bb3e91
# For more information on this configuration file, see containers-registries.conf(5).
bb3e91
#
bb3e91
# NOTE: RISK OF USING UNQUALIFIED IMAGE NAMES
bb3e91
# We recommend always using fully qualified image names including the registry
bb3e91
# server (full dns name), namespace, image name, and tag
bb3e91
# (e.g., registry.redhat.io/ubi8/ubi:latest). Pulling by digest (i.e.,
bb3e91
# quay.io/repository/name@digest) further eliminates the ambiguity of tags.
bb3e91
# When using short names, there is always an inherent risk that the image being
bb3e91
# pulled could be spoofed. For example, a user wants to pull an image named
bb3e91
# `foobar` from a registry and expects it to come from myregistry.com. If
bb3e91
# myregistry.com is not first in the search list, an attacker could place a
bb3e91
# different `foobar` image at a registry earlier in the search list. The user
bb3e91
# would accidentally pull and run the attacker's image and code rather than the
bb3e91
# intended content. We recommend only adding registries which are completely
bb3e91
# trusted (i.e., registries which don't allow unknown or anonymous users to
bb3e91
# create accounts with arbitrary names). This will prevent an image from being
bb3e91
# spoofed, squatted or otherwise made insecure.  If it is necessary to use one
bb3e91
# of these registries, it should be added at the end of the list.
bb3e91
#
bb3e91
# # An array of host[:port] registries to try when pulling an unqualified image, in order.
bb3e91
bb3e91
unqualified-search-registries = ["registry.fedoraproject.org", "registry.access.redhat.com", "registry.centos.org", "quay.io", "docker.io"]
bb3e91
bb3e91
# [[registry]]
bb3e91
# # The "prefix" field is used to choose the relevant [[registry]] TOML table;
bb3e91
# # (only) the TOML table with the longest match for the input image name
bb3e91
# # (taking into account namespace/repo/tag/digest separators) is used.
bb3e91
# # 
bb3e91
# # The prefix can also be of the form: *.example.com for wildcard subdomain
bb3e91
# # matching.
bb3e91
# #
bb3e91
# # If the prefix field is missing, it defaults to be the same as the "location" field.
bb3e91
# prefix = "example.com/foo"
bb3e91
#
bb3e91
# # If true, unencrypted HTTP as well as TLS connections with untrusted
bb3e91
# # certificates are allowed.
bb3e91
# insecure = false
bb3e91
#
bb3e91
# # If true, pulling images with matching names is forbidden.
bb3e91
# blocked = false
bb3e91
#
bb3e91
# # The physical location of the "prefix"-rooted namespace.
bb3e91
# #
bb3e91
# # By default, this is equal to "prefix" (in which case "prefix" can be omitted
bb3e91
# # and the [[registry]] TOML table can only specify "location").
bb3e91
# #
bb3e91
# # Example: Given
bb3e91
# #   prefix = "example.com/foo"
bb3e91
# #   location = "internal-registry-for-example.net/bar"
bb3e91
# # requests for the image example.com/foo/myimage:latest will actually work with the
bb3e91
# # internal-registry-for-example.net/bar/myimage:latest image.
bb3e91
#
bb3e91
# # The location can be empty iff prefix is in a
bb3e91
# # wildcarded format: "*.example.com". In this case, the input reference will
bb3e91
# # be used as-is without any rewrite.
bb3e91
# location = internal-registry-for-example.com/bar"
bb3e91
#
bb3e91
# # (Possibly-partial) mirrors for the "prefix"-rooted namespace.
bb3e91
# #
bb3e91
# # The mirrors are attempted in the specified order; the first one that can be
bb3e91
# # contacted and contains the image will be used (and if none of the mirrors contains the image,
bb3e91
# # the primary location specified by the "registry.location" field, or using the unmodified
bb3e91
# # user-specified reference, is tried last).
bb3e91
# #
bb3e91
# # Each TOML table in the "mirror" array can contain the following fields, with the same semantics
bb3e91
# # as if specified in the [[registry]] TOML table directly:
bb3e91
# # - location
bb3e91
# # - insecure
bb3e91
# [[registry.mirror]]
bb3e91
# location = "example-mirror-0.local/mirror-for-foo"
bb3e91
# [[registry.mirror]]
bb3e91
# location = "example-mirror-1.local/mirrors/foo"
bb3e91
# insecure = true
bb3e91
# # Given the above, a pull of example.com/foo/image:latest will try:
bb3e91
# # 1. example-mirror-0.local/mirror-for-foo/image:latest
bb3e91
# # 2. example-mirror-1.local/mirrors/foo/image:latest
bb3e91
# # 3. internal-registry-for-example.net/bar/image:latest
bb3e91
# # in order, and use the first one that exists.
bb3e91
short-name-mode = "enforcing"