CONTAINERS-REGISTRIES.CONF(5) (NAME) containers-registries.conf - (DESCRIPTION) CONTAINERS-REGISTRIES . TOML . $XDG_CONFIG_HOME/containers/registries.conf ( $XDG_CONFIG_HOME $HOME/.config/containers/registries.conf) /etc/containers/registries.conf /usr/share/containers/registries.conf . . CONTAINERS_REGISTRIES_CONF . (drop-in) . registries.conf : - $XDG_CONFIG_HOME/containers/registries.conf.d ( $XDG_CONFIG_HOME $HOME/.config/containers/registries.conf.d) - /etc/containers/registries.rootful.conf.d ( uid 0) - /etc/containers/registries.rootless.conf.d/$UID ( uid > 0) - /etc/containers/registries.rootless.conf.d ( uid > 0) - /etc/containers/registries.conf.d - /usr/share/containers/registries.rootful.conf.d ( uid 0) - /usr/share/containers/registries.rootless.conf.d/$UID ( uid > 0) - /usr/share/containers/registries.rootless.conf.d ( uid > 0) - /usr/share/containers/registries.conf.d .conf . - . . . : o /usr/share/containers/registries.rootless.conf.d/50-middle.conf o /etc/containers/registries.rootless.conf.d/20-first.conf o /etc/containers/registries.rootless.conf.d/70-last.conf 20-first.conf 50-middle.conf 70-last.conf (basename) . conf . unqualified-search- registries /etc/containers/registries.conf.d/myregistries.conf /etc/containers/registries.conf . [[registry]] . CONTAINERS_REGISTRIES_CONF_OVERRIDE . containers-config(5) . (GLOBAL SETTINGS) unqualified-search-registries host[:port] (pull) (unqualified) . credential-helpers . "containers-auth.json" containers-auth.json(5) . ["containers-auth.json"] . additional-layer-store-auth-helper . << >> (Additional Layer Store) docker:// . << Additional Layer Store >> . [[registry]] TOML [[registry]] / . TOML [[registry]] TOML [[registry]] prefix . prefix: : - host[:port] - host[:port]/namespace[/_namespace_] - host[:port]/namespace[/_namespace_]/repo - host[:port]/namespace[/_namespace_]/repo(:_tag|@digest) - [*.]host prefix ( ) TOML [[registry]] () TOML . (wildcard) *.example.com . . *.example.com example.*.com *.example.com/foo *.example.com:5000/foo/bar:baz . * *.example.com bar.example.com foo.bar.example.com . prefix location ( ) . (Per-namespace settings) insecure true false. TLS . insecure true HTTP TLS . blocked true false. true (pull) . (Remapping and mirroring registries) <<>> . ( Dockerfile ). location prefix prefix . prefix ( prefix TOML [[registry]] location ). : prefix = "example.com/foo" location = "internal-registry-for-example.com/bar" example.com/foo/myimage:latest internal-registry-for-example.com/bar/myimage:latest . prefix "*.example.com" . . insecure / blocked / mirrors . : prefix = "*.example.com" blah.example.com/foo/myimage:latest insecure/blocked/mirrors . mirror TOML ( ) prefix ( TOML [[registry]]) . ( registry.location ). (blob) ( Blob ). TOML mirror : - location: TOML [[registry]] - insecure: TOML [[registry]] - pull-from-mirror: all digest-only tag-only. "digest-only" (digest) . . . "tag-only" . . "all" ( ) mirror-by-digest-only . mirror-by-digest-only . mirror-by-digest-only true false. true (digest) . digest-only . tag-only . ( ). Blob (Blob-level mirror fallback) (blobs) . ( HTTP 5xx ) BLOB_UNKNOWN HTTP 429 . pull . . ( retry containers-common kubelet) . . : (push) / . . (Short-Name Aliasing) (unqualified- search) . (namespace squatting) . ["registry1.com", "registry2.com"] registry1.com registry2.com registry1.com . . << >> (short- name aliases) . [aliases] "name"="value" name ( "image") value ( "registry.com/namespace/image") . "name" "value" . "name" localhost . . . short-name-mode . . "image" "image:tag" "image@digest" ( "image") . . ( containers-registries.conf.d(5) ) . "value" ( "") . "name" . : (Modes) short-name-mode : o enforcing: unqualified . ( stdout stdin TTY ) . . o permissive: enforcing . unqualified . o disabled: unqualified . short-name-mode permissive . enforcing permissive . /var/cache/containers/short- name-aliases.conf registries.conf short-name-aliases.conf . (rootless) $HOME/.cache . registries.conf short-name-aliases.conf short-name-aliases.conf . docker.io docker.io : ( docker.io/namespace/image) push pull /library . ( .) docker.io/alpine docker.io/library/alpine . docker.io/user/alpine . docker.io () /library ( ) prefix location /library prefix = "docker.io/library/alpine" prefix = "docker.io/alpine". docker.io/alpine/* docker.io/[library/]alpine . (EXAMPLE) unqualified-search-registries = ["example.com"] [[registry]] prefix = "example.com/foo" insecure = false blocked = false location = "internal-registry-for-example.com/bar" [[registry.mirror]] location = "example-mirror-0.local/mirror-for-foo" [[registry.mirror]] location = "example-mirror-1.local/mirrors/foo" insecure = true [[registry]] location = "registry.com" [[registry.mirror]] location = "mirror.registry.com" example.com/foo/image:latest : 1. example-mirror-0.local/mirror-for-foo/image:latest 2. example-mirror-1.local/mirrors/foo/image:latest 3. internal-registry-for-example.com/bar/image:latest . Blob . TOML [[registry]] . registry.com/image:latest mirror.registry.com example.com/foo . Additional Layer Store additional-layer-store-auth-helper . . additional-layer-store-auth-helper . docker:// (stdin) : { "$image_reference": { "username": "$username", "password": "$password", "identityToken": "$identityToken" } } $image_reference $repo{:$tag|@$digest} . . (EXAMPLE) : [registries.search] registries = ['registry1.com', 'registry2.com'] [registries.insecure] registries = ['registry3.com'] [registries.block] registries = ['registry.untrusted.com', 'registry.unsafe.com'] : (NOTE: RISK OF USING UNQUALIFIED IMAGE NAMES) ( dns) ( registry.redhat.io/ubi8/ubi:latest). . foobar myregistry.com . myregistry.com foobar . . . . . (fully-qualified) . ( quay.io/repository/name@digest) . (SEE ALSO) containers-config(5), containers-auth.json(5), containers-certs.d(5) (HISTORY) Tom Sweeney tsweeney@redhat.com Sascha Grunert sgrunert@suse.com Valentin Rothberg vrothberg@suse.com containers-registries.conf(5) Tom Sweeney tsweeney@redhat.com Brent Baude bbaude@redhat.com Containers CONTAINERS-REGISTRIES.CONF(5)