netguard

Overview ¶

Package netguard is the HTTP transport for registry lookups. Image references come from the repository being scanned, which may not be yours (a pull request from a fork, a third-party project), so a reference must not be able to make the scanner call an address that is not a registry.

Link-local addresses, which include every cloud metadata service (169.254.169.254, fd00:ec2::254), are always refused: no registry lives there. With PublicOnly, loopback, private (RFC 1918), carrier-grade NAT, IPv6 unique-local and unspecified addresses are refused too, which is the setting for untrusted repositories. Addresses are checked after DNS on every connection, including redirects. With PublicOnly no proxy is used, so every connection is a checked direct dial: a proxy resolves names itself, and a name that resolves differently there (DNS rebinding) would escape the check. Without PublicOnly the environment's proxy is honoured and the target's addresses are checked before the request is handed to it.