fix: remove obsolete comments
This commit is contained in:
Gabriel Nützi
@@ -1,79 +1,2 @@
|
||||
# For more information on this configuration file, see containers-registries.conf(5).
|
||||
#
|
||||
# NOTE: RISK OF USING UNQUALIFIED IMAGE NAMES
|
||||
# We recommend always using fully qualified image names including the registry
|
||||
# server (full dns name), namespace, image name, and tag
|
||||
# (e.g., registry.redhat.io/ubi8/ubi:latest). Pulling by digest (i.e.,
|
||||
# quay.io/repository/name@digest) further eliminates the ambiguity of tags.
|
||||
# When using short names, there is always an inherent risk that the image being
|
||||
# pulled could be spoofed. For example, a user wants to pull an image named
|
||||
# `foobar` from a registry and expects it to come from myregistry.com. If
|
||||
# myregistry.com is not first in the search list, an attacker could place a
|
||||
# different `foobar` image at a registry earlier in the search list. The user
|
||||
# would accidentally pull and run the attacker's image and code rather than the
|
||||
# intended content. We recommend only adding registries which are completely
|
||||
# trusted (i.e., registries which don't allow unknown or anonymous users to
|
||||
# create accounts with arbitrary names). This will prevent an image from being
|
||||
# spoofed, squatted or otherwise made insecure. If it is necessary to use one
|
||||
# of these registries, it should be added at the end of the list.
|
||||
#
|
||||
# # An array of host[:port] registries to try when pulling an unqualified image, in order.
|
||||
# unqualified-search-registries = ["example.com"]
|
||||
unqualified-search-registries = ["registry.fedoraproject.org", "registry.access.redhat.com", "docker.io"]
