Skip to content
This repository was archived by the owner on Jul 18, 2025. It is now read-only.

Commit 82e4948

Browse files
eunomieeunomie
committed
Remove --insecure-registries flag
The `--insecure-registries` flag is removed to have a consistent UX with Docker CLI. Instead of this flag, the list of insecure registries is retrieved from the engine. See https://docs.docker.com/registry/insecure/ to configure your engine to allow communication to an insecure registry. See the engine API documentation at https://docs.docker.com/engine/api/v1.40/#operation/SystemInfo and `RegistryConfig.IndexConfigs` fields. Signed-off-by: Yves Brissaud <yves.brissaud@docker.com>
1 parent acbaab0 commit 82e4948

10 files changed

Lines changed: 85 additions & 47 deletions

File tree

‎e2e/images_test.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ func TestImageList(t *testing.T) {
2727
defer dir.Remove()
2828

2929
// Push an application so that we can later pull it by digest
30-
cmd.Command = dockerCli.Command("app", "push", "--tag", info.registryAddress+"/c-myapp", "--insecure-registries="+info.registryAddress, filepath.Join("testdata", "push-pull", "push-pull.dockerapp"))
30+
cmd.Command = dockerCli.Command("app", "push", "--tag", info.registryAddress+"/c-myapp", filepath.Join("testdata", "push-pull", "push-pull.dockerapp"))
3131
r := icmd.RunCmd(cmd).Assert(t, icmd.Success)
3232

3333
// Get the digest from the output of the pull command
@@ -36,7 +36,7 @@ func TestImageList(t *testing.T) {
3636
digest := matches[0][1]
3737

3838
// Pull the app by digest
39-
cmd.Command = dockerCli.Command("app", "pull", "--insecure-registries="+info.registryAddress, info.registryAddress+"/c-myapp@"+digest)
39+
cmd.Command = dockerCli.Command("app", "pull", info.registryAddress+"/c-myapp@"+digest)
4040
icmd.RunCmd(cmd).Assert(t, icmd.Success)
4141

4242
cmd.Command = dockerCli.Command("app", "bundle", filepath.Join("testdata", "simple", "simple.dockerapp"), "--tag", "b-simple-app", "--output", dir.Join("simple-bundle.json"))

‎e2e/pushpull_test.go‎

Lines changed: 36 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,7 @@ func TestPushArchs(t *testing.T) {
9595
t.Run(testCase.name, func(t *testing.T) {
9696
cmd := info.configuredCmd
9797
ref := info.registryAddress + "/test/push-pull:1"
98-
args := []string{"app", "push", "--tag", ref, "--insecure-registries=" + info.registryAddress}
98+
args := []string{"app", "push", "--tag", ref}
9999
args = append(args, testCase.args...)
100100
args = append(args, filepath.Join("testdata", "push-pull", "push-pull.dockerapp"))
101101
cmd.Command = dockerCli.Command(args...)
@@ -121,14 +121,31 @@ func TestPushArchs(t *testing.T) {
121121
})
122122
}
123123

124+
func TestPushInsecureRegistry(t *testing.T) {
125+
runWithDindSwarmAndRegistry(t, func(info dindSwarmAndRegistryInfo) {
126+
ref := info.registryAddress + "/test/push-insecure"
127+
128+
// create a command outside of the dind context so without the insecure registry configured
129+
cmd2, cleanup2 := dockerCli.createTestCmd()
130+
defer cleanup2()
131+
cmd2.Command = dockerCli.Command("app", "push", "--tag", ref, filepath.Join("testdata", "push-pull", "push-pull.dockerapp"))
132+
icmd.RunCmd(cmd2).Assert(t, icmd.Expected{ExitCode: 1})
133+
134+
// run the push with the command inside dind context configured to allow access to the insecure registry
135+
cmd := info.configuredCmd
136+
cmd.Command = dockerCli.Command("app", "push", "--tag", ref, filepath.Join("testdata", "push-pull", "push-pull.dockerapp"))
137+
icmd.RunCmd(cmd).Assert(t, icmd.Success)
138+
})
139+
}
140+
124141
func TestPushInstall(t *testing.T) {
125142
runWithDindSwarmAndRegistry(t, func(info dindSwarmAndRegistryInfo) {
126143
cmd := info.configuredCmd
127144
ref := info.registryAddress + "/test/push-pull"
128-
cmd.Command = dockerCli.Command("app", "push", "--tag", ref, "--insecure-registries="+info.registryAddress, filepath.Join("testdata", "push-pull", "push-pull.dockerapp"))
145+
cmd.Command = dockerCli.Command("app", "push", "--tag", ref, filepath.Join("testdata", "push-pull", "push-pull.dockerapp"))
129146
icmd.RunCmd(cmd).Assert(t, icmd.Success)
130147

