cmd/dist: completely remove dist command

Signed-off-by: Stephen J Day <stephen.day@docker.com>

cmd/ctr/apply.go

@@ -0,0 +1,37 @@
+package main
+
+import (
+	"os"
+
+	"github.com/containerd/containerd/archive"
+	"github.com/containerd/containerd/archive/compression"
+	"github.com/containerd/containerd/log"
+	"github.com/urfave/cli"
+)
+
+var applyCommand = cli.Command{
+	Name:      "apply",
+	Usage:     "apply layer from stdin to dir",
+	ArgsUsage: "[flags] <path>",
+	Flags:     []cli.Flag{},
+	Action: func(context *cli.Context) error {
+		var (
+			dir = context.Args().First()
+		)
+		ctx, cancel := appContext(context)
+		defer cancel()
+
+		log.G(ctx).Info("applying layer from stdin")
+
+		rd, err := compression.DecompressStream(os.Stdin)
+		if err != nil {
+			return err
+		}
+
+		if _, err := archive.Apply(ctx, dir, rd); err != nil {
+			return err
+		}
+
+		return nil
+	},
+}

cmd/ctr/fetch.go

@@ -0,0 +1,307 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"os"
+	"sync"
+	"text/tabwriter"
+	"time"
+
+	"github.com/containerd/containerd"
+	"github.com/containerd/containerd/content"
+	"github.com/containerd/containerd/errdefs"
+	"github.com/containerd/containerd/images"
+	"github.com/containerd/containerd/log"
+	"github.com/containerd/containerd/progress"
+	"github.com/containerd/containerd/remotes"
+	digest "github.com/opencontainers/go-digest"
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+	"github.com/urfave/cli"
+)
+
+var fetchCommand = cli.Command{
+	Name:      "fetch",
+	Usage:     "fetch all content for an image into containerd",
+	ArgsUsage: "[flags] <remote> <object>",
+	Description: `Fetch an image into containerd.
+	
+This command ensures that containerd has all the necessary resources to build
+an image's rootfs and convert the configuration to a runtime format supported
+by containerd.
+
+This command uses the same syntax, of remote and object, as 'dist
+fetch-object'. We may want to make this nicer, but agnostism is preferred for
+the moment.
+
+Right now, the responsibility of the daemon and the cli aren't quite clear. Do
+not use this implementation as a guide. The end goal should be having metadata,
+content and snapshots ready for a direct use via the 'ctr run'.
+
+Most of this is experimental and there are few leaps to make this work.`,
+	Flags: registryFlags,
+	Action: func(clicontext *cli.Context) error {
+		var (
+			ref = clicontext.Args().First()
+		)
+		ctx, cancel := appContext(clicontext)
+		defer cancel()
+
+		_, err := fetch(ctx, ref, clicontext)
+		return err
+	},
+}
+
+func fetch(ctx context.Context, ref string, clicontext *cli.Context) (containerd.Image, error) {
+	client, err := newClient(clicontext)
+	if err != nil {
+		return nil, err
+	}
+
+	resolver, err := getResolver(ctx, clicontext)
+	if err != nil {
+		return nil, err
+	}
+
+	ongoing := newJobs(ref)
+
+	pctx, stopProgress := context.WithCancel(ctx)
+	progress := make(chan struct{})
+
+	go func() {
+		showProgress(pctx, ongoing, client.ContentStore(), os.Stdout)
+		close(progress)
+	}()
+
+	h := images.HandlerFunc(func(ctx context.Context, desc ocispec.Descriptor) ([]ocispec.Descriptor, error) {
+		if desc.MediaType != images.MediaTypeDockerSchema1Manifest {
+			ongoing.add(desc)
+		}
+		return nil, nil
+	})
+
+	log.G(pctx).WithField("image", ref).Debug("fetching")
+
+	img, err := client.Pull(pctx, ref, containerd.WithResolver(resolver), containerd.WithImageHandler(h), containerd.WithSchema1Conversion)
+	stopProgress()
+	if err != nil {
+		return nil, err
+	}
+
+	<-progress
+	return img, nil
+}
+
+func showProgress(ctx context.Context, ongoing *jobs, cs content.Store, out io.Writer) {
+	var (
+		ticker   = time.NewTicker(100 * time.Millisecond)
+		fw       = progress.NewWriter(out)
+		start    = time.Now()
+		statuses = map[string]statusInfo{}
+		done     bool
+	)
+	defer ticker.Stop()
+
+outer:
+	for {
+		select {
+		case <-ticker.C:
+			fw.Flush()
+
+			tw := tabwriter.NewWriter(fw, 1, 8, 1, ' ', 0)
+
+			resolved := "resolved"
+			if !ongoing.isResolved() {
+				resolved = "resolving"
+			}
+			statuses[ongoing.name] = statusInfo{
+				Ref:    ongoing.name,
+				Status: resolved,
+			}
+			keys := []string{ongoing.name}
+
+			activeSeen := map[string]struct{}{}
+			if !done {
+				active, err := cs.ListStatuses(ctx, "")
+				if err != nil {
+					log.G(ctx).WithError(err).Error("active check failed")