|
||||
#
|
||||
# [[registry]]
|
||||
# # The "prefix" field is used to choose the relevant [[registry]] TOML table;
|
||||
# # (only) the TOML table with the longest match for the input image name
|
||||
# # (taking into account namespace/repo/tag/digest separators) is used.
|
||||
# #
|
||||
# # The prefix can also be of the form: *.example.com for wildcard subdomain
|
||||
# # matching.
|
||||
# #
|
||||
# # If the prefix field is missing, it defaults to be the same as the "location" field.
|
||||
# prefix = "example.com/foo"
|
||||
#
|
||||
# # If true, unencrypted HTTP as well as TLS connections with untrusted
|
||||
# # certificates are allowed.
|
||||
# insecure = false
|
||||
#
|
||||
# # If true, pulling images with matching names is forbidden.
|
||||
# blocked = false
|
||||
#
|
||||
# # The physical location of the "prefix"-rooted namespace.
|
||||
# #
|
||||
# # By default, this is equal to "prefix" (in which case "prefix" can be omitted
|
||||
# # and the [[registry]] TOML table can only specify "location").
|
||||
# #
|
||||
# # Example: Given
|
||||
# # prefix = "example.com/foo"
|
||||
# # location = "internal-registry-for-example.com/bar"
|
||||
# # requests for the image example.com/foo/myimage:latest will actually work with the
|
||||
# # internal-registry-for-example.com/bar/myimage:latest image.
|
||||
#
|
||||
# # The location can be empty if prefix is in a
|
||||
# # wildcarded format: "*.example.com". In this case, the input reference will
|
||||
# # be used as-is without any rewrite.
|
||||
# location = internal-registry-for-example.com/bar"
|
||||
#
|
||||
# # (Possibly-partial) mirrors for the "prefix"-rooted namespace.
|
||||
# #
|
||||
# # The mirrors are attempted in the specified order; the first one that can be
|
||||
# # contacted and contains the image will be used (and if none of the mirrors contains the image,
|
||||
# # the primary location specified by the "registry.location" field, or using the unmodified
|
||||
# # user-specified reference, is tried last).
|
||||
# #
|
||||
# # Each TOML table in the "mirror" array can contain the following fields, with the same semantics
|
||||
# # as if specified in the [[registry]] TOML table directly:
|
||||
# # - location
|
||||
# # - insecure
|
||||
# [[registry.mirror]]
|
||||
# location = "example-mirror-0.local/mirror-for-foo"
|
||||
# [[registry.mirror]]
|
||||
# location = "example-mirror-1.local/mirrors/foo"
|
||||
# insecure = true
|
||||
# # Given the above, a pull of example.com/foo/image:latest will try:
|
||||
# # 1. example-mirror-0.local/mirror-for-foo/image:latest
|
||||
# # 2. example-mirror-1.local/mirrors/foo/image:latest
|
||||
# # 3. internal-registry-for-example.com/bar/image:latest
|
||||
# # in order, and use the first one that exists.
|
||||
short-name-mode = "enforcing"
|
||||
|
||||
-131
@@ -1,136 +1,5 @@
|
||||
[aliases]
|
||||
# almalinux
|
||||
"almalinux" = "docker.io/library/almalinux"
|
||||
"almalinux-minimal" = "docker.io/library/almalinux-minimal"
|
||||
# Amazon Linux
|
||||
"amazonlinux" = "public.ecr.aws/amazonlinux/amazonlinux"
|
||||
# Arch Linux
|
||||
"archlinux" = "docker.io/library/archlinux"
|
||||
# centos
|
||||
"centos" = "quay.io/centos/centos"
|
||||
# containers
|
||||
"skopeo" = "quay.io/skopeo/stable"
|
||||
"buildah" = "quay.io/buildah/stable"
|
||||
"podman" = "quay.io/podman/stable"
|
||||
"hello" = "quay.io/podman/hello"
|
||||
"hello-world" = "quay.io/podman/hello"
|
||||
# docker
|
||||
"alpine" = "docker.io/library/alpine"
|
||||
"docker" = "docker.io/library/docker"
|
||||
