registry

func CredentialsStore ¶

func CredentialsStore(configFile configfile.ConfigFile) credentials.Store

CredentialsStore returns a new credentials store based on the settings provided in the configuration file.

func DefaultAuthHandler ¶

func DefaultAuthHandler(_ context.Context) (string, error)

DefaultAuthHandler will be invoked if an AuthConfig is rejected It could be used to return a new value for the "X-Registry-Auth" authentication header, but there's no point trying again with the same value as used in AuthConfig

func EncodeAuth ¶

func EncodeAuth(authConfig types.AuthConfig) (string, error)

EncodeAuth Base64 encode an AuthConfig struct for transmission over HTTP

func EncodedAuth ¶

func EncodedAuth(ref string) (string, error)

EncodedAuth returns an encoded auth config for the given registry loaded from environment variables or docker config as available in that order

func EncodedConfigAuth ¶

func EncodedConfigAuth(imageRef string) (string, error)

EncodedConfigAuth returns an encoded auth config for the given registry loaded from the docker config Returns an empty string if credentials cannot be found for the referenced server The docker config must be mounted on the container

func EncodedEnvAuth ¶

func EncodedEnvAuth(imageRef string) (string, error)

EncodedEnvAuth returns an encoded auth config for the given image reference loaded from environment variables.

REPO_HOST, when set, restricts those credentials to a single registry. Without it they are offered to whatever registry the image happens to live on, so a single watched image on a hostile or typosquatted registry is enough to collect them -- which is why docker's own credential lookup is per-registry.

Returns an error if the variables are unset, or if they are scoped to a different registry than the image, so the caller falls back to the docker config.

func EnvCredentialsAreUnscoped ¶ added in v1.0.0

func EnvCredentialsAreUnscoped() bool

EnvCredentialsAreUnscoped reports whether REPO_USER/REPO_PASS are set without a REPO_HOST to scope them, which means they are offered to whatever registry each watched image lives on.

Checked at startup rather than lazily on first use: with REPO_HOST optional, the resulting warning is the only mitigation for the default configuration, so it needs to be in the first screen of logs rather than appearing mid-scan.

func GetPullOptions ¶

func GetPullOptions(imageName string) (image.PullOptions, error)

GetPullOptions creates a struct with all options needed for pulling images from a registry

func WarnOnAPIConsumption ¶

func WarnOnAPIConsumption(container dockwatchTypes.Container) bool

WarnOnAPIConsumption will return true if the registry is known-expected to respond well to HTTP HEAD in checking the container digest -- or if there are problems parsing the container hostname. Will return false if behavior for container is unknown.