+					continue
+				}
+				// update status of active entries!
+				for _, active := range active {
+					statuses[active.Ref] = statusInfo{
+						Ref:       active.Ref,
+						Status:    "downloading",
+						Offset:    active.Offset,
+						Total:     active.Total,
+						StartedAt: active.StartedAt,
+						UpdatedAt: active.UpdatedAt,
+					}
+					activeSeen[active.Ref] = struct{}{}
+				}
+			}
+
+			// now, update the items in jobs that are not in active
+			for _, j := range ongoing.jobs() {
+				key := remotes.MakeRefKey(ctx, j)
+				keys = append(keys, key)
+				if _, ok := activeSeen[key]; ok {
+					continue
+				}
+
+				status, ok := statuses[key]
+				if !done && (!ok || status.Status == "downloading") {
+					info, err := cs.Info(ctx, j.Digest)
+					if err != nil {
+						if !errdefs.IsNotFound(err) {
+							log.G(ctx).WithError(err).Errorf("failed to get content info")
+							continue outer
+						} else {
+							statuses[key] = statusInfo{
+								Ref:    key,
+								Status: "waiting",
+							}
+						}
+					} else if info.CreatedAt.After(start) {
+						statuses[key] = statusInfo{
+							Ref:       key,
+							Status:    "done",
+							Offset:    info.Size,
+							Total:     info.Size,
+							UpdatedAt: info.CreatedAt,
+						}
+					} else {
+						statuses[key] = statusInfo{
+							Ref:    key,
+							Status: "exists",
+						}
+					}
+				} else if done {
+					if ok {
+						if status.Status != "done" && status.Status != "exists" {
+							status.Status = "done"
+							statuses[key] = status
+						}
+					} else {
+						statuses[key] = statusInfo{
+							Ref:    key,
+							Status: "done",
+						}
+					}
+				}
+			}
+
+			var ordered []statusInfo
+			for _, key := range keys {
+				ordered = append(ordered, statuses[key])
+			}
+
+			display(tw, ordered, start)
+			tw.Flush()
+
+			if done {
+				fw.Flush()
+				return
+			}
+		case <-ctx.Done():
+			done = true // allow ui to update once more
+		}
+	}
+}
+
+// jobs provides a way of identifying the download keys for a particular task
+// encountering during the pull walk.
+//
+// This is very minimal and will probably be replaced with something more
+// featured.
+type jobs struct {
+	name     string
+	added    map[digest.Digest]struct{}
+	descs    []ocispec.Descriptor
+	mu       sync.Mutex
+	resolved bool
+}
+
+func newJobs(name string) *jobs {
+	return &jobs{
+		name:  name,
+		added: map[digest.Digest]struct{}{},
+	}
+}
+
+func (j *jobs) add(desc ocispec.Descriptor) {
+	j.mu.Lock()
+	defer j.mu.Unlock()
+	j.resolved = true
+
+	if _, ok := j.added[desc.Digest]; ok {
+		return
+	}
+	j.descs = append(j.descs, desc)
+	j.added[desc.Digest] = struct{}{}
+}
+
+func (j *jobs) jobs() []ocispec.Descriptor {
+	j.mu.Lock()
+	defer j.mu.Unlock()
+
+	var descs []ocispec.Descriptor
+	return append(descs, j.descs...)
+}
+
+func (j *jobs) isResolved() bool {
+	j.mu.Lock()
+	defer j.mu.Unlock()
+	return j.resolved
+}
+
+type statusInfo struct {
+	Ref       string
+	Status    string
+	Offset    int64
+	Total     int64
+	StartedAt time.Time
+	UpdatedAt time.Time
+}
+
+func display(w io.Writer, statuses []statusInfo, start time.Time) {
+	var total int64
+	for _, status := range statuses {
+		total += status.Offset
+		switch status.Status {
+		case "downloading", "uploading":
+			var bar progress.Bar
+			if status.Total > 0.0 {
+				bar = progress.Bar(float64(status.Offset) / float64(status.Total))
+			}
+			fmt.Fprintf(w, "%s:\t%s\t%40r\t%8.8s/%s\t\n",
+				status.Ref,
+				status.Status,
+				bar,
+				progress.Bytes(status.Offset), progress.Bytes(status.Total))
+		case "resolving", "waiting":
+			bar := progress.Bar(0.0)
+			fmt.Fprintf(w, "%s:\t%s\t%40r\t\n",
+				status.Ref,
+				status.Status,
+				bar)
+		default:
+			bar := progress.Bar(1.0)
+			fmt.Fprintf(w, "%s:\t%s\t%40r\t\n",
+				status.Ref,
+				status.Status,
+				bar)
+		}
+	}
+
+	fmt.Fprintf(w, "elapsed: %-4.1fs\ttotal: %7.6v\t(%v)\t\n",
+		time.Since(start).Seconds(),
+		// TODO(stevvooe): These calculations are actually way off.
+		// Need to account for previously downloaded data. These
+		// will basically be right for a download the first time
+		// but will be skewed if restarting, as it includes the
+		// data into the start time before.
+		progress.Bytes(total),
+		progress.NewBytesPerSecond(total, time.Since(start)))
+}

