diff --git a/nixos/tests/gitlab/runner/podman-runner/root/etc/containers/registries.conf b/nixos/tests/gitlab/runner/podman-runner/root/etc/containers/registries.conf index bfe0335521df..c3a575800d86 100644 --- a/nixos/tests/gitlab/runner/podman-runner/root/etc/containers/registries.conf +++ b/nixos/tests/gitlab/runner/podman-runner/root/etc/containers/registries.conf @@ -1,79 +1,2 @@ -# For more information on this configuration file, see containers-registries.conf(5). -# -# NOTE: RISK OF USING UNQUALIFIED IMAGE NAMES -# We recommend always using fully qualified image names including the registry -# server (full dns name), namespace, image name, and tag -# (e.g., registry.redhat.io/ubi8/ubi:latest). Pulling by digest (i.e., -# quay.io/repository/name@digest) further eliminates the ambiguity of tags. -# When using short names, there is always an inherent risk that the image being -# pulled could be spoofed. For example, a user wants to pull an image named -# `foobar` from a registry and expects it to come from myregistry.com. If -# myregistry.com is not first in the search list, an attacker could place a -# different `foobar` image at a registry earlier in the search list. The user -# would accidentally pull and run the attacker's image and code rather than the -# intended content. We recommend only adding registries which are completely -# trusted (i.e., registries which don't allow unknown or anonymous users to -# create accounts with arbitrary names). This will prevent an image from being -# spoofed, squatted or otherwise made insecure. If it is necessary to use one -# of these registries, it should be added at the end of the list. -# -# # An array of host[:port] registries to try when pulling an unqualified image, in order. -# unqualified-search-registries = ["example.com"] unqualified-search-registries = ["registry.fedoraproject.org", "registry.access.redhat.com", "docker.io"] -# -# [[registry]] -# # The "prefix" field is used to choose the relevant [[registry]] TOML table; -# # (only) the TOML table with the longest match for the input image name -# # (taking into account namespace/repo/tag/digest separators) is used. -# # -# # The prefix can also be of the form: *.example.com for wildcard subdomain -# # matching. -# # -# # If the prefix field is missing, it defaults to be the same as the "location" field. -# prefix = "example.com/foo" -# -# # If true, unencrypted HTTP as well as TLS connections with untrusted -# # certificates are allowed. -# insecure = false -# -# # If true, pulling images with matching names is forbidden. -# blocked = false -# -# # The physical location of the "prefix"-rooted namespace. -# # -# # By default, this is equal to "prefix" (in which case "prefix" can be omitted -# # and the [[registry]] TOML table can only specify "location"). -# # -# # Example: Given -# # prefix = "example.com/foo" -# # location = "internal-registry-for-example.com/bar" -# # requests for the image example.com/foo/myimage:latest will actually work with the -# # internal-registry-for-example.com/bar/myimage:latest image. -# -# # The location can be empty if prefix is in a -# # wildcarded format: "*.example.com". In this case, the input reference will -# # be used as-is without any rewrite. -# location = internal-registry-for-example.com/bar" -# -# # (Possibly-partial) mirrors for the "prefix"-rooted namespace. -# # -# # The mirrors are attempted in the specified order; the first one that can be -# # contacted and contains the image will be used (and if none of the mirrors contains the image, -# # the primary location specified by the "registry.location" field, or using the unmodified -# # user-specified reference, is tried last). -# # -# # Each TOML table in the "mirror" array can contain the following fields, with the same semantics -# # as if specified in the [[registry]] TOML table directly: -# # - location -# # - insecure -# [[registry.mirror]] -# location = "example-mirror-0.local/mirror-for-foo" -# [[registry.mirror]] -# location = "example-mirror-1.local/mirrors/foo" -# insecure = true -# # Given the above, a pull of example.com/foo/image:latest will try: -# # 1. example-mirror-0.local/mirror-for-foo/image:latest -# # 2. example-mirror-1.local/mirrors/foo/image:latest -# # 3. internal-registry-for-example.com/bar/image:latest -# # in order, and use the first one that exists. short-name-mode = "enforcing" diff --git a/nixos/tests/gitlab/runner/podman-runner/root/etc/containers/registries.conf.d/000-shortnames.conf b/nixos/tests/gitlab/runner/podman-runner/root/etc/containers/registries.conf.d/000-shortnames.conf index 45fbe17958da..142e6158235c 100644 --- a/nixos/tests/gitlab/runner/podman-runner/root/etc/containers/registries.conf.d/000-shortnames.conf +++ b/nixos/tests/gitlab/runner/podman-runner/root/etc/containers/registries.conf.d/000-shortnames.conf @@ -1,136 +1,5 @@ [aliases] - # almalinux - "almalinux" = "docker.io/library/almalinux" - "almalinux-minimal" = "docker.io/library/almalinux-minimal" - # Amazon Linux - "amazonlinux" = "public.ecr.aws/amazonlinux/amazonlinux" - # Arch Linux - "archlinux" = "docker.io/library/archlinux" - # centos - "centos" = "quay.io/centos/centos" - # containers - "skopeo" = "quay.io/skopeo/stable" "buildah" = "quay.io/buildah/stable" "podman" = "quay.io/podman/stable" - "hello" = "quay.io/podman/hello" - "hello-world" = "quay.io/podman/hello" - # docker "alpine" = "docker.io/library/alpine" - "docker" = "docker.io/library/docker" - "registry" = "docker.io/library/registry" - "swarm" = "docker.io/library/swarm" - # Fedora - "fedora-bootc" = "registry.fedoraproject.org/fedora-bootc" - "fedora-minimal" = "registry.fedoraproject.org/fedora-minimal" - "fedora" = "registry.fedoraproject.org/fedora" - # Gentoo - "gentoo" = "docker.io/gentoo/stage3" - # openSUSE - "opensuse/tumbleweed" = "registry.opensuse.org/opensuse/tumbleweed" - "opensuse/tumbleweed-dnf" = "registry.opensuse.org/opensuse/tumbleweed-dnf" - "opensuse/tumbleweed-microdnf" = "registry.opensuse.org/opensuse/tumbleweed-microdnf" - "opensuse/leap" = "registry.opensuse.org/opensuse/leap" - "opensuse/busybox" = "registry.opensuse.org/opensuse/busybox" - "tumbleweed" = "registry.opensuse.org/opensuse/tumbleweed" - "tumbleweed-dnf" = "registry.opensuse.org/opensuse/tumbleweed-dnf" - "tumbleweed-microdnf" = "registry.opensuse.org/opensuse/tumbleweed-microdnf" - "leap" = "registry.opensuse.org/opensuse/leap" - "leap-dnf" = "registry.opensuse.org/opensuse/leap-dnf" - "leap-microdnf" = "registry.opensuse.org/opensuse/leap-microdnf" - "tw-busybox" = "registry.opensuse.org/opensuse/busybox" - # SUSE - "suse/sle15" = "registry.suse.com/suse/sle15" - "suse/sles12sp5" = "registry.suse.com/suse/sles12sp5" - "suse/sles12sp4" = "registry.suse.com/suse/sles12sp4" - "suse/sles12sp3" = "registry.suse.com/suse/sles12sp3" - "sle15" = "registry.suse.com/suse/sle15" - "sles12sp5" = "registry.suse.com/suse/sles12sp5" - "sles12sp4" = "registry.suse.com/suse/sles12sp4" - "sles12sp3" = "registry.suse.com/suse/sles12sp3" - "bci/bci-base" = "registry.suse.com/bci/bci-base" - "bci/bci-micro" = "registry.suse.com/bci/bci-micro" - "bci/bci-minimal" = "registry.suse.com/bci/bci-minimal" - "bci/bci-busybox" = "registry.suse.com/bci/bci-busybox" - # Red Hat Enterprise Linux - "rhel" = "registry.access.redhat.com/rhel" - "rhel6" = "registry.access.redhat.com/rhel6" - "rhel7" = "registry.access.redhat.com/rhel7" - "rhel7.9" = "registry.access.redhat.com/rhel7.9" - "rhel-atomic" = "registry.access.redhat.com/rhel-atomic" - "rhel9-bootc" = "registry.redhat.io/rhel9/rhel-bootc" - "rhel-minimal" = "registry.access.redhat.com/rhel-minimal" - "rhel-init" = "registry.access.redhat.com/rhel-init" - "rhel7-atomic" = "registry.access.redhat.com/rhel7-atomic" - "rhel7-minimal" = "registry.access.redhat.com/rhel7-minimal" - "rhel7-init" = "registry.access.redhat.com/rhel7-init" - "rhel7/rhel" = "registry.access.redhat.com/rhel7/rhel" - "rhel7/rhel-atomic" = "registry.access.redhat.com/rhel7/rhel7/rhel-atomic" - "ubi7/ubi" = "registry.access.redhat.com/ubi7/ubi" - "ubi7/ubi-minimal" = "registry.access.redhat.com/ubi7-minimal" - "ubi7/ubi-init" = "registry.access.redhat.com/ubi7-init" - "ubi7" = "registry.access.redhat.com/ubi7" - "ubi7-init" = "registry.access.redhat.com/ubi7-init" - "ubi7-minimal" = "registry.access.redhat.com/ubi7-minimal" - "rhel8" = "registry.access.redhat.com/ubi8" - "rhel8-init" = "registry.access.redhat.com/ubi8-init" - "rhel8-minimal" = "registry.access.redhat.com/ubi8-minimal" - "rhel8-micro" = "registry.access.redhat.com/ubi8-micro" - "ubi8" = "registry.access.redhat.com/ubi8" - "ubi8-minimal" = "registry.access.redhat.com/ubi8-minimal" - "ubi8-init" = "registry.access.redhat.com/ubi8-init" - "ubi8-micro" = "registry.access.redhat.com/ubi8-micro" - "ubi8/ubi" = "registry.access.redhat.com/ubi8/ubi" - "ubi8/ubi-minimal" = "registry.access.redhat.com/ubi8-minimal" - "ubi8/ubi-init" = "registry.access.redhat.com/ubi8-init" - "ubi8/ubi-micro" = "registry.access.redhat.com/ubi8-micro" - "ubi8/podman" = "registry.access.redhat.com/ubi8/podman" - "ubi8/buildah" = "registry.access.redhat.com/ubi8/buildah" - "ubi8/skopeo" = "registry.access.redhat.com/ubi8/skopeo" - "rhel9" = "registry.access.redhat.com/ubi9" - "rhel9-init" = "registry.access.redhat.com/ubi9-init" - "rhel9-minimal" = "registry.access.redhat.com/ubi9-minimal" - "rhel9-micro" = "registry.access.redhat.com/ubi9-micro" - "ubi9" = "registry.access.redhat.com/ubi9" - "ubi9-minimal" = "registry.access.redhat.com/ubi9-minimal" - "ubi9-init" = "registry.access.redhat.com/ubi9-init" - "ubi9-micro" = "registry.access.redhat.com/ubi9-micro" - "ubi9/ubi" = "registry.access.redhat.com/ubi9/ubi" - "ubi9/ubi-minimal" = "registry.access.redhat.com/ubi9-minimal" - "ubi9/ubi-init" = "registry.access.redhat.com/ubi9-init" - "ubi9/ubi-micro" = "registry.access.redhat.com/ubi9-micro" - "ubi9/podman" = "registry.access.redhat.com/ubi9/podman" - "ubi9/buildah" = "registry.access.redhat.com/ubi9/buildah" - "ubi9/skopeo" = "registry.access.redhat.com/ubi9/skopeo" - # Rocky Linux - "rockylinux" = "docker.io/library/rockylinux" - # Debian - "debian" = "docker.io/library/debian" - # Kali Linux - "kali-bleeding-edge" = "docker.io/kalilinux/kali-bleeding-edge" - "kali-dev" = "docker.io/kalilinux/kali-dev" - "kali-experimental" = "docker.io/kalilinux/kali-experimental" - "kali-last-release" = "docker.io/kalilinux/kali-last-release" - "kali-rolling" = "docker.io/kalilinux/kali-rolling" - # Ubuntu "ubuntu" = "docker.io/library/ubuntu" - # Oracle Linux - "oraclelinux" = "container-registry.oracle.com/os/oraclelinux" - # busybox - "busybox" = "docker.io/library/busybox" - # php - "php" = "docker.io/library/php" - # python - "python" = "docker.io/library/python" - # rust - "rust" = "docker.io/library/rust" - # node - "node" = "docker.io/library/node" - # Grafana Labs - "grafana/agent" = "docker.io/grafana/agent" - "grafana/grafana" = "docker.io/grafana/grafana" - "grafana/k6" = "docker.io/grafana/k6" - "grafana/loki" = "docker.io/grafana/loki" - "grafana/mimir" = "docker.io/grafana/mimir" - "grafana/oncall" = "docker.io/grafana/oncall" - "grafana/pyroscope" = "docker.io/grafana/pyroscope" - "grafana/tempo" = "docker.io/grafana/tempo" diff --git a/nixos/tests/gitlab/runner/podman-runner/root/etc/containers/storage.conf b/nixos/tests/gitlab/runner/podman-runner/root/etc/containers/storage.conf index 99a4ac7b1783..9db50278d80b 100644 --- a/nixos/tests/gitlab/runner/podman-runner/root/etc/containers/storage.conf +++ b/nixos/tests/gitlab/runner/podman-runner/root/etc/containers/storage.conf @@ -1,177 +1,15 @@ -# This file is the configuration file for all tools -# that use the containers/storage library. The storage.conf file -# overrides all other storage.conf files. Container engines using the -# container/storage library do not