Commit Graph

125 Commits

Author SHA1 Message Date
Shiming Zhang
b890f056e8 Fix content.ReaderAt close
Signed-off-by: Shiming Zhang <wzshiming@foxmail.com>
2021-05-08 12:39:09 +08:00
ktock
5c02688b59 converter: use OpenWriter helper function
When several goroutines call uncompress converter in parallel, the ref name
conflicts each other. This leads to Writer method failing with Unavaliable error
without retry.
For solving this issue, OpenWriter helper should be used. This allows them to
retry in such situations.

Signed-off-by: Kohei Tokunaga <ktokunaga.mail@gmail.com>
2021-04-15 19:05:10 +09:00
ktock
c54d92c79d image: use generic decompressor for calculating DiffID
Currently, `image.GetDiffID` cannot calculate DiffID of zstd layers because it
directly uses `compress/gzip` decompressor.
This commit fixes this issue by using the generic decompressor.

Signed-off-by: Kohei Tokunaga <ktokunaga.mail@gmail.com>
2021-03-31 10:21:47 +09:00
Fu, Wei
80fa9fe32a
Merge pull request #5135 from AkihiroSuda/default-config-crypt
add imgcrypt stream processors to the default config
2021-03-25 14:31:38 +08:00
Akihiro Suda
ecb881e5e6
add imgcrypt stream processors to the default config
Enable the following config by default:

```toml
version = 2

[plugins."io.containerd.grpc.v1.cri".image_decryption]
  key_model = "node"

[stream_processors]
  [stream_processors."io.containerd.ocicrypt.decoder.v1.tar.gzip"]
    accepts = ["application/vnd.oci.image.layer.v1.tar+gzip+encrypted"]
    returns = "application/vnd.oci.image.layer.v1.tar+gzip"
    path = "ctd-decoder"
    args = ["--decryption-keys-path", "/etc/containerd/ocicrypt/keys"]
    env = ["OCICRYPT_KEYPROVIDER_CONFIG=/etc/containerd/ocicrypt/ocicrypt_keyprovider.conf"]
  [stream_processors."io.containerd.ocicrypt.decoder.v1.tar"]
    accepts = ["application/vnd.oci.image.layer.v1.tar+encrypted"]
    returns = "application/vnd.oci.image.layer.v1.tar"
    path = "ctd-decoder"
    args = ["--decryption-keys-path", "/etc/containerd/ocicrypt/keys"]
    env = ["OCICRYPT_KEYPROVIDER_CONFIG=/etc/containerd/ocicrypt/ocicrypt_keyprovider.conf"]
```

Fix issue 5128

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
2021-03-15 13:27:16 +09:00
Derek McGowan
35eeb24a17
Fix exported comments enforcer in CI
Add comments where missing and fix incorrect comments

Signed-off-by: Derek McGowan <derek@mcg.dev>
2021-03-12 08:47:05 -08:00
Akihiro Suda
5ca3ac65c4
add Image content converter
Go example:
```go
opts := []converter.Opt{
  // convert Docker media types to OCI ones
  converter.WithDocker2OCI(true),
  // convert tar.gz layers to uncompressed tar layers
  converter.WithLayerConvertFunc(uncompress.LayerConvertFunc),
}
srcRef := "example.com/foo:orig"
dstRef := "example.com/foo:converted"
dstImg, err = converter.Convert(ctx, client, dstRef, srcRef, opts...)
fmt.Println(dstImg.Target)
```

ctr example: `ctr images convert --oci --uncompress example.com/foo:orig example.com/foo:converted`

Go test: `go test -exec sudo -test.root -test.run TestConvert`

The implementation is from https://github.com/containerd/stargz-snapshotter/pull/224,
but eStargz-specific functions are not included in this PR.

eStargz converter can be specified by importing `estargz` package and using `WithLayerConvertFunc(estargz.LayerConvertFunc)` option.

This converter interface will be potentially useful for converting zstd and ocicrypt layers as well.

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
2021-01-22 13:33:19 +09:00
Guangwen Feng
3e7bb721d4 Fix typo in comment
Signed-off-by: Guangwen Feng <fenggw-fnst@cn.fujitsu.com>
2021-01-06 17:01:29 +08:00
Akihiro Suda
e2e2c5737d
export: add --skip-non-distributable
The flag skips adding non-distributable blobs such as Windows layers to archive.

