Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Machines created by podman machine must alter registries.conf #11489

Closed
mheon opened this issue Sep 8, 2021 · 7 comments · Fixed by #11498
Closed

Machines created by podman machine must alter registries.conf #11489

mheon opened this issue Sep 8, 2021 · 7 comments · Fixed by #11498
Assignees
@baude @ashley-cui
Labels
kind/bug Categorizes issue or PR as related to a bug. locked - please file new issue/PR Assist humans wanting to comment on an old issue or PR with locked comments.

Comments

@mheon
Copy link
Member

mheon commented Sep 8, 2021

Is this a BUG REPORT or FEATURE REQUEST? (leave only one on its own line)

/kind bug

Description

At present, podman-remote does not properly support short name prompting. The VMs created by podman machine presently use FCOS based on F34, which includes a registries.conf that enforces shortname prompting. The combination of these two renders shortnames unusable with machines created by podman machine at present.

After some discussion, the team decided on a temporary workaround of changing registries.conf to only have a single search registry for VMs created by podman machine: docker.io. This will remove the need for prompting as there will be no ambiguity. In the future we will investigate a more permanent solution that allows podman-remote to prompt (while not requiring the Docker-compatible API to do so).
@openshift-ci openshift-ci bot added the kind/bug Categorizes issue or PR as related to a bug. label Sep 8, 2021
@afbjorklund
Copy link
Contributor

afbjorklund commented Sep 8, 2021 •
edited
Loading

I got "lucky" while testing, since the image was covered by the hard-coded list

Resolved "busybox" as an alias (/etc/containers/registries.conf.d/000-shortnames.conf)

Running other images does show the problem, and don't work at all (as short)

Error: short-name resolution enforced but cannot prompt without a TTY

@afbjorklund
Copy link
Contributor

afbjorklund commented Sep 8, 2021 •
edited
Loading

. In the future we will investigate a more permanent solution

Was there another issue already, on how to handle the prompting over remote ?

@rhatdan
Copy link
Member

rhatdan commented Sep 8, 2021

Nope we need one for that as well. We are talking about multiple different steps to fix this long term.

@vrothberg
Copy link
Member

I suggest dropping a config into /etc/containers/registries.conf.d/ with the following content:

unqualified-search-registries = ["docker.io"]

Cc: @mtrmac

@vrothberg vrothberg mentioned this issue Sep 9, 2021
Merged
@vrothberg
Copy link
Member

I gave it a shot in #11498

@vrothberg
Copy link
Member

For the record: the same issue applies when using Podman/Buildah without having access to a TTY (e.g., in a build pipeline) when the short-name mode is set to enforcing. That was the trade-off for increasing security. It is hence not entirely limited to remote.

Getting prompting to work over the libpod endpoints will increase the interactive experience when using podman-remote but the core issue still persists when using the remote API in a non-interactive fashion (without podman-remote) or using the compat API.

@rhatdan
Copy link
Member

rhatdan commented Sep 9, 2021

That is understood, we are trying to help out Humans though and not robots. Robots can more easily be fixed the humans.

vrothberg added a commit to vrothberg/libpod that referenced this issue Sep 10, 2021
@vrothberg
podman machine: enforce a single search registry
6f36a47 
Enforce "docker.io" to be the only search registry.  Short-name
resolution for remote clients is not fully supported since there is no
means to prompt.  Enforcing a single registry  works around the problem
since prompting only fires with more than one search registry.

Fixes: containers#11489
Signed-off-by: Valentin Rothberg <[email protected]>
mheon pushed a commit to mheon/libpod that referenced this issue Sep 20, 2021
@vrothberg @mheon
podman machine: enforce a single search registry
c494713 
Enforce "docker.io" to be the only search registry.  Short-name
resolution for remote clients is not fully supported since there is no
means to prompt.  Enforcing a single registry  works around the problem
since prompting only fires with more than one search registry.

Fixes: containers#11489
Signed-off-by: Valentin Rothberg <[email protected]>
praveenkumar added a commit to praveenkumar/snc that referenced this issue Feb 15, 2022
@praveenkumar
Enforce a single search registry
6bfce84 
Enforce "docker.io" to be the only search registry.  Short-name
resolution for remote clients is not fully supported since there is no
means to prompt.  Enforcing a single registry  works around the problem
since prompting only fires with more than one search registry.