"registry" = "docker.io/library/registry"
|
||||
"swarm" = "docker.io/library/swarm"
|
||||
# Fedora
|
||||
"fedora-bootc" = "registry.fedoraproject.org/fedora-bootc"
|
||||
"fedora-minimal" = "registry.fedoraproject.org/fedora-minimal"
|
||||
"fedora" = "registry.fedoraproject.org/fedora"
|
||||
# Gentoo
|
||||
"gentoo" = "docker.io/gentoo/stage3"
|
||||
# openSUSE
|
||||
"opensuse/tumbleweed" = "registry.opensuse.org/opensuse/tumbleweed"
|
||||
"opensuse/tumbleweed-dnf" = "registry.opensuse.org/opensuse/tumbleweed-dnf"
|
||||
"opensuse/tumbleweed-microdnf" = "registry.opensuse.org/opensuse/tumbleweed-microdnf"
|
||||
"opensuse/leap" = "registry.opensuse.org/opensuse/leap"
|
||||
"opensuse/busybox" = "registry.opensuse.org/opensuse/busybox"
|
||||
"tumbleweed" = "registry.opensuse.org/opensuse/tumbleweed"
|
||||
"tumbleweed-dnf" = "registry.opensuse.org/opensuse/tumbleweed-dnf"
|
||||
"tumbleweed-microdnf" = "registry.opensuse.org/opensuse/tumbleweed-microdnf"
|
||||
"leap" = "registry.opensuse.org/opensuse/leap"
|
||||
"leap-dnf" = "registry.opensuse.org/opensuse/leap-dnf"
|
||||
"leap-microdnf" = "registry.opensuse.org/opensuse/leap-microdnf"
|
||||
"tw-busybox" = "registry.opensuse.org/opensuse/busybox"
|
||||
# SUSE
|
||||
"suse/sle15" = "registry.suse.com/suse/sle15"
|
||||
"suse/sles12sp5" = "registry.suse.com/suse/sles12sp5"
|
||||
"suse/sles12sp4" = "registry.suse.com/suse/sles12sp4"
|
||||
"suse/sles12sp3" = "registry.suse.com/suse/sles12sp3"
|
||||
"sle15" = "registry.suse.com/suse/sle15"
|
||||
"sles12sp5" = "registry.suse.com/suse/sles12sp5"
|
||||
"sles12sp4" = "registry.suse.com/suse/sles12sp4"
|
||||
"sles12sp3" = "registry.suse.com/suse/sles12sp3"
|
||||
"bci/bci-base" = "registry.suse.com/bci/bci-base"
|
||||
"bci/bci-micro" = "registry.suse.com/bci/bci-micro"
|
||||
"bci/bci-minimal" = "registry.suse.com/bci/bci-minimal"
|
||||
"bci/bci-busybox" = "registry.suse.com/bci/bci-busybox"
|
||||
# Red Hat Enterprise Linux
|
||||
"rhel" = "registry.access.redhat.com/rhel"
|
||||
"rhel6" = "registry.access.redhat.com/rhel6"
|
||||
"rhel7" = "registry.access.redhat.com/rhel7"
|
||||
"rhel7.9" = "registry.access.redhat.com/rhel7.9"
|
||||
"rhel-atomic" = "registry.access.redhat.com/rhel-atomic"
|
||||
"rhel9-bootc" = "registry.redhat.io/rhel9/rhel-bootc"
|
||||
"rhel-minimal" = "registry.access.redhat.com/rhel-minimal"
|
||||
"rhel-init" = "registry.access.redhat.com/rhel-init"
|
||||
"rhel7-atomic" = "registry.access.redhat.com/rhel7-atomic"
|
||||
"rhel7-minimal" = "registry.access.redhat.com/rhel7-minimal"
|
||||
"rhel7-init" = "registry.access.redhat.com/rhel7-init"
|
||||
"rhel7/rhel" = "registry.access.redhat.com/rhel7/rhel"
|
||||
"rhel7/rhel-atomic" = "registry.access.redhat.com/rhel7/rhel7/rhel-atomic"
|
||||
"ubi7/ubi" = "registry.access.redhat.com/ubi7/ubi"
|
||||
"ubi7/ubi-minimal" = "registry.access.redhat.com/ubi7-minimal"
|
||||
"ubi7/ubi-init" = "registry.access.redhat.com/ubi7-init"
|
||||
"ubi7" = "registry.access.redhat.com/ubi7"
|
||||
"ubi7-init" = "registry.access.redhat.com/ubi7-init"
|
||||
"ubi7-minimal" = "registry.access.redhat.com/ubi7-minimal"
|
||||
"rhel8" = "registry.access.redhat.com/ubi8"
|
||||
"rhel8-init" = "registry.access.redhat.com/ubi8-init"
|
||||
"rhel8-minimal" = "registry.access.redhat.com/ubi8-minimal"
|
||||
"rhel8-micro" = "registry.access.redhat.com/ubi8-micro"
|
||||
"ubi8" = "registry.access.redhat.com/ubi8"
|
||||
"ubi8-minimal" = "registry.access.redhat.com/ubi8-minimal"
|
||||
"ubi8-init" = "registry.access.redhat.com/ubi8-init"
|
||||