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
2021-01-01 06:32:01 +09:00
Shengjing Zhu
5988bfc1ef docs: Various typo found by codespell
Signed-off-by: Shengjing Zhu <zhsj@debian.org>
2020-12-22 13:22:16 +08:00
Giuseppe Scrivano
30802fac73
compression: add support for the zstd algorithm
zstd is a compression algorithm that has a very fast decoder, while
providing also good compression ratios.  The fast decoder makes it
suitable for container images, as decompressing the tarballs is a very
expensive operation.

https://github.com/opencontainers/image-spec/pull/788 added support
for zstd to the OCI image specs.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2020-12-07 09:56:30 +01:00
Akihiro Suda
d184a0a343
Merge pull request #4414 from dmcgowan/discard-content
Set content labels based on content type
2020-07-24 16:31:46 +09:00
Derek McGowan
c8b14ae4c0
Set content labels based on content type
Give control of the content labeling process for children to
the client. This allows the client to control the names
associated with the labels and filter out labels.

Signed-off-by: Derek McGowan <derek@mcg.dev>
2020-07-21 00:46:07 -07:00
Paul "TBBle" Hampson
71f11db8a3 Annotate bare ErrNotImplemented returns
This makes it possible to see _what_ is not implemented from the caller.

Signed-off-by: Paul "TBBle" Hampson <Paul.Hampson@Pobox.com>
2020-07-16 20:16:11 +10:00
Brian Goff
aa191deff1 Change log for unknown mt to debug
This log message shows up in the client's logs. For any media type that
the client doesn't know about it will wind up with a warning log.
Downgrade this to debug since it is more of a development concern.

We encountered this trying to fetch Docker plugins which has a media
type for plugin configs.

Signed-off-by: Brian Goff <cpuguy83@gmail.com>
2020-06-29 11:21:21 -07:00
Sebastiaan van Stijn
dc92ad6520
Replace errors.Cause() with errors.Is()
Dependencies may be switching to use the new `%w` formatting
option to wrap errors; switching to use `errors.Is()` makes
sure that we are still able to unwrap the error and detect the
underlying cause.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-05-08 14:36:45 +02:00
Xiaodong Ye
c4ed3ff1ed Replace ocispec.MediaTypeImageManifest with manifest.MediaType
Signed-off-by: Xiaodong Ye <xiaodongy@vmware.com>
2019-12-20 10:26:13 +08:00
Lantao Liu
78be736622 Return not found error if no platform matched.
Signed-off-by: Lantao Liu <lantaol@google.com>
2019-10-28 22:37:07 -07:00
Michael Crosby
901bcb2231 Add distribution subpkgs to core
Ref: #3554

Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
2019-10-07 13:38:12 -04:00
yuxiaobo
0cb7e4d5fd Perfect documentations
Signed-off-by: yuxiaobo <yuxiaobogo@163.com>
2019-09-30 09:29:04 +08:00
yuxiaobo
a0ae24b984 Word spelling correction
Signed-off-by: yuxiaobo <yuxiaobogo@163.com>
2019-09-25 16:49:54 +08:00
Derek McGowan
6f31417d49
Generalize media types
Avoid directly handling media types with "+" attributes,
instead handling the base and passing through the full
media type to the appropriate stream processor or decompression.

Signed-off-by: Derek McGowan <derek@mcgstyle.net>
2019-09-19 16:09:19 -07:00
Phil Estes
b77e25dade
Merge pull request #3516 from crosbymichael/remote-enc
Remove encryption code from containerd core
2019-08-13 10:52:48 -04:00
Phil Estes
ec0c968215
Merge pull request #3520 from dmcgowan/image-usage
Add image usage function to client
2019-08-12 18:01:15 -04:00
Derek McGowan
c017e0efed
Use a child context for errgroup in dispatch
Prevent an errgroup error from causing the acquire to
return a cancellation error. Previously any error
from the errgroup would cause the Dispatch to always
return the cancelled error.

Signed-off-by: Derek McGowan <derek@mcgstyle.net>
2019-08-09 16:01:23 -07:00
Michael Crosby
d085d9b464 Remove encryption code from containerd core
We are separating out the encryption code and have designed a few new
interfaces and APIs for processing content streams.  This keep the core
clean of encryption code but enables not only encryption but support of
multiple content types ( custom media types ).

Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
2019-08-09 15:01:16 +00:00
Darren Shepherd
1161409779 Limit multiple platform manifests to one for size check
client.Pull will only pull one matching platform by default.
When checking the size of image we match that behavior so that
we don't look for multiple platforms that might not exist on disk.

Signed-off-by: Darren Shepherd <darren@rancher.com>
2019-08-08 14:16:27 -07:00
Derek McGowan
3e52e29025
Fix bug in export named manifest option
When providing multiple names, the shared annotation map was
causing the names to get overridden.
Combined the WithManifest options which had compatible interfaces.

Signed-off-by: Derek McGowan <derek@mcgstyle.net>
2019-08-01 15:34:07 -07:00
Phil Estes
29930e9185
Merge pull request #3455 from dmcgowan/fix-default-import-compression
Add option to compress blobs on import
2019-07-25 16:45:11 -04:00
Derek McGowan
02826345cf
Add option to compress blobs on import
Change the default back to leave uncompressed and add
option to do the compression.