Without this patch docker client not able to pull short-name images for remote client
```
$ ssh -nNT -L $(pwd)/docker.sock:/run/podman/podman.sock -i /Users/prkumar/.ssh/podman-machine-default -p 64940 root@localhost
<-- different terminal -->
$ export DOCKER_HOST=unix://$(pwd)/docker.sock
$ docker pull httpd:latest
Error response from daemon: failed to resolve image name: short-name resolution enforced but cannot prompt without a TTY
```

This is taken from https://github.com/containers/podman/blob/e06631d6c22f4d5b7a62f70ccdf623379a9d5fe7/pkg/machine/ignition.go#L305-L323

- containers/podman#11489
praveenkumar added a commit to praveenkumar/snc that referenced this issue Feb 15, 2022
@praveenkumar
Enforce a single search registry
53ca01c 
Enforce "docker.io" to be the only search registry.  Short-name
resolution for remote clients is not fully supported since there is no
means to prompt.  Enforcing a single registry  works around the problem
since prompting only fires with more than one search registry.

Without this patch docker/podman client not able to pull short-name images when using remote socket.
```
$ ssh -nNT -L $(pwd)/docker.sock:/run/podman/podman.sock -i /Users/prkumar/.ssh/podman-machine-default -p 64940 root@localhost
<-- different terminal -->
$ export DOCKER_HOST=unix://$(pwd)/docker.sock
$ docker pull httpd:latest
Error response from daemon: failed to resolve image name: short-name resolution enforced but cannot prompt without a TTY
```

- containers/podman@6f36a47
- containers/podman#11489
praveenkumar added a commit to praveenkumar/snc that referenced this issue Feb 15, 2022
@praveenkumar
Enforce a single search registry
e8154c1 
Enforce "docker.io" to be the only search registry.  Short-name
resolution for remote clients is not fully supported since there is no
means to prompt.  Enforcing a single registry  works around the problem
since prompting only fires with more than one search registry.

Without this patch docker/podman client not able to pull short-name images when using remote socket.
```
$ ssh -nNT -L $(pwd)/docker.sock:/run/podman/podman.sock -i /Users/prkumar/.ssh/podman-machine-default -p 64940 root@localhost
==== docker client ====
$ docker -H unix://$(pwd)/docker.sock pull httpd:latest
Error response from daemon: failed to resolve image name: short-name resolution enforced but cannot prompt without a TTY
=== podman client ===
$ podman -c unix://$(pwd)/docker.sock pull httpd:latest
Error: short-name resolution enforced but cannot prompt without a TTY
```

- containers/podman@6f36a47
- containers/podman#11489
praveenkumar added a commit to praveenkumar/snc that referenced this issue Feb 15, 2022
@praveenkumar
Enforce a single search registry
9e0354f 
Enforce "docker.io" to be the only search registry.  Short-name
resolution for remote clients is not fully supported since there is no
means to prompt.  Enforcing a single registry  works around the problem
since prompting only fires with more than one search registry.

Without this patch docker/podman client not able to pull short-name images when using remote socket.
```
$ eval $(crc podman-env)
$ podman-remote pull httpd:latest
Error: short-name resolution enforced but cannot prompt without a TTY
```

- containers/podman@6f36a47
- containers/podman#11489
praveenkumar added a commit to crc-org/snc that referenced this issue Feb 16, 2022
@praveenkumar
Enforce a single search registry
5375be0 
Enforce "docker.io" to be the only search registry.  Short-name
resolution for remote clients is not fully supported since there is no
means to prompt.  Enforcing a single registry  works around the problem
since prompting only fires with more than one search registry.

Without this patch docker/podman client not able to pull short-name images when using remote socket.
```
$ eval $(crc podman-env)
$ podman-remote pull httpd:latest
Error: short-name resolution enforced but cannot prompt without a TTY
```

- containers/podman@6f36a47
- containers/podman#11489
@github-actions github-actions bot added the locked - please file new issue/PR Assist humans wanting to comment on an old issue or PR with locked comments. label Sep 21, 2023
@github-actions github-actions bot locked as resolved and limited conversation to collaborators Sep 21, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees

@baude baude

@ashley-cui ashley-cui

Labels
kind/bug Categorizes issue or PR as related to a bug. locked - please file new issue/PR Assist humans wanting to comment on an old issue or PR with locked comments.
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

[CI:DOCS] podman machine: enforce a single search registry vrothberg/libpod
6 participants
@rhatdan @mheon @baude @afbjorklund @vrothberg @ashley-cui