registry

package
v0.4.2 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 16, 2026 License: MIT Imports: 22 Imported by: 0

Documentation

Overview

Package registry resolves image references against container registries. It must not import internal/store: the store imports it.

Index

Constants

View Source 
const DockerHub = "docker.io"

DockerHub is the canonical host for references that name none.

Variables

View Source 
var (
	ErrUnauthorized   = errors.New("registry refused the credentials")
	ErrNotFound       = errors.New("image not found in registry")
	ErrRateLimited    = errors.New("registry rate limit reached")
	ErrUnavailable    = errors.New("registry unavailable")
	ErrDigestMismatch = errors.New("registry digest does not match the manifest")
)
View Source 
var ErrInvalidReference = errors.New("invalid image reference")
View Source 
var ErrPrivateDestination = errors.New("registry resolves to a private or reserved address")

Functions

func CanonicalHost 

func CanonicalHost(host string) string

CanonicalHost lowercases a registry host and folds Docker Hub's aliases into docker.io, so a reference and a configured registry name the same host the same way.

Types

type Client 

type Client struct {
	// contains filtered or unexported fields
}

func New 

func New(opts Options) *Client

func (*Client) CheckHost 

func (c *Client) CheckHost(ctx context.Context, ref Reference) error

CheckHost applies Head's destination guard to ref's registry host with no registry request: what a digest reference, which needs no Head, still owes.

func (*Client) Head 

func (c *Client) Head(ctx context.Context, ref Reference, cred *Credential) (Resolved, error)

Head reads the digest ref names from Docker-Content-Digest without the body, so Docker Hub does not count a pull. Platforms are nil; the same request budget and guard apply.

func (*Client) Resolve 

func (c *Client) Resolve(ctx context.Context, ref Reference, cred *Credential) (Resolved, error)

Resolve GETs the manifest ref names and verifies its digest against the body: at most two manifest requests and one token request. cred goes only to ref's host or the token realm that host advertises. Docker Hub counts every manifest GET as a pull.

type Credential 

type Credential struct {
	Username, Secret string
}

Credential authenticates to one registry. Secret is held only for the call.

type Options 

type Options struct {
	AllowPrivate bool
	Timeout      time.Duration // per request; 15s when zero
	RootCAs      *x509.CertPool
	DialAddr     func(ctx context.Context, host string) (netip.Addr, error)
}

Options configures a Client. RootCAs and DialAddr exist for tests only: production uses the system roots and DNS.

type Reference 

type Reference struct {
	Host, Repository, Tag, Digest string
}

Reference is an image reference split into what a registry request needs.

func ParseReference 

func ParseReference(ref string) (Reference, error)

ParseReference applies Docker's defaults: no host is docker.io, a one-component Docker Hub repository is under library/, and a reference with neither tag nor digest means latest.

type Resolved 

type Resolved struct {
	Digest    string // Docker-Content-Digest of the manifest or index
	MediaType string
	Platforms []string // "os/arch[/variant]" from an index; empty for a single manifest, nil from Head
	Checked   time.Time
}

Resolved is what a tag or digest points at.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.