Signed-off-by: Derek McGowan <derek@mcgstyle.net>
2019-07-25 12:05:38 -07:00
Brandon Lum
3d1fa69694 Implemented constructors for both encryption and decryption
Signed-off-by: Brandon Lum <lumjjb@gmail.com>
2019-07-24 22:19:39 -04:00
Stefan Berger
364de4c35d Wrap creation of CryptoConfig in constructors
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
2019-07-23 19:53:23 -04:00
Brandon Lum
c6d437fd70 Corrected lease implementation
Signed-off-by: Brandon Lum <lumjjb@gmail.com>
2019-07-18 18:17:20 -04:00
Brandon Lum
c00517a94c Made fixes and optimizations to encryption GC
Signed-off-by: Brandon Lum <lumjjb@gmail.com>
2019-07-18 15:15:32 -04:00
Phil Estes
c90a3d4932
Merge pull request #3134 from stefanberger/encryption_code_plus_ctr.pr
Add image encryption support and ctr support
2019-07-17 15:47:12 -04:00
Derek McGowan
dde436e65b Crypto library movement and changes to content helper interfaces
Signed-off-by: Derek McGowan <derek@mcgstyle.net>
2019-07-17 15:21:29 -04:00
Stefan Berger
bf8804c743 Implemented image encryption/decryption libraries and ctr commands
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Signed-off-by: Brandon Lum <lumjjb@gmail.com>
2019-07-17 15:19:58 -04:00
Phil Estes
129942ca4d
Merge pull request #3135 from dmcgowan/archive-importer-docker-types
Compress import blobs in Docker compatibility code
2019-07-17 09:25:40 -04:00
Michael Crosby
b5d0c78225
Merge pull request #3406 from fuweid/me-update-Manifest
images: only fetch the best matched manifest info
2019-07-16 15:32:09 -04:00
Maksym Pavlenko
ef7f46eb7b Fix linter errors
Signed-off-by: Maksym Pavlenko <makpav@amazon.com>
2019-07-14 20:49:40 -07:00
Wei Fu
d643f1dc88 images: only fetch the best matched manifest info
When client uses Pull action to pull image, it will limit the number of
manifest as one. But Unpack action will call Manifest to traverse all
the manifests including non-dowloaded one. If the platform has more than
one manifest, the Pull with unpack action will fail. And also, there is
no need to read non-best matched manifest. Therefore, the Manifest can
do the sort earlier.

Signed-off-by: Wei Fu <fuweid89@gmail.com>
2019-07-12 22:34:43 -04:00
Derek McGowan
5e2d7efd82
Use a single custom annotation for export
Remove annotation prefix and add multiple index records
for manifests with multiple image names. This makes the
custom annotation more consistent with the OCI image
annotation. Additionally, ensure the OCI image annotation
always represents the tag (partial image name) as recommended
by the specification. The containerd image name annotation
will always contain the full image name.

Signed-off-by: Derek McGowan <derek@mcgstyle.net>
2019-05-21 17:21:26 -07:00
Wei Fu
e61f7f4913
Merge pull request #3172 from dmcgowan/export-docker-compatibility
Update image export to support Docker format
2019-05-17 14:30:54 +08:00
Davor Kapsa
cfc36388b3 Remove redundant error checks
Signed-off-by: Davor Kapsa <davor.kapsa@gmail.com>
2019-04-30 21:28:51 +02:00
Derek McGowan
4754d2aeee
Update image export to support Docker format
Add manifest.json file which is used by Docker
to import images.

Signed-off-by: Derek McGowan <derek@mcgstyle.net>
2019-04-04 15:23:06 -07:00
Derek McGowan
8d1ae237eb
Always add compressed blobs to Docker import manifest
Ensure the manifest which gets created using the Docker
compatibility code compresses the blob before creating
the manifest. This ensures consistency with manifests
used by Docker.

Signed-off-by: Derek McGowan <derek@mcgstyle.net>
2019-04-04 10:35:01 -07:00
Sebastiaan van Stijn
525802f9ce
Use distribution's reference.ParseDockerRef
Using the cri utility caused other project to have
containerd/cri as a dependency, only for this utility.

The new `reference.ParseDockerRef` function does the
same (other than having a different name).

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2019-02-07 13:13:25 +01:00
Lantao Liu
d7ed403072 Add image pull concurrency limit.
Signed-off-by: Lantao Liu <lantaol@google.com>
2019-01-29 10:27:05 -08:00
Phil Estes
b444d7d507
Handle additional cleanups from prior PR
Update comment and streamline getting the default platform spec

Signed-off-by: Phil Estes <estesp@linux.vnet.ibm.com>
2019-01-16 13:07:29 -05:00
kadisi
40267382c5 fix ctr image export not found error
Signed-off-by: Jie Zhang <iamkadisi@163.com>
2018-12-17 08:52:28 +08:00