cmd/ctr/fetchobject.go

@@ -0,0 +1,55 @@
+package main
+
+import (
+	"io"
+	"os"
+
+	"github.com/containerd/containerd/log"
+	"github.com/urfave/cli"
+)
+
+// TODO(stevvooe): Create "multi-fetch" mode that just takes a remote
+// then receives object/hint lines on stdin, returning content as
+// needed.
+
+var fetchObjectCommand = cli.Command{
+	Name:        "fetch-object",
+	Usage:       "retrieve objects from a remote",
+	ArgsUsage:   "[flags] <remote> <object> [<hint>, ...]",
+	Description: `Fetch objects by identifier from a remote.`,
+	Flags:       registryFlags,
+	Action: func(context *cli.Context) error {
+		var (
+			ref = context.Args().First()
+		)
+		ctx, cancel := appContext(context)
+		defer cancel()
+
+		resolver, err := getResolver(ctx, context)
+		if err != nil {
+			return err
+		}
+
+		ctx = log.WithLogger(ctx, log.G(ctx).WithField("ref", ref))
+
+		log.G(ctx).Infof("resolving")
+		name, desc, err := resolver.Resolve(ctx, ref)
+		if err != nil {
+			return err
+		}
+		fetcher, err := resolver.Fetcher(ctx, name)
+		if err != nil {
+			return err
+		}
+
+		log.G(ctx).Infof("fetching")
+		rc, err := fetcher.Fetch(ctx, desc)
+		if err != nil {
+			return err
+		}
+		defer rc.Close()
+
+		_, err = io.Copy(os.Stdout, rc)
+		return err
+	},
+}

cmd/ctr/main.go

@@ -59,6 +59,11 @@ containerd CLI
 	}
 	app.Commands = append([]cli.Command{
 		imageCommand,
+		pullCommand,
+		fetchCommand,
+		fetchObjectCommand,
+		pushCommand,
+		pushObjectCommand,
 		containersCommand,
 		checkpointCommand,
 		runCommand,
@@ -76,6 +81,8 @@ containerd CLI
 		snapshotCommand,
 		versionCommand,
 		psCommand,
+		applyCommand,
+		rootfsCommand,
 	}, extraCmds...)
 	app.Before = func(context *cli.Context) error {
 		if context.GlobalBool("debug") {

