Search code examples
dockerdocker-registrycodefresh

How to list Docker images in a Codefresh private registry?

I'm currently using Codefresh's free private registry to store my images. I am using CircleCI for my Docker builds, so from there I use docker login so I can push and pull to the Codefresh registry. This works fine. However, Codefresh only lists images in its web app for which it did the building, so I cannot easily see a catalogue of them. I suspect this is by design, so that users stick with Codefresh for CI. However, if possible, I would like to list the images I have in the registry.

I assume that this registry is a basic v2 version of the standard Docker Registry. So, I have had a hunt around, and found this console utility to manage images. However, it does not seem to work for me. I don't know whether this is because registry management tools are still immature generally (web searches indicate they were added much later, and there are lot of folks for whom this simple task has become a substantial undertaking) or whether there is something unusual with Codefresh.

Here is what I am trying:

reg -d -r r.cfcr.io -u myusername -p cfaccesstoken

(The -d is for debug).

This results in:

2017/10/18 11:24:43 registry.ping url=https://r.cfcr.io/v2/
2017/10/18 11:24:44 registry.catalog url=https://r.cfcr.io/v2/_catalog
2017/10/18 11:25:53 registry.catalog url=https://r.cfcr.iohttps://r.cfcr.io/v2/_catalog?n=1000&last=davigsantos/davigsantos/codeflix
FATA[0075] Get https://r.cfcr.iohttps//r.cfcr.io/v2/_catalog?n=1000&last=davigsantos/davigsantos/codeflix: dial tcp: lookup r.cfcr.iohttps on 127.0.1.1:53: no such host

The penultimate line contains a container name I don't recognise - I hope it is a public one, and not one I should not be seeing!

The last line indicates some sort of fatal error, with all sorts of URL fragments mashed together in ways that definitely won't work.

I have also discovered that dropping the access token makes no difference; the output is exactly the same:

reg -d -r r.cfcr.io -u myusername

What else can I try? I am running Mint Linux and would be fine with swapping to another utility if necessary. Is there something wrong about the way I am issuing this command, or is Codefresh running a non-standard registry that is incompatible with standard API calls?

Update

It looks like Codefresh also has their own API, though it does not seem to be documented as far as I can tell. Running the get operation produces this error:

Failed to authenticate request because no token was provided

That's encouraging, so I will try to find out how to provide a token in a curl call; the Swagger web interface does not seem to permit it. However I am conscious that, if I can get the API working, it may not list my Docker images anyway, since they were not built by Codefresh.

Update 2

I have found some articles on the Codefresh blog that hint how to authenticate on the API, the format is a header thus:

--header "x-access-token: (token)"

However I get this error:

{"status":401,"code":"2401","name":"UNAUTHORIZED_ERROR","message":"Failed to authenticate request because token is not valid","context":{}}

The token I am using is the same one as I use for docker login, which works. I notice I was not specifying my username, so I am also adding this curl option:

-u (user):(token)

As you can see, I am close to trying random things now, as there does not seem to be official help online.

Update 3

Prompted by a comment below, it seems that Docker maintains an access token after login is used, in ~/.docker/config.json.

I therefore tried this:

reg -d -r r.cfcr.io -u myusername -p dockeraccesstoken

(Note how cfaccesstoken has been changed to dockeraccesstoken).

This returns much more quickly now (as opposed to appearing to hang), but returns nothing:

2017/10/24 10:56:16 registry.ping url=https://r.cfcr.io/v2/
2017/10/24 10:56:18 registry.catalog url=https://r.cfcr.io/v2/_catalog
Repositories for r.cfcr.io
Solution

  • You need to first generate a token on CodeFresh User Settings

    Docker token

    Next I will show you how to login from terminal

    curl -H 'Host: r.cfcr.io' -H 'User-Agent: ItsMe' -H 'Authorization: Basic <AUTH>' --compressed 'https://r.cfcr.io/v2/token?account=xxxx&scope=repository%3A<user>/<name>%3Apush%2Cpull&service=r.cfcr.io'

    You can get the <AUTH> by running

    echo <account>:<token> | base64

    This will return you a big token

    {"expires_in":43200,"issued_at":"2017-10-24T03:34:54.118390368-07:00","token":"APMm...P91"}%

    Now you can use that token to make a docker API call

    $ curl -IH 'Host: r.cfcr.io' -H 'User-Agent: ItsMe' -H 'Authorization: Bearer APMm+...aRL' -X HEAD 'https://r.cfcr.io/v2/<user>/<user>/testci/blobs/sha256:c7fefcc4c54c63f32b5422ede095793eb5ff0f45ad7a22861974ec9b61e7749b'
HTTP/1.1 200 OK
Docker-Distribution-API-Version: registry/2.0
Content-Length: 22488057
Date: Tue, 24 Oct 2017 10:42:23 GMT
Content-Type: text/html
Server: Docker Registry
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN

    For registry search access below should have worked

    curl -H 'Host: r.cfcr.io' -H 'User-Agent: ItsMe' -H 'Authorization: Basic ' --compressed 'https://r.cfcr.io/v2/token?account=xxxx&scope=registry%3Acatalog%3Asearch&service=r.cfcr.io'

    But it doesn't and neither does registry:catalog:* for scopes. This is like hitting a target with blind folds and not even knowing in which direction we stand. You best bet is to get them to disclose some information to you

    Edit-1: Getting the catalog

    So I finally managed to crack it, but the result is a bit unfortunate. I ended up getting catalog/repositories of every single user. I checked, you still can't pull those repo. So their docker images are safe as such. These look like so:

    EveryRepo

    Edit-2: Fetching all repos

    After we notified Codefresh of this situation, here is how to do the fetch. One needs to first generate a token using below:

    curl -H 'Host: r.cfcr.io' -H 'User-Agent: MyAgent' -H 'Authorization: Basic .....' --compressed 'https://r.cfcr.io/v2/token?account=<account>&service=r.cfcr.io'

    And then using the same we can query the complete catalog:

    curl -H "User-Agent: ItsMe" -H 'Authorization: Bearer <TOKEN>' 'https://r.cfcr.io/v2/_catalog?n=10' --compressed