unkin-agent
f0ee593164
Local repo writes (file uploads/deletes, object evictions, native publishes, docker push) are open to anyone who can reach the service; only remote/virtual config is token-gated. - add `ARTIFACTAPI_AUTH_UPLOADS` (default false) gating every local write path behind the OIDC verifier - accept the token as Bearer, Token, Basic password (any user) or bare header value on every gated path, including remote/virtual config writes - serve a `/v2/token` Bearer challenge flow so `docker login` with the token enables push; missing, expired or invalid credentials get an anonymous token so pulls stay open - document minting a Vault identity token and passing it per client Reviewed-on: #169 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
21 lines
983 B
Markdown
21 lines
983 B
Markdown
# Local docker registry
|
|
|
|
A local `docker` repo is a real container registry, not a mirror: it serves the
|
|
Docker Registry HTTP API V2 for both push and pull, so any client (`docker`,
|
|
`podman`, `skopeo`, `buildah`) can use it directly.
|
|
|
|
```sh
|
|
docker tag myapp:latest artifactapi.example.com/docker-internal/myapp:latest
|
|
docker push artifactapi.example.com/docker-internal/myapp:latest
|
|
docker pull artifactapi.example.com/docker-internal/myapp:latest
|
|
```
|
|
|
|
With [uploads gated](../common/auth.md), `docker login` with any username and
|
|
a token as the password before pushing; pulls stay anonymous.
|
|
|
|
The first path segment after `/v2/` is the artifactapi repo name; the remainder
|
|
is the image name. Blobs and manifests are stored through the shared
|
|
content-addressable store (deduplicated by digest, reaped by GC once
|
|
unreferenced); tags are mutable references and re-pushing a tag moves it. Blob
|
|
uploads support both the monolithic and chunked (`POST`/`PATCH`/`PUT`) flows.
|