Documentation
¶
Overview ¶
Package registryprobe looks for images a project already publishes.
R-094 tier 1, the top of the confidence ladder: an image the maintainers publish themselves is their own answer to "how is this built", already built and already shipped. Nothing Pando infers about the source beats it, and running it skips the build entirely.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Probe ¶
type Probe struct {
// HTTP is the client used for registry calls. A short timeout on purpose:
// this is a best-effort lookup on the path of every app anyone adds, and a
// slow registry must not hold up detection.
HTTP *http.Client
// IncludeDockerHub turns on the Docker Hub half of R-094 tier 1. Off by
// default, and the two registries are not equivalent:
//
// On ghcr.io a namespace belongs to the GitHub account of the same name.
// Only the owner of github.com/acme can publish ghcr.io/acme/*, so finding
// an image there really is the maintainers' own image.
//
// On Docker Hub the namespace is an unrelated account. Anyone may register
// the Docker Hub user "acme" regardless of who owns github.com/acme, so a
// match proves only that the names are the same. Defaulting this on would
// mean Pando proposing to run a stranger's image, described as the
// project's own — and proposals are reviewed by someone R-005 says may not
// know what a container registry is.
//
// See docs/design/notes-registry-tier-namespaces.md.
IncludeDockerHub bool
}
Probe checks public registries for an image matching a source repository.
func (*Probe) Published ¶
Published reports images published for a source repository.
Only under the same owner and name as the repository. On ghcr.io that is a real correspondence — the namespace belongs to the GitHub account of the same name — though it still does not prove the image was built from the commit being deployed, which is why the proposal goes through review before anything is pinned (R-098). Docker Hub has no such correspondence at all and is off unless IncludeDockerHub is set.
Source Files