Tags list API will load all repository tags to memory

[njucjc]

This following code will query all tags in the repo and load them into memory for paging. If there are a large number of tags in the repo, there may be leading to OOM.

tags, err := tagService.All(th)
	if err != nil {
		switch err := err.(type) {
		case distribution.ErrRepositoryUnknown:
			th.Errors = append(th.Errors, errcode.ErrorCodeNameUnknown.WithDetail(map[string]string{"name": th.Repository.Named().Name()}))
		case errcode.Error:
			th.Errors = append(th.Errors, err)
		default:
			th.Errors = append(th.Errors, errcode.ErrorCodeUnknown.WithDetail(err))
		}
		return
	}

	// do pagination if requested
	q := r.URL.Query()
	// get entries after latest, if any specified
	if lastEntry := q.Get("last"); lastEntry != "" {
		lastEntryIndex := sort.SearchStrings(tags, lastEntry)

		// as`sort.SearchStrings` can return len(tags), if the
		// specified `lastEntry` is not found, we need to
		// ensure it does not panic when slicing.
		if lastEntryIndex == len(tags) {
			tags = []string{}
		} else {
			tags = tags[lastEntryIndex+1:]
		}
	}

[milosgajdos]

This is true and I dont think it's easily solvable as it must comply with the spec https://github.com/opencontainers/distribution-spec/blob/main/spec.md#listing-tags

[njucjc]

I think the most difficult thing here is that the tags list result need to be returned in lexical order. This problem can be solved if the back-end storage driver can sort it when doing list operations. It seems that aws s3 can work like this way.
https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListObjectsV2.html

[njucjc]

I found a PR related to this problem in distribution-spec.

[milosgajdos]

Yeah, the general lack of any sort of limits throughout the specification has been posing serious challengers for implementors. There are workarounds but that's just duct tape on broken spec, unfortunately.