Type ID: docker_distributor_web
The Web distributor is used to publish a Docker repository in a way that can be consumed and served by Crane directly. By default the redirect files are stored as /var/lib/pulp/published/docker/v1/app/<reponame>.json and /var/lib/pulp/published/docker/v2/app/<reponame>.json for the Docker v1 and v2 content, respectively. The repo data itself is stored in /var/lib/pulp/published/docker/v1/web/<repo_id>/ and /var/lib/pulp/published/docker/v2/web/<repo_id>/.
The global configuration file for the docker_web_distributor plugin can be found in /etc/pulp/server/plugins.conf.d/docker_distributor.json.
All values from the global configuration can be overridden on the local config.
Type ID: docker_distributor_export
The export distributor is used to save the contents of a v1 publish into a tar file that can be moved easily for instances where Crane is running on a different server than your Pulp instance. By default the redirect file is stored in the root of the tar file as <reponame>.json, and the repo data itself is stored in the /<repo_id>/ sub directory of the tar file.
The global configuration file for the docker_export_distributor plugin can be found in /etc/pulp/server/plugins.conf.d/docker_distributor_export.json.
All values from the global configuration can be overridden on the local config.
For Docker v2 content, the distributors generate a json file with the details of the repository contents.
The file is JSON formatted with the following keys
type (string) - the type of file. This will always be “pulp-docker-redirect”.
this will be 3.
repository (string) - the name of the repository this file is describing.
repo-registry-id (string) - the name that will be used for this repository in the Docker registry.
url (string) - the URL for accessing the repository content.
schema2_data (array) - an array of tags and digests that schema version 2 manifests reference.
protected (bool) - whether or not the repository should be protected by an entitlement certificate.
Example Redirect File Contents:
{
"type":"pulp-docker-redirect",
"version":3,
"repository":"docker",
"repo-registry-id":"redhat/docker",
"url":"http://www.foo.com/docker",
"schema2_data":[]}
"protected": false
}
For Docker v2 content, the distributors generate a json file with the details of the repository contents.
The file is JSON formatted with the following keys
Example Redirect File Contents:
{
"type":"pulp-docker-redirect",
"version":2,
"repository":"docker",
"repo-registry-id":"redhat/docker",
"url":"http://www.foo.com/docker",
"protected": false
}
For legacy Docker v1 content, the distributors generate a json file with the details of the repository contents.
The file is JSON formatted with the following keys
Example Redirect File Contents:
{
"type":"pulp-docker-redirect",
"version":1,
"repository":"docker",
"repo-registry-id":"redhat/docker",
"url":"http://www.foo.com/docker",
"protected": false,
"images":[
{"id":"48e5f45168b97799ad0aafb7e2fef9fac57b5f16f6db7f67ba2000eb947637eb"},
{"id":"511136ea3c5a64f264b78b5433614aec563103b4d4702f3ba7d4d2698e22c158"},
{"id":"769b9341d937a3dba9e460f664b4f183a6cecdd62b337220a28b3deb50ee0a02"},
{"id":"bf747efa0e2fa9f7c691588ce3938944c75607a7bb5e757f7369f86904d97c78"}
],
"tags": {"latest": "769b9341d937a3dba9e460f664b4f183a6cecdd62b337220a28b3deb50ee0a02"}
}
The Docker rsync distributor publishes docker content to a remote server. The distributor uses rsync over ssh to perform the file transfer. Docker images (v1) are published into the root of the remote repository. Manifests (v2) are published into manifests directory and Blobs (v2) are published into blobs directory.
The docker rsync distributor makes it easier to serve docker content on one server and run Crane on another server. It is recommended that the rsync distributor is used required to publish prior to publishing with the docker web distributor.
Pulp’s SELinux policy includes a pulp_manage_rsync boolean. When enabled, the pulp_manage_rsync boolean allows Pulp to use rsync and make ssh connections. The boolean is disabled by default. The RPM Rsync distributor will fail to publish with SELinux Enforcing unless the boolean is enabled. To enable it, you can do this:
$ sudo semanage boolean --modify --on pulp_manage_rsync
Here is an example docker_rsync_distributor configuration:
{
"distributor_id": "my_docker_rsync_distributor",
"distributor_type_id": "docker_rsync_distributor",
"distributor_config": {
"remote": {
"auth_type": "publickey",
"ssh_user": "foo",
"ssh_identity_file": "/home/user/.ssh/id_rsa",
"host": "192.168.121.1",
"root": "/home/foo/pulp_root_dir"
},
"postdistributor_id": "docker_web_distributor_name_cli"
}
}
The distributor_config contains a remote section with the following settings:
Absolute path to the private key that will be used as identity file for ssh. The key must be owned by user apache and must not be readable by other users. If the POSIX permissions are too loose, the SSH application will refuse to use the key. Additionally, if SELinux is Enforcing, Pulp requires the key to be labeled with the httpd_sys_content_t SELinux context. This can be applied to the file with:
$ sudo chcon -t httpd_sys_content_t /path/to/ssh_identity_file