,
|
|
|
|
}
|
|
|
|
index.Secure = config.isSecureIndex(indexName)
|
|
|
|
return index, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// GetAuthConfigKey special-cases using the full index address of the official
|
|
|
|
// index as the AuthConfig key, and uses the (host)name[:port] for private indexes.
|
|
|
|
func (index *IndexInfo) GetAuthConfigKey() string {
|
|
|
|
if index.Official {
|
2015-07-21 15:40:36 -04:00
|
|
|
return IndexServer
|
2015-01-07 18:42:01 -05:00
|
|
|
}
|
|
|
|
return index.Name
|
|
|
|
}
|
|
|
|
|
|
|
|
// splitReposName breaks a reposName into an index name and remote name
|
|
|
|
func splitReposName(reposName string) (string, string) {
|
|
|
|
nameParts := strings.SplitN(reposName, "/", 2)
|
|
|
|
var indexName, remoteName string
|
|
|
|
if len(nameParts) == 1 || (!strings.Contains(nameParts[0], ".") &&
|
|
|
|
!strings.Contains(nameParts[0], ":") && nameParts[0] != "localhost") {
|
|
|
|
// This is a Docker Index repos (ex: samalba/hipache or ubuntu)
|
|
|
|
// 'docker.io'
|
2015-07-21 15:40:36 -04:00
|
|
|
indexName = IndexName
|
2015-01-07 18:42:01 -05:00
|
|
|
remoteName = reposName
|
|
|
|
} else {
|
|
|
|
indexName = nameParts[0]
|
|
|
|
remoteName = nameParts[1]
|
|
|
|
}
|
|
|
|
return indexName, remoteName
|
|
|
|
}
|
|
|
|
|
|
|
|
// NewRepositoryInfo validates and breaks down a repository name into a RepositoryInfo
|
2015-09-22 07:44:40 -04:00
|
|
|
func (config *ServiceConfig) NewRepositoryInfo(reposName string, bySearch bool) (*RepositoryInfo, error) {
|
2015-01-07 18:42:01 -05:00
|
|
|
if err := validateNoSchema(reposName); err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
indexName, remoteName := splitReposName(reposName)
|
2015-09-22 07:44:40 -04:00
|
|
|
|
|
|
|
if !bySearch {
|
|
|
|
if err := validateRemoteName(remoteName); err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
2015-01-07 18:42:01 -05:00
|
|
|
}
|
|
|
|
|
|
|
|
repoInfo := &RepositoryInfo{
|
|
|
|
RemoteName: remoteName,
|
|
|
|
}
|
|
|
|
|
|
|
|
var err error
|
|
|
|
repoInfo.Index, err = config.NewIndexInfo(indexName)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
if repoInfo.Index.Official {
|
|
|
|
normalizedName := repoInfo.RemoteName
|
|
|
|
if strings.HasPrefix(normalizedName, "library/") {
|
|
|
|
// If pull "library/foo", it's stored locally under "foo"
|
|
|
|
normalizedName = strings.SplitN(normalizedName, "/", 2)[1]
|
|
|
|
}
|
|
|
|
|
|
|
|
repoInfo.LocalName = normalizedName
|
|
|
|
repoInfo.RemoteName = normalizedName
|
|
|
|
// If the normalized name does not contain a '/' (e.g. "foo")
|
|
|
|
// then it is an official repo.
|
|
|
|
if strings.IndexRune(normalizedName, '/') == -1 {
|
|
|
|
repoInfo.Official = true
|
|
|
|
// Fix up remote name for official repos.
|
|
|
|
repoInfo.RemoteName = "library/" + normalizedName
|
|
|
|
}
|
|
|
|
|
2015-07-14 20:45:49 -04:00
|
|
|
repoInfo.CanonicalName = "docker.io/" + repoInfo.RemoteName
|
2015-01-07 18:42:01 -05:00
|
|
|
} else {
|
|
|
|
repoInfo.LocalName = repoInfo.Index.Name + "/" + repoInfo.RemoteName
|
|
|
|
repoInfo.CanonicalName = repoInfo.LocalName
|
2015-05-15 20:48:20 -04:00
|
|
|
|
2015-01-07 18:42:01 -05:00
|
|
|
}
|
2015-05-15 20:48:20 -04:00
|
|
|
|
2015-01-07 18:42:01 -05:00
|
|
|
return repoInfo, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// GetSearchTerm special-cases using local name for official index, and
|
|
|
|
// remote name for private indexes.
|
|
|
|
func (repoInfo *RepositoryInfo) GetSearchTerm() string {
|
|
|
|
if repoInfo.Index.Official {
|
|
|
|
return repoInfo.LocalName
|
|
|
|
}
|
|
|
|
return repoInfo.RemoteName
|
|
|
|
}
|
|
|
|
|
|
|
|
// ParseRepositoryInfo performs the breakdown of a repository name into a RepositoryInfo, but
|
|
|
|
// lacks registry configuration.
|
|
|
|
func ParseRepositoryInfo(reposName string) (*RepositoryInfo, error) {
|
2015-09-22 07:44:40 -04:00
|
|
|
return emptyServiceConfig.NewRepositoryInfo(reposName, false)
|
|
|
|
}
|
|
|
|
|
|
|
|
// ParseIndexInfo will use repository name to get back an indexInfo.
|
|
|
|
func ParseIndexInfo(reposName string) (*IndexInfo, error) {
|
|
|
|
indexName, _ := splitReposName(reposName)
|
|
|
|
|
|
|
|
indexInfo, err := emptyServiceConfig.NewIndexInfo(indexName)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
return indexInfo, nil
|
2015-01-07 18:42:01 -05:00
|
|
|
}
|
|
|
|
|
|
|
|
// NormalizeLocalName transforms a repository name into a normalize LocalName
|
|
|
|
// Passes through the name without transformation on error (image id, etc)
|
|
|
|
func NormalizeLocalName(name string) string {
|
|
|
|
repoInfo, err := ParseRepositoryInfo(name)
|
|
|
|
if err != nil {
|
|
|
|
return name
|
|
|
|
}
|
|
|
|
return repoInfo.LocalName
|
|
|
|
}
|