inherit fields from other storage.conf -# files. -# -# Note: The storage.conf file overrides other storage.conf files based on this precedence: -# /usr/containers/storage.conf -# /etc/containers/storage.conf -# $HOME/.config/containers/storage.conf -# $XDG_CONFIG_HOME/containers/storage.conf (If XDG_CONFIG_HOME is set) -# See man 5 containers-storage.conf for more information -# The "container storage" table contains all of the server options. [storage] - -# Default Storage Driver, Must be set for proper operation. driver = "overlay" - -# Temporary storage location runroot = "/run/containers/storage" - -# Primary Read/Write location of container storage -# When changing the graphroot location on an SELINUX system, you must -# ensure the labeling matches the default locations labels with the -# following commands: -# semanage fcontext -a -e /var/lib/containers/storage /NEWSTORAGEPATH -# restorecon -R -v /NEWSTORAGEPATH graphroot = "/var/lib/containers/storage" -# Optional alternate location of image store if a location separate from the -# container store is required. If set, it must be different than graphroot. -# imagestore = "" - - -# Storage path for rootless users -# -# rootless_storage_path = "$HOME/.local/share/containers/storage" - -# Transient store mode makes all container metadata be saved in temporary storage -# (i.e. runroot above). This is faster, but doesn't persist across reboots. -# Additional garbage collection must also be performed at boot-time, so this -# option should remain disabled in most configurations. -# transient_store = true - [storage.options] -# Storage options to be passed to underlying storage drivers - -# AdditionalImageStores is used to pass paths to additional Read/Only image stores -# Must be comma separated list. additionalimagestores = [ "/var/lib/shared", "/usr/lib/containers/storage", ] - -# Allows specification of how storage is populated when pulling images. This -# option can speed the pulling process of images compressed with format -# zstd:chunked. Containers/storage looks for files within images that are being -# pulled from a container registry that were previously pulled to the host. It -# can copy or create a hard link to the existing file when it finds them, -# eliminating the need to pull them from the container registry. These options -# can deduplicate pulling of content, disk storage of content and can allow the -# kernel to use less memory when running containers. - -# containers/storage supports four keys -# * enable_partial_images="true" | "false" -# Tells containers/storage to look for files previously pulled in storage -# rather then always pulling them from the container registry. -# * use_hard_links = "false" | "true" -# Tells containers/storage to use hard links rather then create new files in -# the image, if an identical file already existed in storage. -# * ostree_repos = "" -# Tells containers/storage where an ostree repository exists that might have -# previously pulled content which can be used when attempting to avoid -# pulling content from the container registry -# * convert_images = "false" | "true" -# If set to true, containers/storage will convert images to a -# format compatible with partial pulls in order to take advantage -# of local deduplication and hard linking. It is an expensive -# operation so it is not enabled by default. pull_options = {enable_partial_images = "true", use_hard_links = "false", ostree_repos=""} -# Remap-UIDs/GIDs is the mapping from UIDs/GIDs as they should appear inside of -# a container, to the UIDs/GIDs as they should appear outside of the container, -# and the length of the range of UIDs/GIDs. Additional mapped sets can be -# listed and will be heeded by libraries, but there are limits to the number of -# mappings which the kernel will allow when you later attempt to run a -# container. -# -# remap-uids = "0:1668442479:65536" -# remap-gids = "0:1668442479:65536" - -# Remap-User/Group is a user name which can be used to look up one or more UID/GID -# ranges in the /etc/subuid or /etc/subgid file. Mappings are set up starting -# with an in-container ID of 0 and then a host-level ID taken from the lowest -# range that matches the specified name, and using the length of that range. -# Additional ranges are then assigned, using the ranges which specify the -# lowest host-level IDs first, to the lowest not-yet-mapped in-container ID, -# until all of the entries have been used for maps. This setting overrides the -# Remap-UIDs/GIDs setting. -# -# remap-user = "containers" -# remap-group = "containers" - -# Root-auto-userns-user is a user name which can be used to look up one or more UID/GID -# ranges in the /etc/subuid and /etc/subgid file. These ranges will be partitioned -# to containers configured to create automatically a user namespace. Containers -# configured to automatically create a user namespace can still overlap with containers -# having an explicit mapping set. -# This setting is ignored when running as rootless. -# root-auto-userns-user = "storage" -# -# Auto-userns-min-size is the minimum size for a user namespace created automatically. -# auto-userns-min-size=1024 -# -# Auto-userns-max-size is the maximum size for a user namespace created automatically. -# auto-userns-max-size=65536 - [storage.options.overlay] -# ignore_chown_errors can be set to allow a non privileged user running with -# a single UID within a user namespace to run containers. The user can pull -# and use any image even those with multiple uids. Note multiple UIDs will be -# squashed down to the default uid in the container. These images will have no -# separation between the users in the container. Only supported for the overlay -# and vfs drivers. -#ignore_chown_errors = "false" - -# Inodes is used to set a maximum inodes of the container image. -# inodes = "" - -# Path to an helper program to use for mounting the file system instead of mounting it -# directly. mount_program = "/usr/bin/fuse-overlayfs" - -# mountopt specifies comma separated list of extra mount options mountopt = "nodev,fsync=0" - -# Set to skip a PRIVATE bind mount on the storage home directory. -# skip_mount_home = "false" - -# Set to use composefs to mount data layers with overlay. -# use_composefs = "false" - -# Size is used to set a maximum size of the container image. -# size = "" - -# ForceMask specifies the permissions mask that is used for new files and -# directories. -# -# The values "shared" and "private" are accepted. -# Octal permission masks are also accepted. -# -# "": No value specified. -# All files/directories, get set with the permissions identified within the -# image. -# "private": it is equivalent to 0700. -# All files/directories get set with 0700 permissions. The owner has rwx -# access to the files. No other users on the system can access the files. -# This setting could be used with networked based homedirs. -# "shared": it is equivalent to 0755. -# The owner has rwx access to the files and everyone else can read, access -# and execute them. This setting is useful for sharing containers storage -# with other users. For instance have a storage owned by root but shared -# to rootless users as an additional store. -# NOTE: All files within the image are made readable and executable by any -# user on the system. Even /etc/shadow within your image is now readable by -# any user. -# -# OCTAL: Users can experiment with other OCTAL Permissions. -# -# Note: The force_mask Flag is an experimental feature, it could change in the -# future. When "force_mask" is set the original permission mask is stored in -# the "user.containers.override_stat" xattr and the "mount_program" option must -# be specified. Mount programs like "/usr/bin/fuse-overlayfs" present the -# extended attribute permissions to processes within containers rather than the -# "force_mask" permissions. -# -# force_mask = ""