131-
cmd.Command = dockerCli.Command("app", "install", "--insecure-registries="+info.registryAddress, ref, "--name", t.Name())
148+
cmd.Command = dockerCli.Command("app", "install", ref, "--name", t.Name())
132149
icmd.RunCmd(cmd).Assert(t, icmd.Success)
133150
cmd.Command = dockerCli.Command("service", "ls")
134151
assert.Check(t, cmp.Contains(icmd.RunCmd(cmd).Assert(t, icmd.Success).Combined(), ref))
@@ -140,16 +157,16 @@ func TestPushPullInstall(t *testing.T) {
140157
cmd := info.configuredCmd
141158
ref := info.registryAddress + "/test/push-pull"
142159
tag := ":v.0.0.1"
143-
cmd.Command = dockerCli.Command("app", "push", "--tag", ref+tag, "--insecure-registries="+info.registryAddress, filepath.Join("testdata", "push-pull", "push-pull.dockerapp"))
160+
cmd.Command = dockerCli.Command("app", "push", "--tag", ref+tag, filepath.Join("testdata", "push-pull", "push-pull.dockerapp"))
144161
icmd.RunCmd(cmd).Assert(t, icmd.Success)
145-
cmd.Command = dockerCli.Command("app", "pull", ref+tag, "--insecure-registries="+info.registryAddress)
162+
cmd.Command = dockerCli.Command("app", "pull", ref+tag)
146163
icmd.RunCmd(cmd).Assert(t, icmd.Success)
147164

148165
// stop the registry
149166
info.stopRegistry()
150167

151168
// install without --pull should succeed (rely on local store)
152-
cmd.Command = dockerCli.Command("app", "install", "--insecure-registries="+info.registryAddress, ref+tag, "--name", t.Name())
169+
cmd.Command = dockerCli.Command("app", "install", ref+tag, "--name", t.Name())
153170
icmd.RunCmd(cmd).Assert(t, icmd.Success)
154171
cmd.Command = dockerCli.Command("service", "ls")
155172
assert.Check(t, cmp.Contains(icmd.RunCmd(cmd).Assert(t, icmd.Success).Combined(), ref))
@@ -162,7 +179,7 @@ func TestPushPullInstall(t *testing.T) {
162179
})
163180

164181
// install with --pull should fail (registry is stopped)
165-
cmd.Command = dockerCli.Command("app", "install", "--pull", "--insecure-registries="+info.registryAddress, ref, "--name", t.Name()+"2")
182+
cmd.Command = dockerCli.Command("app", "install", "--pull", ref, "--name", t.Name()+"2")
166183
assert.Check(t, cmp.Contains(icmd.RunCmd(cmd).Assert(t, icmd.Expected{ExitCode: 1}).Combined(), "failed to resolve bundle manifest"))
167184
})
168185
}
@@ -183,10 +200,10 @@ func TestPushInstallBundle(t *testing.T) {
183200
// push it and install to check it is available
184201
t.Run("push-bundle", func(t *testing.T) {
185202
name := strings.Replace(t.Name(), "/", "_", 1)
186-
cmd.Command = dockerCli.Command("app", "push", "--insecure-registries="+info.registryAddress, "--tag", ref, bundleFile)
203+
cmd.Command = dockerCli.Command("app", "push", "--tag", ref, bundleFile)
187204
icmd.RunCmd(cmd).Assert(t, icmd.Success)
188205