cmd/ctr/pull.go

@@ -0,0 +1,45 @@
+package main
+
+import (
+	"fmt"
+
+	"github.com/containerd/containerd/log"
+	"github.com/urfave/cli"
+)
+
+var pullCommand = cli.Command{
+	Name:      "pull",
+	Usage:     "pull an image from a remote",
+	ArgsUsage: "[flags] <ref>",
+	Description: `Fetch and prepare an image for use in containerd.
+
+After pulling an image, it should be ready to use the same reference in a run
+command. As part of this process, we do the following:
+
+1. Fetch all resources into containerd.
+2. Prepare the snapshot filesystem with the pulled resources.
+3. Register metadata for the image.
+`,
+	Flags: append(registryFlags, snapshotterFlags...),
+	Action: func(clicontext *cli.Context) error {
+		var (
+			ref = clicontext.Args().First()
+		)
+
+		ctx, cancel := appContext(clicontext)
+		defer cancel()
+
+		img, err := fetch(ctx, ref, clicontext)
+		if err != nil {
+			return err
+		}
+
+		log.G(ctx).WithField("image", ref).Debug("unpacking")
+
+		// TODO: Show unpack status
+		fmt.Printf("unpacking %s...", img.Target().Digest)
+		err = img.Unpack(ctx, clicontext.String("snapshotter"))
+		fmt.Println("done")
+		return err
+	},
+}

cmd/ctr/push.go

@@ -0,0 +1,206 @@
+package main
+
+import (
+	"context"
+	"os"
+	"sync"
+	"text/tabwriter"
+	"time"
+
+	"github.com/containerd/containerd"
+	"github.com/containerd/containerd/images"
+	"github.com/containerd/containerd/log"
+	"github.com/containerd/containerd/progress"
+	"github.com/containerd/containerd/remotes"
+	"github.com/containerd/containerd/remotes/docker"
+	digest "github.com/opencontainers/go-digest"
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+	"github.com/pkg/errors"
+	"github.com/urfave/cli"
+	"golang.org/x/sync/errgroup"
+)
+
+var (
+	pushTracker = docker.NewInMemoryTracker()
+)
+
+var pushCommand = cli.Command{
+	Name:      "push",
+	Usage:     "push an image to a remote",
+	ArgsUsage: "[flags] <remote> [<local>]",
+	Description: `Pushes an image reference from containerd.
+
+	All resources associated with the manifest reference will be pushed.
+	The ref is used to resolve to a locally existing image manifest.
+	The image manifest must exist before push. Creating a new image
+	manifest can be done through calculating the diff for layers,
+	creating the associated configuration, and creating the manifest
+	which references those resources.
+`,
+	Flags: append(registryFlags, cli.StringFlag{
+		Name:  "manifest",
+		Usage: "Digest of manifest",
+	}, cli.StringFlag{
+		Name:  "manifest-type",
+		Usage: "Media type of manifest digest",
+		Value: ocispec.MediaTypeImageManifest,
+	}),
+	Action: func(clicontext *cli.Context) error {
+		var (
+			ref   = clicontext.Args().First()
+			local = clicontext.Args().Get(1)
+			desc  ocispec.Descriptor
+		)
+
+		ctx, cancel := appContext(clicontext)
+		defer cancel()
+
+		client, err := newClient(clicontext)
+		if err != nil {
+			return err
+		}
+
+		if manifest := clicontext.String("manifest"); manifest != "" {
+			desc.Digest, err = digest.Parse(manifest)
+			if err != nil {
+				return errors.Wrap(err, "invalid manifest digest")
+			}
+			desc.MediaType = clicontext.String("manifest-type")
+		} else {
+			if local == "" {
+				local = ref
+			}
+			img, err := client.ImageService().Get(ctx, local)
+			if err != nil {
+				return errors.Wrap(err, "unable to resolve image to manifest")
+			}
+			desc = img.Target
+		}
+
+		resolver, err := getResolver(ctx, clicontext)
+		if err != nil {
+			return err
+		}
+		ongoing := newPushJobs(pushTracker)
+
+		eg, ctx := errgroup.WithContext(ctx)
+
+		eg.Go(func() error {
+			log.G(ctx).WithField("image", ref).WithField("digest", desc.Digest).Debug("pushing")
+
+			jobHandler := images.HandlerFunc(func(ctx context.Context, desc ocispec.Descriptor) ([]ocispec.Descriptor, error) {
+				ongoing.add(remotes.MakeRefKey(ctx, desc))
+				return nil, nil
+			})
+
+			return client.Push(ctx, ref, desc,
+				containerd.WithResolver(resolver),
+				containerd.WithImageHandler(jobHandler),
+			)
+		})
+
+		errs := make(chan error)
+		go func() {
+			defer close(errs)
+			errs <- eg.Wait()
+		}()
+
+		var (
+			ticker = time.NewTicker(100 * time.Millisecond)
+			fw     = progress.NewWriter(os.Stdout)
+			start  = time.Now()
+			done   bool
+		)
+		defer ticker.Stop()
+
+		for {
+			select {
+			case <-ticker.C:
+				fw.Flush()
+
+				tw := tabwriter.NewWriter(fw, 1, 8, 1, ' ', 0)
+
+				display(tw, ongoing.status(), start)
+				tw.Flush()
+
+				if done {
+					fw.Flush()
+					return nil
+				}
+			case err := <-errs:
+				if err != nil {
+					return err
+				}
+				done = true
+			case <-ctx.Done():
+				done = true // allow ui to update once more
+			}
+		}
+	},
+}
+
+type pushStatus struct {
+	name    string
+	started bool
+	written int64
+	total   int64
+}
+
+type pushjobs struct {
+	jobs    map[string]struct{}
+	ordered []string
+	tracker docker.StatusTracker
+	mu      sync.Mutex
+}
+
+func newPushJobs(tracker docker.StatusTracker) *pushjobs {
+	return &pushjobs{
+		jobs:    make(map[string]struct{}),
+		tracker: tracker,
+	}
+}
+
+func (j *pushjobs) add(ref string) {
+	j.mu.Lock()
+	defer j.mu.Unlock()
+
+	if _, ok := j.jobs[ref]; ok {
+		return
+	}
+	j.ordered = append(j.ordered, ref)
+	j.jobs[ref] = struct{}{}
+}
+
+func (j *pushjobs) status() []statusInfo {
+	j.mu.Lock()
+	defer j.mu.Unlock()
+
+	statuses := make([]statusInfo, 0, len(j.jobs))
+	for _, name := range j.ordered {
+		si := statusInfo{
+			Ref: name,
+		}
+
+		status, err := j.tracker.GetStatus(name)
+		if err != nil {
+			si.Status = "waiting"
+		} else {
+			si.Offset = status.Offset
+			si.Total = status.Total
+			si.StartedAt = status.StartedAt
+			si.UpdatedAt = status.UpdatedAt
+			if status.Offset >= status.Total {
+				if status.UploadUUID == "" {
+					si.Status = "done"
+				} else {
+					si.Status = "committing"
+				}
+			} else {
+				si.Status = "uploading"
+			}
+		}
+		statuses = append(statuses, si)
+	}
+
+	return statuses
+}