"ubi8-micro" = "registry.access.redhat.com/ubi8-micro"
|
||||
"ubi8/ubi" = "registry.access.redhat.com/ubi8/ubi"
|
||||
"ubi8/ubi-minimal" = "registry.access.redhat.com/ubi8-minimal"
|
||||
"ubi8/ubi-init" = "registry.access.redhat.com/ubi8-init"
|
||||
"ubi8/ubi-micro" = "registry.access.redhat.com/ubi8-micro"
|
||||
"ubi8/podman" = "registry.access.redhat.com/ubi8/podman"
|
||||
"ubi8/buildah" = "registry.access.redhat.com/ubi8/buildah"
|
||||
"ubi8/skopeo" = "registry.access.redhat.com/ubi8/skopeo"
|
||||
"rhel9" = "registry.access.redhat.com/ubi9"
|
||||
"rhel9-init" = "registry.access.redhat.com/ubi9-init"
|
||||
"rhel9-minimal" = "registry.access.redhat.com/ubi9-minimal"
|
||||
"rhel9-micro" = "registry.access.redhat.com/ubi9-micro"
|
||||
"ubi9" = "registry.access.redhat.com/ubi9"
|
||||
"ubi9-minimal" = "registry.access.redhat.com/ubi9-minimal"
|
||||
"ubi9-init" = "registry.access.redhat.com/ubi9-init"
|
||||
"ubi9-micro" = "registry.access.redhat.com/ubi9-micro"
|
||||
"ubi9/ubi" = "registry.access.redhat.com/ubi9/ubi"
|
||||
"ubi9/ubi-minimal" = "registry.access.redhat.com/ubi9-minimal"
|
||||
"ubi9/ubi-init" = "registry.access.redhat.com/ubi9-init"
|
||||
"ubi9/ubi-micro" = "registry.access.redhat.com/ubi9-micro"
|
||||
"ubi9/podman" = "registry.access.redhat.com/ubi9/podman"
|
||||
"ubi9/buildah" = "registry.access.redhat.com/ubi9/buildah"
|
||||
"ubi9/skopeo" = "registry.access.redhat.com/ubi9/skopeo"
|
||||
# Rocky Linux
|
||||
"rockylinux" = "docker.io/library/rockylinux"
|
||||
# Debian
|
||||
"debian" = "docker.io/library/debian"
|
||||
# Kali Linux
|
||||
"kali-bleeding-edge" = "docker.io/kalilinux/kali-bleeding-edge"
|
||||
"kali-dev" = "docker.io/kalilinux/kali-dev"
|
||||
"kali-experimental" = "docker.io/kalilinux/kali-experimental"
|
||||
"kali-last-release" = "docker.io/kalilinux/kali-last-release"
|
||||
"kali-rolling" = "docker.io/kalilinux/kali-rolling"
|
||||
# Ubuntu
|
||||
"ubuntu" = "docker.io/library/ubuntu"
|
||||
# Oracle Linux
|
||||
"oraclelinux" = "container-registry.oracle.com/os/oraclelinux"
|
||||
# busybox
|
||||
"busybox" = "docker.io/library/busybox"
|
||||
# php
|
||||
"php" = "docker.io/library/php"
|
||||
# python
|
||||
"python" = "docker.io/library/python"
|
||||
# rust
|
||||
"rust" = "docker.io/library/rust"
|
||||
# node
|
||||
"node" = "docker.io/library/node"
|
||||
# Grafana Labs
|
||||
"grafana/agent" = "docker.io/grafana/agent"
|
||||
"grafana/grafana" = "docker.io/grafana/grafana"
|
||||
"grafana/k6" = "docker.io/grafana/k6"
|
||||
"grafana/loki" = "docker.io/grafana/loki"
|
||||
"grafana/mimir" = "docker.io/grafana/mimir"
|
||||
"grafana/oncall" = "docker.io/grafana/oncall"
|
||||
"grafana/pyroscope" = "docker.io/grafana/pyroscope"
|
||||
"grafana/tempo" = "docker.io/grafana/tempo"
|
||||
|
||||
@@ -1,177 +1,15 @@
|
||||
# This file is the configuration file for all tools
|
||||
# that use the containers/storage library. The storage.conf file
|
||||
# overrides all other storage.conf files. Container engines using the
|
||||
# container/storage library do not inherit fields from other storage.conf
|
||||
# files.
|
||||
#
|
||||
# Note: The storage.conf file overrides other storage.conf files based on this precedence:
|
||||
# /usr/containers/storage.conf
|
||||
# /etc/containers/storage.conf
|
||||
# $HOME/.config/containers/storage.conf
|
||||
# $XDG_CONFIG_HOME/containers/storage.conf (If XDG_CONFIG_HOME is set)
|
||||
# See man 5 containers-storage.conf for more information
|
||||
# The "container storage" table contains all of the server options.
|
||||
[storage]
