Documentation
¶
Overview ¶
Package imagemove streams a host-built image from a source Docker host over SSH into a target node's image store and verifies it by image ID.
Index ¶
Constants ¶
const DefaultSSHPort = 22
DefaultSSHPort is used when the target names no port.
Variables ¶
var ErrArchiveContent = errors.New("the image archive has no readable config")
ErrArchiveContent is returned when the saved archive carries no readable image config, so its content cannot be verified.
var ErrTooLarge = errors.New("the image stream passed the size limit")
ErrTooLarge is returned when the stream passes the size bound.
Functions ¶
func SaveCommand ¶
SaveCommand is the only command ever run on the source host.
func ValidateImageID ¶
ValidateImageID accepts a full sha256 image ID as `docker inspect` prints it.
func ValidateImageRef ¶
ValidateImageRef accepts a plain repository reference with an optional tag. Digests, uppercase names and anything that could act as a remote shell token or a command line option are refused.
Types ¶
type ArchiveInfo ¶
type ArchiveInfo struct {
// ConfigDigest is the sha256 of the image config blob, which is the
// image ID on a classic (overlay2) image store.
ConfigDigest string
DiffIDs []string
}
ArchiveInfo is what a streamed `docker save` archive says about its image.
type Credentials ¶
type Credentials struct {
PrivateKey []byte
Passphrase []byte
// UseAgent signs with the control plane process's SSH agent (SSH_AUTH_SOCK).
UseAgent bool
}
Credentials authenticate to the source host. They are held in memory only.
type HostKeys ¶
type HostKeys struct {
Path string
// contains filtered or unexported fields
}
HostKeys pins each source host's key on first use, the in-process equivalent of StrictHostKeyChecking=accept-new. Path "" pins in memory.
type Request ¶
type Request struct {
Ref string
// WantID is the source image ID; "" means the load cannot be verified.
WantID string
MaxBytes int64
Progress func(bytes int64)
}
Request is one image to move.
type Result ¶
type Result struct {
Bytes int64
LoadedID string
// AlreadyPresent is true when the target already had the exact image.
AlreadyPresent bool
Verified bool
// ConfigDigest is the sha256 of the streamed image config.
ConfigDigest string
}
Result reports what a transfer did.
func Transfer ¶
Transfer moves one image and verifies it by content: the loaded image's layers must equal the streamed config's diff IDs, and a source image ID must match the config digest (classic store) or the loaded ID (same store). It skips the stream when the target already holds the same image ID, so a re-run resumes instead of re-copying.
type Runtime ¶
type Runtime interface {
docker.ImageLoader
docker.ImageInspector
docker.ImageLayerInspector
}
Runtime is the target node surface a transfer needs.
type SSHSaver ¶
type SSHSaver struct {
Target Target
Creds Credentials
HostKeys *HostKeys
DialTimeout time.Duration
}
SSHSaver runs the fixed save command over an in-process SSH client: no shell or ssh binary runs on this side, and no prompt can ever block.
type Target ¶
Target is a validated SSH login on the source host.
func ParseTarget ¶
ParseTarget parses user@host, user@host:port or user@[ipv6]:port. A non-zero port argument is used when the string names none, and must agree with it when it does.