189-
cmd.Command = dockerCli.Command("app", "install", "--insecure-registries="+info.registryAddress, ref, "--name", name)
206+
cmd.Command = dockerCli.Command("app", "install", ref, "--name", name)
190207
icmd.RunCmd(cmd).Assert(t, icmd.Success)
191208
cmd.Command = dockerCli.Command("service", "ls")
192209
assert.Check(t, cmp.Contains(icmd.RunCmd(cmd).Assert(t, icmd.Success).Combined(), ref))
@@ -203,10 +220,10 @@ func TestPushInstallBundle(t *testing.T) {
203220
t.Run("push-ref", func(t *testing.T) {
204221
name := strings.Replace(t.Name(), "/", "_", 1)
205222
ref2 := info.registryAddress + "/test/push-ref"
206-
cmd.Command = dockerCli.Command("app", "push", "--insecure-registries="+info.registryAddress, "--tag", ref2, ref+":latest")
223+
cmd.Command = dockerCli.Command("app", "push", "--tag", ref2, ref+":latest")
207224
icmd.RunCmd(cmd).Assert(t, icmd.Success)
208225

209-
cmd.Command = dockerCli.Command("app", "install", "--insecure-registries="+info.registryAddress, ref2, "--name", name)
226+
cmd.Command = dockerCli.Command("app", "install", ref2, "--name", name)
210227
icmd.RunCmd(cmd).Assert(t, icmd.Success)
211228
cmd.Command = dockerCli.Command("service", "ls")
212229
assert.Check(t, cmp.Contains(icmd.RunCmd(cmd).Assert(t, icmd.Success).Combined(), ref2))
@@ -218,16 +235,22 @@ func TestPushInstallBundle(t *testing.T) {
218235
ref2 := ref + ":v0.42"
219236
// Create a new command so the bundle store can be trashed before installing the app
220237
cmd2, cleanup2 := dockerCli.createTestCmd()
238+
239+
// Enter the same context as `cmd` to run commands within the same environment
240+
cmd2.Command = dockerCli.Command("context", "create", "swarm-context", "--docker", fmt.Sprintf(`"host=tcp://%s"`, info.swarmAddress))
241+
icmd.RunCmd(cmd2).Assert(t, icmd.Success)
242+
cmd2.Env = append(cmd2.Env, "DOCKER_CONTEXT=swarm-context")
243+
221244
// bundle the app again but this time with a tag to store it into the bundle store
222245
cmd2.Command = dockerCli.Command("app", "bundle", "--tag", ref2, "-o", bundleFile, filepath.Join("testdata", "push-pull", "push-pull.dockerapp"))
223246
icmd.RunCmd(cmd2).Assert(t, icmd.Success)
224247
// Push the app without tagging it explicitly
225-
cmd2.Command = dockerCli.Command("app", "push", "--insecure-registries="+info.registryAddress, ref2)
248+
cmd2.Command = dockerCli.Command("app", "push", ref2)
226249
icmd.RunCmd(cmd2).Assert(t, icmd.Success)
227250
// remove the bundle from the bundle store to be sure it won't be used instead of registry
228251
cleanup2()
229252
// install from the registry
230-
cmd.Command = dockerCli.Command("app", "install", "--insecure-registries="+info.registryAddress, ref2, "--name", name)
253+
cmd.Command = dockerCli.Command("app", "install", ref2, "--name", name)
231254
icmd.RunCmd(cmd).Assert(t, icmd.Success)
232255
cmd.Command = dockerCli.Command("service", "ls")
233256
assert.Check(t, cmp.Contains(icmd.RunCmd(cmd).Assert(t, icmd.Success).Combined(), ref))