|
||||
|
||||
# Default Storage Driver, Must be set for proper operation.
|
||||
driver = "overlay"
|
||||
|
||||
# Temporary storage location
|
||||
runroot = "/run/containers/storage"
|
||||
|
||||
# Primary Read/Write location of container storage
|
||||
# When changing the graphroot location on an SELINUX system, you must
|
||||
# ensure the labeling matches the default locations labels with the
|
||||
# following commands:
|
||||
# semanage fcontext -a -e /var/lib/containers/storage /NEWSTORAGEPATH
|
||||
# restorecon -R -v /NEWSTORAGEPATH
|
||||
graphroot = "/var/lib/containers/storage"
|
||||
|
||||
# Optional alternate location of image store if a location separate from the
|
||||
# container store is required. If set, it must be different than graphroot.
|
||||
# imagestore = ""
|
||||
|
||||
|
||||
# Storage path for rootless users
|
||||
#
|
||||
# rootless_storage_path = "$HOME/.local/share/containers/storage"
|
||||
|
||||
# Transient store mode makes all container metadata be saved in temporary storage
|
||||
# (i.e. runroot above). This is faster, but doesn't persist across reboots.
|
||||
# Additional garbage collection must also be performed at boot-time, so this
|
||||
# option should remain disabled in most configurations.
|
||||
# transient_store = true
|
||||
|
||||
[storage.options]
|
||||
# Storage options to be passed to underlying storage drivers
|
||||
|
||||
# AdditionalImageStores is used to pass paths to additional Read/Only image stores
|
||||
# Must be comma separated list.
|
||||
additionalimagestores = [
|
||||
"/var/lib/shared",
|
||||
"/usr/lib/containers/storage",
|
||||
]
|
||||
|
||||
# Allows specification of how storage is populated when pulling images. This
|
||||
# option can speed the pulling process of images compressed with format
|
||||
# zstd:chunked. Containers/storage looks for files within images that are being
|
||||
# pulled from a container registry that were previously pulled to the host. It
|
||||
# can copy or create a hard link to the existing file when it finds them,
|
||||
# eliminating the need to pull them from the container registry. These options
|
||||
# can deduplicate pulling of content, disk storage of content and can allow the
|
||||
# kernel to use less memory when running containers.
|
||||
|
||||
# containers/storage supports four keys
|
||||
# * enable_partial_images="true" | "false"
|
||||
# Tells containers/storage to look for files previously pulled in storage
|
||||
# rather then always pulling them from the container registry.
|
||||
# * use_hard_links = "false" | "true"
|
||||
# Tells containers/storage to use hard links rather then create new files in
|
||||
# the image, if an identical file already existed in storage.
|
||||
# * ostree_repos = ""
|
||||
# Tells containers/storage where an ostree repository exists that might have
|
||||
# previously pulled content which can be used when attempting to avoid
|
||||
# pulling content from the container registry
|
||||
# * convert_images = "false" | "true"
|
||||
# If set to true, containers/storage will convert images to a
|
||||
# format compatible with partial pulls in order to take advantage
|
||||
# of local deduplication and hard linking. It is an expensive
|
||||
# operation so it is not enabled by default.
|
||||
pull_options = {enable_partial_images = "true", use_hard_links = "false", ostree_repos=""}
