liquidmetal-dev / liquidmetal-dev/flintlock

Cannot pull images from a private registry

Open
#482 8 comments 0 reactions 0 assignees View on GitHub
area/security help wanted kind/bug priority/critical-urgent
Dominant language
Go
Stars
1.5k
Forks
73
Avg merge
17h 24m
Merged PRs (30d)
30

Description

**What happened:**
I am trying to pull an image from a private registry for use as the root volume. I am using this command:

```bash
fl microvm create --host 127.0.0.1:9090 --name fctest --metadata-hostname fctest --network-interface eth1:tap --metadata-ssh-key-file ~/.ssh/id_ed25519.pub --memory 4096 --root-image ghcr.io/richardcase/private-images/flintlock-ubuntu-perftest:7a248f6 --vcpu 2
```

The `ghcr.io/richardcase/private-images/flintlock-ubuntu-perftest:7a248f6` image is in a private package in GitHub. It requires a PAT with `repo:read` to get this.

Currently, there is no way to supply credentials and it was assumed we could supply this using the CRI section of the containerd config file like this:

```toml
[plugins."io.containerd.grpc.v1.cri".registry]
[plugins."io.containerd.grpc.v1.cri".registry.configs]
[plugins."io.containerd.grpc.v1.cri".registry.configs."ghcr.io".auth]
username = "YYYYYYYYYYY"
password = "XXXXXXXXX"
```

However, this does not work as we aren't using the CRI.....doh!

**What did you expect to happen:**
I would expect there to be a way to supply credentials so that i can use a image from a private registry

**How to reproduce it:**
Try and use a privat eimage using the `fl` command shown above

**Anything else you would like to add:**
This came via the community slack from Cory & Paul.

Paul suggested that we need to include a resolver here: https://github.com/weaveworks-liquidmetal/flintlock/blob/main/infrastructure/containerd/image_service.go#L146

**Environment:**

- flintlock version: v0.1.1
- containerd version: 1.5.9

Contributor guide

Open the contributing guide

Research direction

Start with infrastructure/containerd/image_service.go around line 146 and reproduce the private-image pull using the `fl microvm create` command in the issue. Trace how the image resolver is configured and determine how registry credentials can be supplied. Done means the command can pull the specified private GHCR image with credentials while preserving public-image pulls.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
infrastructure
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.