cmd/ctr/pushobject.go

@@ -0,0 +1,81 @@
+package main
+
+import (
+	"fmt"
+
+	"github.com/containerd/containerd/content"
+	"github.com/containerd/containerd/log"
+	digest "github.com/opencontainers/go-digest"
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+	"github.com/urfave/cli"
+)
+
+var pushObjectCommand = cli.Command{
+	Name:        "push-object",
+	Usage:       "pushes an object to a remote",
+	ArgsUsage:   "[flags] <remote> <object> <type>",
+	Description: `Push objects by identifier to a remote.`,
+	Flags:       registryFlags,
+	Action: func(clicontext *cli.Context) error {
+		var (
+			ref    = clicontext.Args().Get(0)
+			object = clicontext.Args().Get(1)
+			media  = clicontext.Args().Get(2)
+		)
+		dgst, err := digest.Parse(object)
+		if err != nil {
+			return err
+		}
+
+		ctx, cancel := appContext(clicontext)
+		defer cancel()
+
+		resolver, err := getResolver(ctx, clicontext)
+		if err != nil {
+			return err
+		}
+
+		ctx = log.WithLogger(ctx, log.G(ctx).WithField("ref", ref))
+
+		log.G(ctx).Infof("resolving")
+		pusher, err := resolver.Pusher(ctx, ref)
+		if err != nil {
+			return err
+		}
+
+		cs, err := getContentStore(clicontext)
+		if err != nil {
+			return err
+		}
+
+		info, err := cs.Info(ctx, dgst)
+		if err != nil {
+			return err
+		}
+		desc := ocispec.Descriptor{
+			MediaType: media,
+			Digest:    dgst,
+			Size:      info.Size,
+		}
+
+		rc, err := cs.Reader(ctx, dgst)
+		if err != nil {
+			return err
+		}
+		defer rc.Close()
+
+		cw, err := pusher.Push(ctx, desc)
+		if err != nil {
+			return err
+		}
+
+		// TODO: Progress reader
+		if err := content.Copy(cw, rc, desc.Size, desc.Digest); err != nil {
+			return err
+		}
+
+		fmt.Printf("Pushed %s %s\n", desc.Digest, desc.MediaType)
+
+		return nil
+	},
+}

