Missing Policy configuration, no demo or introduction in the document

[zhangguanzhang]

https://github.com/distribution/distribution/blob/bc6e81e1b9a8017a66fc56a55913b92930941feb/configuration/configuration.go#L205-215L

cannot found Policy configuration at https://distribution.github.io/distribution/about/configuration/
I don’t understand what Policy is for

@dmcgowan PTAL

link: #2112

[milosgajdos]

You are right I believe there was never any documentation about policies so I'll try to give you a very short description.

Policies define registry authorization behaviour for different type of API resource classes in registry.

// Classes is a list of repository classes which the
// registry allows content for. This class is matched
// against the configuration media type inside uploaded
// manifests. When non-empty, the registry will enforce
// the class in authorized resources.

Resource class is basically a type of resource determined by mediaType of the content (we mean the config MediaType in the content manifest). There are currently only 2 classes recognised:

• image (

  distribution/registry/handlers/manifests.go

  Line 27 in bc6e81e

  imageClass = "image"

  )
• plugin (hardcoded:

  distribution/registry/handlers/manifests.go

  Line 374 in bc6e81e

  class = "plugin"

  )

Plugins were meant to be used to distribute Docker daemon plugins (such as for logging or whatnot). Though IIRC they are going to be deprecated by Docker. They might have been already 🤷‍♂️

Policies then define restrictions about what you should do when processing API request for specific class of resource. Restrictions are currently limited to

• allow
• deny

By default all classes are allowed but as soon as you eplicitly list at least one class all the other classes are denied e.g. this is a sample config:

policy:
  repository:
    classes:
      - image

The above config ONLY allows images to be distributed and denies handling any other class.
If you leave that config empty registry processes all types of resources:

distribution/registry/handlers/manifests.go

Lines 362 to 365 in bc6e81e

	allowedClasses := imh.App.Config.Policy.Repository.Classes
	if len(allowedClasses) == 0 {
	return nil
	}

So that's in a very short gist what the policy is about. I'm not sure what the future of this config is..it might get removed in the future 🤷‍♂️

[zhangguanzhang]

It seems to be a very unpopular feature. I thought it was set up to allow external parties to ignore authorization when pulling specific images.😀Thanks for answering my doubts