|
||||
|
||||
# Remap-UIDs/GIDs is the mapping from UIDs/GIDs as they should appear inside of
|
||||
# a container, to the UIDs/GIDs as they should appear outside of the container,
|
||||
# and the length of the range of UIDs/GIDs. Additional mapped sets can be
|
||||
# listed and will be heeded by libraries, but there are limits to the number of
|
||||
# mappings which the kernel will allow when you later attempt to run a
|
||||
# container.
|
||||
#
|
||||
# remap-uids = "0:1668442479:65536"
|
||||
# remap-gids = "0:1668442479:65536"
|
||||
|
||||
# Remap-User/Group is a user name which can be used to look up one or more UID/GID
|
||||
# ranges in the /etc/subuid or /etc/subgid file. Mappings are set up starting
|
||||
# with an in-container ID of 0 and then a host-level ID taken from the lowest
|
||||
# range that matches the specified name, and using the length of that range.
|
||||
# Additional ranges are then assigned, using the ranges which specify the
|
||||
# lowest host-level IDs first, to the lowest not-yet-mapped in-container ID,
|
||||
# until all of the entries have been used for maps. This setting overrides the
|
||||
# Remap-UIDs/GIDs setting.
|
||||
#
|
||||
# remap-user = "containers"
|
||||
# remap-group = "containers"
|
||||
|
||||
# Root-auto-userns-user is a user name which can be used to look up one or more UID/GID
|
||||
# ranges in the /etc/subuid and /etc/subgid file. These ranges will be partitioned
|
||||
# to containers configured to create automatically a user namespace. Containers
|
||||
# configured to automatically create a user namespace can still overlap with containers
|
||||
# having an explicit mapping set.
|
||||
# This setting is ignored when running as rootless.
|
||||
# root-auto-userns-user = "storage"
|
||||
#
|
||||
# Auto-userns-min-size is the minimum size for a user namespace created automatically.
|
||||
# auto-userns-min-size=1024
|
||||
#
|
||||
# Auto-userns-max-size is the maximum size for a user namespace created automatically.
|
||||
# auto-userns-max-size=65536
|
||||
|
||||
[storage.options.overlay]
|
||||
# ignore_chown_errors can be set to allow a non privileged user running with
|
||||
# a single UID within a user namespace to run containers. The user can pull
|
||||
# and use any image even those with multiple uids. Note multiple UIDs will be
|
||||
# squashed down to the default uid in the container. These images will have no
|
||||
# separation between the users in the container. Only supported for the overlay
|
||||
# and vfs drivers.
|
||||
#ignore_chown_errors = "false"
|
||||
|
||||
# Inodes is used to set a maximum inodes of the container image.
|
||||
# inodes = ""
|
||||
|
||||
# Path to an helper program to use for mounting the file system instead of mounting it
|
||||
# directly.
|
||||
mount_program = "/usr/bin/fuse-overlayfs"
|
||||
|
||||
# mountopt specifies comma separated list of extra mount options
|
||||
mountopt = "nodev,fsync=0"
|
||||
|
||||
# Set to skip a PRIVATE bind mount on the storage home directory.
|
||||
# skip_mount_home = "false"
|
||||
|
||||
# Set to use composefs to mount data layers with overlay.
|
||||
# use_composefs = "false"
|
||||
|
||||
# Size is used to set a maximum size of the container image.
|
||||
# size = ""
|
||||
|
||||
# ForceMask specifies the permissions mask that is used for new files and
|
||||
# directories.
|
||||
#
|
||||
# The values "shared" and "private" are accepted.
|
||||
# Octal permission masks are also accepted.
|
||||
#
|
||||
# "": No value specified.
|
||||
# All files/directories, get set with the permissions identified within the
|
||||
# image.
|
||||
# "private": it is equivalent to 0700.
|
||||
# All files/directories get set with 0700 permissions. The owner has rwx
|
||||
# access to the files. No other users on the system can access the files.
|
||||
# This setting could be used with networked based homedirs.
|
||||
# "shared": it is equivalent to 0755.
|
||||
# The owner has rwx access to the files and everyone else can read, access
|
||||
# and execute them. This setting is useful for sharing containers storage
|
||||
# with other users. For instance have a storage owned by root but shared
|
||||
# to rootless users as an additional store.
|
||||
# NOTE: All files within the image are made readable and executable by any
|
||||
# user on the system. Even /etc/shadow within your image is now readable by
|
||||
# any user.
|
||||
#
|
||||
# OCTAL: Users can experiment with other OCTAL Permissions.
|
||||
#
|
||||
# Note: The force_mask Flag is an experimental feature, it could change in the
|
||||
# future. When "force_mask" is set the original permission mask is stored in
|
||||
# the "user.containers.override_stat" xattr and the "mount_program" option must
|
||||
# be specified. Mount programs like "/usr/bin/fuse-overlayfs" present the
|
||||
# extended attribute permissions to processes within containers rather than the
|
||||
# "force_mask" permissions.
|
||||
#
|
||||
# force_mask = ""
|
||||
|
||||
Reference in New Issue
Block a user