cmd/ctr/rootfs.go

@@ -0,0 +1,70 @@
+package main
+
+import (
+	"errors"
+	"fmt"
+
+	"github.com/containerd/containerd/log"
+	digest "github.com/opencontainers/go-digest"
+	"github.com/urfave/cli"
+)
+
+var rootfsCommand = cli.Command{
+	Name:  "rootfs",
+	Usage: "rootfs setups a rootfs",
+	Subcommands: []cli.Command{
+		rootfsUnpackCommand,
+	},
+}
+
+var rootfsUnpackCommand = cli.Command{
+	Name:      "unpack",
+	Usage:     "unpack applies layers from a manifest to a snapshot",
+	ArgsUsage: "[flags] <digest>",
+	Flags:     snapshotterFlags,
+	Action: func(clicontext *cli.Context) error {
+		ctx, cancel := appContext(clicontext)
+		defer cancel()
+
+		dgst, err := digest.Parse(clicontext.Args().First())
+		if err != nil {
+			return err
+		}
+
+		log.G(ctx).Debugf("unpacking layers from manifest %s", dgst.String())
+
+		client, err := newClient(clicontext)
+		if err != nil {
+			return err
+		}
+
+		// TODO: Support unpack by name
+
+		images, err := client.ListImages(ctx)
+		if err != nil {
+			return err
+		}
+
+		var unpacked bool
+		for _, image := range images {
+			if image.Target().Digest == dgst {
+				fmt.Printf("unpacking %s (%s)...", dgst, image.Target().MediaType)
+				if err := image.Unpack(ctx, clicontext.String("snapshotter")); err != nil {
+					fmt.Println()
+					return err
+				}
+				fmt.Println("done")
+				unpacked = true
+				break
+			}
+		}
+		if !unpacked {
+			return errors.New("manifest not found")
+		}
+
+		// TODO: Get rootfs from Image
+		//log.G(ctx).Infof("chain ID: %s", chainID.String())
+
+		return nil
+	},
+}

cmd/ctr/utils.go

@@ -1,16 +1,23 @@
 package main
 
 import (
+	"bufio"
 	gocontext "context"
+	"crypto/tls"
 	"encoding/csv"
+	"encoding/json"
 	"fmt"
+	"net"
+	"net/http"
 	"os"
 	"os/signal"
 	"strconv"
 	"strings"
 	"syscall"
+	"time"
 
 	"github.com/Sirupsen/logrus"
+	"github.com/containerd/console"
 	"github.com/containerd/containerd"
 	containersapi "github.com/containerd/containerd/api/services/containers/v1"
 	contentapi "github.com/containerd/containerd/api/services/content/v1"
@@ -24,23 +31,49 @@ import (
 	"github.com/containerd/containerd/content"
 	"github.com/containerd/containerd/images"
 	"github.com/containerd/containerd/namespaces"
+	"github.com/containerd/containerd/remotes"
+	"github.com/containerd/containerd/remotes/docker"
+	"github.com/containerd/containerd/rootfs"
 	contentservice "github.com/containerd/containerd/services/content"
 	"github.com/containerd/containerd/services/diff"
 	imagesservice "github.com/containerd/containerd/services/images"
 	namespacesservice "github.com/containerd/containerd/services/namespaces"
 	snapshotservice "github.com/containerd/containerd/services/snapshot"
 	"github.com/containerd/containerd/snapshot"
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
 	specs "github.com/opencontainers/runtime-spec/specs-go"
+	"github.com/pkg/errors"
 	"github.com/urfave/cli"
 	"google.golang.org/grpc"
 )
 