‎internal/commands/cnab.go‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -255,7 +255,7 @@ func loadBundleFromFile(filename string) (*bundle.Bundle, error) {
255255
//resolveBundle looks for a CNAB bundle which can be in a Docker App Package format or
256256
// a bundle stored locally or in the bundle store. It returns a built or found bundle,
257257
// a reference to the bundle if it is found in the bundlestore, and an error.
258-
func resolveBundle(dockerCli command.Cli, bundleStore appstore.BundleStore, name string, pullRef bool, insecureRegistries []string) (*bundle.Bundle, string, error) {
258+
func resolveBundle(dockerCli command.Cli, bundleStore appstore.BundleStore, name string, pullRef bool) (*bundle.Bundle, string, error) {
259259
// resolution logic:
260260
// - if there is a docker-app package in working directory, or an http:// / https:// prefix, use packager.Extract result
261261
// - the name has a .json or .cnab extension and refers to an existing file or web resource: load the bundle
@@ -286,6 +286,10 @@ func resolveBundle(dockerCli command.Cli, bundleStore appstore.BundleStore, name
286286
return nil, "", errors.Wrap(err, name)
287287
}
288288
tagRef := reference.TagNameOnly(ref)
289+
insecureRegistries, err := insecureRegistriesFromEngine(dockerCli)
290+
if err != nil {
291+
return nil, "", fmt.Errorf("could not retrieve insecure registries: %v", err)
292+
}
289293
bndl, err := bundleStore.LookupOrPullBundle(tagRef, pullRef, dockerCli.ConfigFile(), insecureRegistries)
290294
return bndl, tagRef.String(), err
291295
}
@@ -346,7 +350,7 @@ func isDockerHostLocal(host string) bool {
346350
}
347351

348352
func prepareCustomAction(actionName string, dockerCli command.Cli, appname string, stdout io.Writer,
349-
registryOpts registryOptions, pullOpts pullOptions, paramsOpts parametersOptions) (*action.RunCustom, *appstore.Installation, *bytes.Buffer, error) {
353+
pullOpts pullOptions, paramsOpts parametersOptions) (*action.RunCustom, *appstore.Installation, *bytes.Buffer, error) {
350354
s, err := appstore.NewApplicationStore(config.Dir())
351355
if err != nil {
352356
return nil, nil, nil, err
@@ -356,7 +360,7 @@ func prepareCustomAction(actionName string, dockerCli command.Cli, appname strin
356360
return nil, nil, nil, err
357361
}
358362
driverImpl, errBuf := prepareDriver(dockerCli, bindMount{}, stdout)
359-
bundle, ref, err := resolveBundle(dockerCli, bundleStore, appname, pullOpts.pull, registryOpts.insecureRegistries)
363+
bundle, ref, err := resolveBundle(dockerCli, bundleStore, appname, pullOpts.pull)
360364
if err != nil {
361365
return nil, nil, nil, err
362366
}

‎internal/commands/inspect.go‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,6 @@ import (
1111

1212
type inspectOptions struct {
1313
parametersOptions
14-
registryOptions
1514
pullOptions
1615
}
1716

@@ -27,14 +26,13 @@ func inspectCmd(dockerCli command.Cli) *cobra.Command {
2726
},
2827
}
2928
opts.parametersOptions.addFlags(cmd.Flags())
30-
opts.registryOptions.addFlags(cmd.Flags())
3129
opts.pullOptions.addFlags(cmd.Flags())
3230
return cmd
3331
}
3432

3533
func runInspect(dockerCli command.Cli, appname string, opts inspectOptions) error {
3634
defer muteDockerCli(dockerCli)()
37-
action, installation, errBuf, err := prepareCustomAction(internal.ActionInspectName, dockerCli, appname, nil, opts.registryOptions, opts.pullOptions, opts.parametersOptions)
35+
action, installation, errBuf, err := prepareCustomAction(internal.ActionInspectName, dockerCli, appname, nil, opts.pullOptions, opts.parametersOptions)
3836
if err != nil {
3937
return err
4038
}

