registries
Registries, mirrors, and the credentials of what a node fetches.
Two files the administrator keeps on the node hold the credentials, in the
formats their own tools write, and neither leaves it: the shared store holds
no secret and the API shows none. registry_auth_path is a Docker
config.json whose auths serve the registries: session images and the VPN
gateway image, the digest checks and pins, and the packages of PRoot Apps
catalogs. netrc_path is a netrc whose machines serve plain HTTP hosts: app
stores and their autostart scripts, logos, and the metadata and icons of
catalogs. Both are read at every use, so a rotated credential needs no
restart. On Kubernetes the pull secrets the session PodTemplate names add
to the registry file (registry_auths).
image_mirrors names a mirror per upstream registry,
lscr.io=registry.example/lscr,docker.io=registry.example/hub, the way a
proxying registry exposes one upstream per project. Every pull goes through
mirror: records keep the upstream name, and the credential looked up is
the mirror's.
attributelogger= logging.getLogger(__name__)attributeDOCKER_HUB= 'registry-1.docker.io'funcsplit_reference(image) -> tuple[str, str, str]Split an image reference into registry host, repository, and tag or digest.
A reference without a host is Docker Hub's, with library/ before a
single-segment name; docker.io is named as it is pulled from.
paramimagestrReturns
tuple[str, str, str]funcrepository_of(image) -> strReturn an image reference without its tag or digest.
paramimagestrReturns
strfunc_mirrors() -> dict[str, str]Return the mirror of each upstream registry image_mirrors names.
Returns
dict[str, str]funcmirror(image) -> strReturn the reference an image is pulled by: its mirror's when image_mirrors names one.
paramimagestrReturns
strfunc_host_of(key) -> strReturn the host an auths key names, however the file spells it.
paramkeystrReturns
strfuncparse_docker_config(document, origin='') -> dict[str, tuple[str, str]]Return the username and password per registry host of a Docker config.json document.
Entries that name a credential helper or hold a token only are passed
over, with a warning the first time for origin.
paramdocumentAnyparamoriginstr= ''Returns
dict[str, tuple[str, str]]funcfile_auths() -> dict[str, tuple[str, str]]Return the credentials of registry_auth_path, none when there is no file.
Returns
dict[str, tuple[str, str]]funcregistry_auths() -> dict[str, tuple[str, str]]Return every registry credential this node holds: the backend's pull secrets under the file's.
Returns
dict[str, tuple[str, str]]funccredential(host, auths) -> tuple[str, str] | NoneReturn the username and password for a registry host, or None without one.
paramhoststrparamauthsdict[str, tuple[str, str]]Returns
tuple[str, str] | Nonefuncdocker_auth(reference) -> dict[str, str] | NoneReturn the auth_config the Docker SDK pulls reference with, from the file alone.
paramreferencestrReturns
dict[str, str] | Nonefuncchallenge(response) -> tuple[str, dict[str, str]]Return the scheme and parameters of a response's WWW-Authenticate, ("", {}) without one.
paramresponsehttpx.ResponseReturns
tuple[str, dict[str, str]]funcbasic(found) -> strReturn the Authorization value of a username and password.
paramfoundtuple[str, str]Returns
strfuncnetrc_auth() -> httpx.Auth | NoneReturn the auth that serves the hosts of netrc_path to an httpx client, None without a file.
Returns
httpx.httpx.Auth | None