-var snapshotterFlags = []cli.Flag{
-	cli.StringFlag{
-		Name:  "snapshotter",
-		Usage: "Snapshotter name. Empty value stands for the daemon default value.",
-	},
-}
+var (
+	snapshotterFlags = []cli.Flag{
+		cli.StringFlag{
+			Name:  "snapshotter",
+			Usage: "Snapshotter name. Empty value stands for the daemon default value.",
+		},
+	}
+
+	registryFlags = []cli.Flag{
+		cli.BoolFlag{
+			Name:  "skip-verify,k",
+			Usage: "Skip SSL certificate validation",
+		},
+		cli.BoolFlag{
+			Name:  "plain-http",
+			Usage: "Allow connections using plain HTTP",
+		},
+		cli.StringFlag{
+			Name:  "user,u",
+			Usage: "user[:password] Registry user and password",
+		},
+		cli.StringFlag{
+			Name:  "refresh",
+			Usage: "Refresh token for authorization server",
+		},
+	}
+)
 
 var grpcConn *grpc.ClientConn
 
@@ -145,6 +178,110 @@ func getVersionService(context *cli.Context) (versionservice.VersionClient, erro
 	return versionservice.NewVersionClient(conn), nil
 }
 
+func passwordPrompt() (string, error) {
+	c := console.Current()
+	defer c.Reset()
+
+	if err := c.DisableEcho(); err != nil {
+		return "", errors.Wrap(err, "failed to disable echo")
+	}
+
+	line, _, err := bufio.NewReader(c).ReadLine()
+	if err != nil {
+		return "", errors.Wrap(err, "failed to read line")
+	}
+	return string(line), nil
+}
+
+func getImageLayers(ctx gocontext.Context, image images.Image, cs content.Store) ([]rootfs.Layer, error) {
+	p, err := content.ReadBlob(ctx, cs, image.Target.Digest)
+	if err != nil {
+		return nil, errors.Wrapf(err, "failed to read manifest blob")
+	}
+
+	var manifest ocispec.Manifest
+	if err := json.Unmarshal(p, &manifest); err != nil {
+		return nil, errors.Wrap(err, "failed to unmarshal manifest")
+	}
+
+	diffIDs, err := image.RootFS(ctx, cs)
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to resolve rootfs")
+	}
+
+	if len(diffIDs) != len(manifest.Layers) {
+		return nil, errors.Errorf("mismatched image rootfs and manifest layers")
+	}
+
+	layers := make([]rootfs.Layer, len(diffIDs))
+	for i := range diffIDs {
+		layers[i].Diff = ocispec.Descriptor{
+			// TODO: derive media type from compressed type
+			MediaType: ocispec.MediaTypeImageLayer,
+			Digest:    diffIDs[i],
+		}
+		layers[i].Blob = manifest.Layers[i]
+	}
+
+	return layers, nil
+}
+
+// getResolver prepares the resolver from the environment and options.
+func getResolver(ctx gocontext.Context, clicontext *cli.Context) (remotes.Resolver, error) {
+	username := clicontext.String("user")
+	var secret string
+	if i := strings.IndexByte(username, ':'); i > 0 {
+		secret = username[i+1:]
+		username = username[0:i]
+	}
+	options := docker.ResolverOptions{
+		PlainHTTP: clicontext.Bool("plain-http"),
+		Tracker:   pushTracker,
+	}
+	if username != "" {
+		if secret == "" {
+			fmt.Printf("Password: ")
+
+			var err error
+			secret, err = passwordPrompt()
+			if err != nil {
+				return nil, err
+			}
+
+			fmt.Print("\n")
+		}
+	} else if rt := clicontext.String("refresh"); rt != "" {
+		secret = rt
+	}
+
+	options.Credentials = func(host string) (string, string, error) {
+		// Only one host
+		return username, secret, nil
+	}
+
+	tr := &http.Transport{
+		Proxy: http.ProxyFromEnvironment,
+		DialContext: (&net.Dialer{
+			Timeout:   30 * time.Second,
+			KeepAlive: 30 * time.Second,
+			DualStack: true,
+		}).DialContext,
+		MaxIdleConns:        10,
+		IdleConnTimeout:     30 * time.Second,
+		TLSHandshakeTimeout: 10 * time.Second,
+		TLSClientConfig: &tls.Config{
+			InsecureSkipVerify: clicontext.Bool("insecure"),
+		},
+		ExpectContinueTimeout: 5 * time.Second,
+	}
+
+	options.Client = &http.Client{
+		Transport: tr,
+	}
+
+	return docker.NewResolver(options), nil
+}
+
 func forwardAllSignals(ctx gocontext.Context, task killer) chan os.Signal {
 	sigc := make(chan os.Signal, 128)
 	signal.Notify(sigc)