docker-registry - 如何使用 HTTP API v2 获取 list ？

Question

How to authenticate with the V2 API 很有用并且有效。

REPO="https://hub.docker.com/v2"

我能够获得 token ，列出(我的)存储库并列出他们的图像和标签。

curl --silent \
--header "Authorization: JWT ${TOKEN}" \
${REPO}/repositories/${USERNAME}/

curl --silent \
--header "Authorization: JWT ${TOKEN}" \
${REPO}/repositories/${USERNAME}/${IMAGE}/tags/

我想“获取 list ”，但我正在努力让它发挥作用:
https://docs.docker.com/registry/spec/api/#manifest :

curl --silent \
--header "Host: hub.docker.com" \
--header "Authorization: JWT ${TOKEN}" \
${REPO}/repositories/${USERNAME}/${IMAGE}/manifests/

curl --silent \
--header "Host: hub.docker.com" \
--header "Authorization: JWT ${TOKEN}" \
${REPO}/${USERNAME}/${IMAGE}/manifests/

curl --silent \
--header "Host: hub.docker.com" \
--header "Authorization: JWT ${TOKEN}" \
${REPO}/${USERNAME}/${IMAGE}/manifests/${TAG}

我试过 | 没有 Host header 。 Host header 具有各种值。但是，我显然错过了一些东西。我尝试对工作端点进行模式匹配，但没有任何乐趣:

curl --silent \
--header "Authorization: JWT ${TOKEN}" \
${REPO}/repositories/${USERNAME}/${IMAGE}/manifests/

奇怪的是，此页面将“GET TAGS”显示为 /v2/<name>/tags/list 似乎不正确:
https://docs.docker.com/registry/spec/api/#tags

评论:
https://stackoverflow.com/a/45605443/609290

跟进

我是一名 Google 员工，可以访问 Google Container Registry (GCR)。

REPO="https://gcr.io/v2/"

一时兴起，我只是针对 GCR 尝试了“GET MANIFEST”，并且请求有效:

curl --silent \
--request GET \
--user _token:$(gcloud auth print-access-token) \
${REPO}/${PROJECT}/${IMAGE}/manifests/${TAG}

Answer 1

与所有 *.docker.com|io 相当困惑子域!
我找到了 registry.hub.docker.com和 index.docker.io最可靠的。

您可以轻松地从那里查询标签，但对于 list ，您需要先获取一个 token 以进行拉取:

REGISTRY=https://index.docker.io/v2
#REGISTRY="https://registry.hub.docker.com/v2"
#REGISTRY="https://registry.docker.io/v2"
#REGISTRY="https://registry-1.docker.io/v2"
#REGISTRY="https://hub.docker.com/v2"

REPO=library
IMAGE=debian
# Could also be a repo digest
TAG=latest

# Query tags
curl "$REGISTRY/repositories/$REPO/$IMAGE/tags/"

# Query manifest
curl -iL "$REGISTRY/$REPO/$IMAGE/manifests/$TAG"
# HTTP/1.1 401 Unauthorized
# Www-Authenticate: Bearer realm="https://auth.docker.io/token",service="registry.docker.io",scope="repository:library/debian:pull"

TOKEN=$(curl -sSL "https://auth.docker.io/token?service=registry.docker.io&scope=repository:$REPO/$IMAGE:pull" \
  | jq --raw-output .token)
curl -LH "Authorization: Bearer ${TOKEN}" "$REGISTRY/$REPO/$IMAGE/manifests/$TAG"

# Some repos seem to return V1 Schemas by default

REPO=nginxinc
IMAGE=nginx-unprivileged 
TAG=1.17.2

curl -LH "Authorization: Bearer $(curl -sSL "https://auth.docker.io/token?service=registry.docker.io&scope=repository:$REPO/$IMAGE:pull" | jq --raw-output .token)" \
 "$REGISTRY/$REPO/$IMAGE/manifests/$TAG"

# Solution: Set the Accept Header for V2

curl -LH "Authorization: Bearer $(curl -sSL "https://auth.docker.io/token?service=registry.docker.io&scope=repository:$REPO/$IMAGE:pull" | jq --raw-output .token)" \
  -H "Accept:application/vnd.docker.distribution.manifest.v2+json" \
 "$REGISTRY/$REPO/$IMAGE/manifests/$TAG"

看

this gist再举一个例子和

这个用于可重用脚本的 repo docker-image-size-curl.sh

授权 hub.docker.com works differently你似乎没有从那里得到 list 🤔