Limit "docker pull" to certain image tags based on the user?

[jaydrogers]

Hi everyone,

Quick question

• Is it possible to limit a docker pull to certain image tags?

Example

• User A should have access to my-registry.test/my-org/my-repo:v1 ONLY
• User B should have access to my-registry.test/my-org/my-repo:v2 ONLY

The problem we're encountering

When someone runs docker pull, we see the authentication request come in, but it DOES NOT include what tag they are trying to access.

Received payload on docker pull

{
"account": "usera",
"scope": "repository:my-org/my-repo:pull",
"service": "my-registry.test"
}

[jaydrogers]

Workaround

We found the registry was not designed to set permissions on a per tag basis, so we were able to write our own authentication and wrap the registry in a proxy with Traefik: https://doc.traefik.io/traefik/middlewares/http/forwardauth/

[brackendawson]

Can the user bypass this by pulling the image by digest or are they only allowed to pull the manifest by tag?

This kind of authz will not prevent the user from pulling any of the layers, if they know their digests.

[jaydrogers]

This is a great point. There probably is a way to still get the digests (if they know exactly the digest to pull)

How we authenticate

We have Traefik in front of the registry that requires the endpoint of /v2/{{org}}/{{repo}}/manifests/{{tag}} to receive authentication.

If our Laravel application approves, they can continue to pull the image.

Possible bypass

Only if the user somehow has a list of digests to pull, the user could potentially access these other digests.

Further exploration

Is there a bigger risk that I'm not seeing where a user could pull the digests information without hitting the /v2/{{org}}/{{repo}}/manifests/{{tag}} endpoint?

I appreciate your feedback and perspective as we're learning the inner-workings of the Docker registry for our first time. Thanks!