‎internal/commands/install.go‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,6 @@ import (
1616
type installOptions struct {
1717
parametersOptions
1818
credentialOptions
19-
registryOptions
2019
pullOptions
2120
orchestrator string
2221
kubeNamespace string
@@ -59,7 +58,6 @@ func installCmd(dockerCli command.Cli) *cobra.Command {
5958
}
6059
opts.parametersOptions.addFlags(cmd.Flags())
6160
opts.credentialOptions.addFlags(cmd.Flags())
62-
opts.registryOptions.addFlags(cmd.Flags())
6361
opts.pullOptions.addFlags(cmd.Flags())
6462
cmd.Flags().StringVar(&opts.orchestrator, "orchestrator", "", "Orchestrator to install on (swarm, kubernetes)")
6563
cmd.Flags().StringVar(&opts.kubeNamespace, "namespace", "default", "Kubernetes namespace to install into")
@@ -81,7 +79,7 @@ func runInstall(dockerCli command.Cli, appname string, opts installOptions) erro
8179
return err
8280
}
8381

84-
bndl, ref, err := resolveBundle(dockerCli, bundleStore, appname, opts.pull, opts.insecureRegistries)
82+
bndl, ref, err := resolveBundle(dockerCli, bundleStore, appname, opts.pull)
8583
if err != nil {
8684
return err
8785
}

‎internal/commands/pull.go‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -14,21 +14,19 @@ import (
1414
)
1515

1616
func pullCmd(dockerCli command.Cli) *cobra.Command {
17-
var opts registryOptions
1817
cmd := &cobra.Command{
1918
Use: "pull NAME:TAG [OPTIONS]",
2019
Short: "Pull an application package from a registry",
2120
Example: `$ docker app pull docker/app-example:0.1.0`,
2221
Args: cli.ExactArgs(1),
2322
RunE: func(cmd *cobra.Command, args []string) error {
24-
return runPull(dockerCli, args[0], opts)
23+
return runPull(dockerCli, args[0])
2524
},
2625
}
27-
opts.addFlags(cmd.Flags())
2826
return cmd
2927
}
3028

31-
func runPull(dockerCli command.Cli, name string, opts registryOptions) error {
29+
func runPull(dockerCli command.Cli, name string) error {
3230
appstore, err := store.NewApplicationStore(config.Dir())
3331
if err != nil {
3432
return err
@@ -42,7 +40,11 @@ func runPull(dockerCli command.Cli, name string, opts registryOptions) error {
4240
if err != nil {
4341
return errors.Wrap(err, name)
4442
}
45-
bndl, err := bundleStore.LookupOrPullBundle(reference.TagNameOnly(ref), true, dockerCli.ConfigFile(), opts.insecureRegistries)
43+
insecureRegistries, err := insecureRegistriesFromEngine(dockerCli)
44+
if err != nil {
45+
return errors.Wrap(err, "could not retrieve insecure registries")
46+
}
47+
bndl, err := bundleStore.LookupOrPullBundle(reference.TagNameOnly(ref), true, dockerCli.ConfigFile(), insecureRegistries)
4648
if err != nil {
4749
return errors.Wrap(err, name)
4850
}

‎internal/commands/push.go‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,6 @@ const ( // Docker specific annotations and values
4242
)
4343

4444
type pushOptions struct {
45-
registry registryOptions
4645
tag string
4746
platforms []string
4847
allPlatforms bool
@@ -66,7 +65,6 @@ func pushCmd(dockerCli command.Cli) *cobra.Command {
6665
flags.StringVarP(&opts.tag, "tag", "t", "", "Target registry reference (default: <name>:<version> from metadata)")
6766
flags.StringSliceVar(&opts.platforms, "platform", []string{"linux/amd64"}, "For multi-arch service images, push the specified platforms")
6867
flags.BoolVar(&opts.allPlatforms, "all-platforms", false, "If present, push all platforms")
69-
opts.registry.addFlags(flags)
7068
return cmd
7169
}
7270

@@ -102,7 +100,7 @@ func resolveReferenceAndBundle(dockerCli command.Cli, name string) (*bundle.Bund
102100
return nil, "", err
103101
}
104102

105-
bndl, ref, err := resolveBundle(dockerCli, bundleStore, name, false, nil)
103+
bndl, ref, err := resolveBundle(dockerCli, bundleStore, name, false)
106104
if err != nil {
107105
return nil, "", err
108106
}
@@ -136,7 +134,11 @@ func pushInvocationImage(dockerCli command.Cli, retag retagResult) error {
136134
}
137135

