Thanks to visit codestin.com
Credit goes to github.com

Skip to content
This repository was archived by the owner on Aug 14, 2020. It is now read-only.

Conversation

@iaguis
Copy link
Member

@iaguis iaguis commented Oct 20, 2017

Some registries serve signed manifests and refuse to deliver them (error
404) unless the client specifies the correct Accept header:

$ docker2aci docker://gcr.io/google_containers/busybox:1.24
Error: conversion error: attempted fallback to API v1 but not supported

$ curl --header 'Accept: application/vnd.docker.distribution.manifest.v1+json' \
  -i https://gcr.io/v2/google_containers/busybox/manifests/1.24
HTTP/2 404
docker-distribution-api-version: registry/2.0
content-type: application/json
date: Fri, 20 Oct 2017 09:29:29 GMT
server: Docker Registry
cache-control: private
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
alt-svc: quic=":443"; ma=2592000; v="39,38,37,35"
accept-ranges: none
vary: Accept-Encoding

{"errors":[{"code":"MANIFEST_UNKNOWN","message":"Manifest with tag
'1.24' has media type 'application/vnd.docker.distribution.manifest.v1+prettyjws',
but client accepts 'applicatio/vnd.docker.distribution.manifest.v1+json'."}]}

This adds the signed manifest media type to the default used media types
(and when V2.1 is requested) so we can fetch those images:

$ curl \
  --header \
  'Accept: application/vnd.docker.distribution.manifest.v1+json,application/vnd.docker.distribution.manifest.v1+prettyjws' \
  -i https://gcr.io/v2/google_containers/busybox/manifests/1.24
HTTP/2 200
docker-distribution-api-version: registry/2.0
content-type: application/vnd.docker.distribution.manifest.v1+prettyjws
content-length: 3205
docker-content-digest: sha256:4bdd623e848417d96127e16037743f0cd8b528c026e9175e22a84f639eca58ff
date: Fri, 20 Oct 2017 09:32:01 GMT
server: Docker Registry
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
alt-svc: quic=":443"; ma=2592000; v="39,38,37,35"

$ docker2aci docker://gcr.io/google_containers/busybox:1.24
Downloading sha256:a3ed95caeb0 [===============================]     32 B / 32 B
Downloading sha256:eeee0535bf3 [===============================] 676 KB / 676 KB

Generated ACI(s):
google_containers-busybox-1.24.aci

Fixes #254

@iaguis
Copy link
Member Author

iaguis commented Oct 20, 2017

Now I have to fix the tests 😅

Some registries serve signed manifests and refuse to deliver them (error
404) unless the client specifies the correct Accept header:

    $ docker2aci docker://gcr.io/google_containers/busybox:1.24
    Error: conversion error: attempted fallback to API v1 but not supported

    $ curl --header 'Accept: application/vnd.docker.distribution.manifest.v1+json' \
      -i https://gcr.io/v2/google_containers/busybox/manifests/1.24
    HTTP/2 404
    docker-distribution-api-version: registry/2.0
    content-type: application/json
    date: Fri, 20 Oct 2017 09:29:29 GMT
    server: Docker Registry
    cache-control: private
    x-xss-protection: 1; mode=block
    x-frame-options: SAMEORIGIN
    alt-svc: quic=":443"; ma=2592000; v="39,38,37,35"
    accept-ranges: none
    vary: Accept-Encoding

    {"errors":[{"code":"MANIFEST_UNKNOWN","message":"Manifest with tag
    '1.24' has media type 'application/vnd.docker.distribution.manifest.v1+prettyjws',
    but client accepts 'applicatio/vnd.docker.distribution.manifest.v1+json'."}]}

This adds the signed manifest media type to the default used media types
(and when V2.1 is requested) so we can fetch those images:

    $ curl \
      --header \
      'Accept: application/vnd.docker.distribution.manifest.v1+json,application/vnd.docker.distribution.manifest.v1+prettyjws' \
      -i https://gcr.io/v2/google_containers/busybox/manifests/1.24
    HTTP/2 200
    docker-distribution-api-version: registry/2.0
    content-type: application/vnd.docker.distribution.manifest.v1+prettyjws
    content-length: 3205
    docker-content-digest: sha256:4bdd623e848417d96127e16037743f0cd8b528c026e9175e22a84f639eca58ff
    date: Fri, 20 Oct 2017 09:32:01 GMT
    server: Docker Registry
    x-xss-protection: 1; mode=block
    x-frame-options: SAMEORIGIN
    alt-svc: quic=":443"; ma=2592000; v="39,38,37,35"

    $ docker2aci docker://gcr.io/google_containers/busybox:1.24
    Downloading sha256:a3ed95caeb0 [===============================]     32 B / 32 B
    Downloading sha256:eeee0535bf3 [===============================] 676 KB / 676 KB

    Generated ACI(s):
    google_containers-busybox-1.24.aci
@iaguis iaguis force-pushed the iaguis/add-signedmanifest-mediatype branch from f96ffd3 to 6a20744 Compare October 20, 2017 10:06
Copy link

@dongsupark dongsupark left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I tested it, and it fixes the bug. Cool!

@lucab
Copy link
Contributor

lucab commented Oct 20, 2017

Regression-wise, are other GCR images still fine after this?

@iaguis
Copy link
Member Author

iaguis commented Oct 20, 2017

I tried gcr.io/google_containers/kibana:1.2 which is working on current master and I can fetch it fine.

Also, the motivation for this was running k8s e2e tests on rktlet (which downloads a lot of images from GCR) and, with this patch, I don't see any related failed fetches.

Copy link
Contributor

@lucab lucab left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@iaguis iaguis merged commit 8b57b12 into appc:master Oct 20, 2017
@iaguis iaguis added this to the v0.17.1 milestone Oct 24, 2017
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants