0
Fork 0
mirror of https://github.com/project-zot/zot.git synced 2024-12-16 21:56:37 -05:00
zot - A scale-out production-ready vendor-neutral OCI-native container image/artifact registry (purely based on OCI Distribution Specification)
Find a file
Petu Eusebiu f89925fb27 sync: periodically retry if on-demand fails inline, closes #281
sync: don't return error on sync signatures, just skip them, closes #375
sync: sync signatures on demand
sync on demand: in case of parallel requests pull image just once, closes #344

Signed-off-by: Petu Eusebiu <peusebiu@cisco.com>
2022-02-07 09:04:13 -08:00
.github bench: fix benchmark test data 2022-02-02 13:31:41 -08:00
cmd bench: fix benchmark test data 2022-02-02 13:31:41 -08:00
docs swagger: rename 'docs/' to 'swagger/' 2021-10-21 13:46:14 -07:00
errors sync: for a prefix, allow multiple registries as a list instead of only one, closes #343 2022-02-01 09:45:09 -08:00
examples sync: periodically retry if on-demand fails inline, closes #281 2022-02-07 09:04:13 -08:00
pkg sync: periodically retry if on-demand fails inline, closes #281 2022-02-07 09:04:13 -08:00
swagger move references to zotregistry.io and project-zot 2021-12-05 10:52:27 -08:00
test/scripts storage: improve/fix oci image validation 2022-02-02 13:31:41 -08:00
.gitignore Implement an API for performance monitoring 2021-11-12 11:14:10 -08:00
CODE_OF_CONDUCT.md doc: add a CODE_OF_CONDUCT.md 2020-12-15 11:20:45 -08:00
codecov.yml perf: add a 'zb' binary for perf testing of dist-spec registries 2022-01-13 10:11:08 -08:00
COMPARISON.md move references to zotregistry.io and project-zot 2021-12-05 10:52:27 -08:00
CONTRIBUTING.md Renamed zot-exporter to zxp and added its image to zot release 2022-01-19 10:31:37 -08:00
Dockerfile ci/cd: upgrade golang to 1.17 2022-01-07 09:46:50 -08:00
Dockerfile-arch ci/cd: upgrade golang to 1.17 2022-01-07 09:46:50 -08:00
Dockerfile-arch-minimal ci/cd: upgrade golang to 1.17 2022-01-07 09:46:50 -08:00
Dockerfile-arch-zb bench: fix benchmark test data 2022-02-02 13:31:41 -08:00
Dockerfile-arch-zxp Renamed zot-exporter to zxp and added its image to zot release 2022-01-19 10:31:37 -08:00
Dockerfile-conformance ci/cd: upgrade golang to 1.17 2022-01-07 09:46:50 -08:00
Dockerfile-minimal ci/cd: upgrade golang to 1.17 2022-01-07 09:46:50 -08:00
Dockerfile-zb bench: fix benchmark test data 2022-02-02 13:31:41 -08:00
Dockerfile-zxp Renamed zot-exporter to zxp and added its image to zot release 2022-01-19 10:31:37 -08:00
go.mod controller: support rate-limiting incoming requests 2022-01-24 12:48:13 -08:00
go.sum controller: support rate-limiting incoming requests 2022-01-24 12:48:13 -08:00
golangcilint.yaml go.mod: fix GHSA-mvff-h3cj-wj9c 2022-01-07 00:07:10 -08:00
LICENSE Initial commit 2019-06-21 14:40:59 -07:00
MAINTAINERS.md doc: update current project maintainer list 2020-12-10 17:36:22 -08:00
Makefile ci/cd: add a license checker 2022-01-30 12:04:49 -08:00
README.md Remove sync http handler, not needed anymore since added sync on demand 2022-01-25 09:18:23 -08:00
stacker.yaml ci/cd: upgrade golang to 1.17 2022-01-07 09:46:50 -08:00
THIRD-PARTY-LICENSES.md update go.mod 2022-01-24 09:15:46 -08:00
zot.go zot: initial commit 2019-06-21 15:29:19 -07:00

zot build-test codecov.io Conformance Results CodeQL

zot is a vendor-neutral OCI image registry server purely based on OCI Distribution Specification.

https://zotregistry.io

docker pull ghcr.io/project-zot/zot:latest

docker run -p 5000:5000 ghcr.io/project-zot/zot:latest

Why zot?

Features

  • Conforms to OCI distribution spec APIs
  • Clear separation between core dist-spec and zot-specific extensions
    • make binary-minimal builds a dist-spec-only zot
    • make binary builds a zot with all extensions enabled
  • Uses OCI image layout for image storage
    • Can serve any OCI image layout as a registry
  • Supports container image signatures - cosign and notation
  • Supports helm charts
  • Behavior controlled via configuration
  • Supports amd64 (Intel, AMD, etc) and arm64 (ARM servers, Raspberry PI 4, etc) architectures
  • Supports image deletion by tag
  • Currently suitable for on-prem deployments (e.g. colocated with Kubernetes)
  • Compatible with ecosystem tools such as skopeo and cri-o
  • Vulnerability scanning of images
  • Command-line client support
  • TLS support
  • Authentication via:
    • TLS mutual authentication
    • HTTP Basic (local htpasswd and LDAP)
    • HTTP Bearer token
  • Supports Identity-Based Access Control
  • Supports live modifications on the config file while zot is running (Authorization config only)
  • Doesn't require root privileges
  • Storage optimizations:
    • Automatic garbage collection of orphaned blobs
    • Layer deduplication using hard links when content is identical
  • Serve multiple storage paths (and backends) using a single zot server
  • Pull and synchronize from other dist-spec conformant registries sync
  • Supports ratelimiting including per HTTP method
  • Swagger based documentation
  • Single binary for all the above features
  • Released under Apache 2.0 License
  • Metrics with Prometheus
    • Using a node exporter in case of dist-spec-only zot
  • go get -u github.com/project-zot/zot/cmd/zot

Presentations

Build and install binary (using host's toolchain)

go get -u github.com/project-zot/zot/cmd/zot

Full CI/CD Build

  • Build inside a container (preferred)
make binary-container
  • Alternatively, build inside a container using stacker (preferred)
make binary-stacker
  • Build using host's toolchain
make

Build artifacts are in bin/

Serving

bin/zot serve _config-file_

Examples of config files are available in examples/ dir.

Container Image

The Dockerfile in this repo can be used to build a container image that runs zot.

To build the image with ref zot:latest:

make image

Then run the image with your preferred container runtime:

# with podman
podman run --rm -it -p 5000:5000 -v $(pwd)/registry:/var/lib/registry zot:latest

# with docker
docker run --rm -it -p 5000:5000 -v $(pwd)/registry:/var/lib/registry zot:latest

This will run a registry at http://localhost:5000, storing content at ./registry (bind mounted to /var/lib/registry in the container). By default, auth is disabled.

If you wish use custom configuration settings, you can override the YAML config file located at /etc/zot/config.yml:

# Example: using a local file "custom-config.yml" that
# listens on port 8080 and uses /tmp/zot for storage root
podman run --rm -p 8080:8080 \
  -v $(pwd)/custom-config.yml:/etc/zot/config.yml \
  -v $(pwd)/registry:/tmp/zot \
  zot:latest

CLI

The same zot binary can be used for interacting with any zot server instances.

Adding a zot server URL

To add a zot server URL with an alias "remote-zot":

$ zot config add remote-zot https://server-example:8080

List all configured URLs with their aliases:

$ zot config -l
remote-zot https://server-example:8080
local      http://localhost:8080

Listing images

You can list all images from a server by using its alias specified in this step:

$ zot images remote-zot
IMAGE NAME                        TAG                       DIGEST    SIZE
postgres                          9.6.18-alpine             ef27f3e1  14.4MB
postgres                          9.5-alpine                264450a7  14.4MB
busybox                           latest                    414aeb86  707.8KB

Or filter the list by an image name:

$ zot images remote-zot -n busybox
IMAGE NAME                        TAG                       DIGEST    SIZE
busybox                           latest                    414aeb86  707.8KB

Scanning images for known vulnerabilities

You can fetch CVE (Common Vulnerabilities and Exposures) info for images hosted on zot

  • Get all images affected by a CVE
$ zot cve remote-zot -i CVE-2017-9935
IMAGE NAME                        TAG                       DIGEST    SIZE
c3/openjdk-dev                    commit-5be4d92            ac3762e2  335MB
  • Get all CVEs for an image
$ zot cve remote-zot -I c3/openjdk-dev:0.3.19
ID                SEVERITY  TITLE
CVE-2015-8540     LOW       libpng: underflow read in png_check_keyword()
CVE-2017-16826    LOW       binutils: Invalid memory access in the coff_s...
  • Get detailed json output
$ zot cve remote-zot -I c3/openjdk-dev:0.3.19 -o json
{
  "Tag": "0.3.19",
  "CVEList": [
    {
      "Id": "CVE-2019-17006",
      "Severity": "MEDIUM",
      "Title": "nss: Check length of inputs for cryptographic primitives",
      "Description": "A vulnerability was discovered in nss where input text length was not checked when using certain cryptographic primitives. This could lead to a heap-buffer overflow resulting in a crash and data leak. The highest threat is to confidentiality and integrity of data as well as system availability.",
      "PackageList": [
        {
          "Name": "nss",
          "InstalledVersion": "3.44.0-7.el7_7",
          "FixedVersion": "Not Specified"
        },
        {
          "Name": "nss-sysinit",
          "InstalledVersion": "3.44.0-7.el7_7",
          "FixedVersion": "Not Specified"
        },
        {
          "Name": "nss-tools",
          "InstalledVersion": "3.44.0-7.el7_7",
          "FixedVersion": "Not Specified"
        }
      ]
    },
  • Get all images in a specific repo affected by a CVE
$ zot cve remote-zot -I c3/openjdk-dev -i CVE-2017-9935
IMAGE NAME                        TAG                       DIGEST    SIZE
c3/openjdk-dev                    commit-2674e8a            71046748  338MB
c3/openjdk-dev                    commit-bd5cc94            0ab7fc76  
  • Get all images of a specific repo where a CVE is fixed
$ zot cve remote-zot -I c3/openjdk-dev -i CVE-2017-9935 --fixed
IMAGE NAME                        TAG                       DIGEST    SIZE
c3/openjdk-dev                    commit-2674e8a-squashfs   b545b8ba  321MB
c3/openjdk-dev                    commit-d5024ec-squashfs   cd45f8cf  321MB

Sync

Periodically pull and synchronize images between zot registries. The synchronization is achieved by copying all the images found at source to destination. To use it see sync-config Supports:

  • TLS verification
  • Prefix filtering (can contain multiple repos, eg repo1/repoX/repoZ)
  • Tags regex filtering
  • Tags semver compliance filtering (the 'v' prefix is optional)
  • BASIC auth

Ecosystem

skopeo

skopeo is a tool to work with remote image repositories.

  • Pull Images
skopeo copy docker://<zot-server:port>/repo:tag docker://<another-server:port>/repo:tag
  • Push Images
skopeo copy --format=oci docker://<another-server:port>/repo:tag docker://<zot-server:port>/repo:tag

cri-o

cri-o is a OCI-based Kubernetes container runtime interface.

Works with "docker://" transport which is the default.

Metrics

Can be used for both dist-spec-only zot & the zot with all extensions enabled

Node Exporter

The dist-spec-only zot exposes internal metrics into a Prometheus format through a node exporter. The configuration of node exporter contains connection details for the zot server it is intend to scrape metrics from. See a configuration example. The metrics are automatically enabled in the zot server on first scrape from the Node Exporter (no extra configuration option is needed). Similarly, the metrics are automatically disabled when Node Exporter did not perform any scrapings in a while.

bin/zxp config _config-file_

Enable Metrics

In the zot with all extensions case see configuration example for enabling metrics

Caveats

  • go 1.15+
  • The OCI distribution spec is still WIP, and we try to keep up

Contributing

We encourage and support an active, healthy community of contributors.