138136
func pushBundle(dockerCli command.Cli, opts pushOptions, bndl *bundle.Bundle, retag retagResult) error {
139-
resolver := remotes.CreateResolver(dockerCli.ConfigFile(), opts.registry.insecureRegistries...)
137+
insecureRegistries, err := insecureRegistriesFromEngine(dockerCli)
138+
if err != nil {
139+
return errors.Wrap(err, "could not retrive insecure registries")
140+
}
141+
resolver := remotes.CreateResolver(dockerCli.ConfigFile(), insecureRegistries...)
140142
var display fixupDisplay = &plainDisplay{out: os.Stdout}
141143
if term.IsTerminal(os.Stdout.Fd()) {
142144
display = &interactiveDisplay{out: os.Stdout}

‎internal/commands/render.go‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@ import (
1313

1414
type renderOptions struct {
1515
parametersOptions
16-
registryOptions
1716
pullOptions
1817

1918
formatDriver string
@@ -32,7 +31,6 @@ func renderCmd(dockerCli command.Cli) *cobra.Command {
3231
},
3332
}
3433
opts.parametersOptions.addFlags(cmd.Flags())
35-
opts.registryOptions.addFlags(cmd.Flags())
3634
opts.pullOptions.addFlags(cmd.Flags())
3735
cmd.Flags().StringVarP(&opts.renderOutput, "output", "o", "-", "Output file")
3836
cmd.Flags().StringVar(&opts.formatDriver, "formatter", "yaml", "Configure the output format (yaml|json)")
@@ -53,7 +51,7 @@ func runRender(dockerCli command.Cli, appname string, opts renderOptions) error
5351
w = f
5452
}
5553

56-
action, installation, errBuf, err := prepareCustomAction(internal.ActionRenderName, dockerCli, appname, w, opts.registryOptions, opts.pullOptions, opts.parametersOptions)
54+
action, installation, errBuf, err := prepareCustomAction(internal.ActionRenderName, dockerCli, appname, w, opts.pullOptions, opts.parametersOptions)
5755
if err != nil {
5856
return err
5957
}

‎internal/commands/root.go‎

Lines changed: 23 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
package commands
22

33
import (
4+
"context"
45
"fmt"
56
"io/ioutil"
67
"os"
@@ -10,6 +11,7 @@ import (
1011
"github.com/docker/app/internal/store"
1112
"github.com/docker/cli/cli/command"
1213
"github.com/docker/cli/cli/config"
14+
"github.com/sirupsen/logrus"
1315
"github.com/spf13/cobra"
1416
"github.com/spf13/pflag"
1517
)
@@ -169,18 +171,31 @@ func (o *credentialOptions) CredentialSetOpts(dockerCli command.Cli, credentialS
169171
}
170172
}
171173

172-
type registryOptions struct {
173-
insecureRegistries []string
174-
}
175-
176-
func (o *registryOptions) addFlags(flags *pflag.FlagSet) {
177-
flags.StringSliceVar(&o.insecureRegistries, "insecure-registries", nil, "Use HTTP instead of HTTPS when pulling from/pushing to those registries")
178-
}
179-
180174
type pullOptions struct {
181175
pull bool
182176
}
183177

184178
func (o *pullOptions) addFlags(flags *pflag.FlagSet) {
185179
flags.BoolVar(&o.pull, "pull", false, "Pull the bundle")
186180
}
181+
182+
// insecureRegistriesFromEngine reads the registry configuration from the daemon and returns
183+
// a list of all insecure ones.
184+
func insecureRegistriesFromEngine(dockerCli command.Cli) ([]string, error) {
185+
registries := []string{}
186+
187+
info, err := dockerCli.Client().Info(context.Background())
188+
if err != nil {
189+
return registries, fmt.Errorf("could not get docker info: %v", err)
190+
}
191+
192+
for _, reg := range info.RegistryConfig.IndexConfigs {
193+
if !reg.Secure {
194+
registries = append(registries, reg.Name)
195+
}
196+
}
197+
198+
logrus.Debugf("insecure registries: %v", registries)
199+
200+
return registries, nil
201+
}

0 commit comments

Comments
 (0)