Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

docs: registries.conf: mention Podman Machine #2676

Closed
wants to merge 1 commit into from
Closed

docs: registries.conf: mention Podman Machine #2676

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions docs/containers-registries.conf.5.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,8 @@ file for container image registries. The file format is TOML.

Container engines will use the `$HOME/.config/containers/registries.conf` if it exists, otherwise they will use `/etc/containers/registries.conf`

If you are using Podman Machine (e.g., on MacOS or Windows), registries.conf is read on the server-side only. Changing the configuration implies changing the files inside the Podman Machine which you can do via `podman machine ssh`. Make sure to not add registries.conf to a non-root user's home directory and only configure the system-wide settings in `/etc/containers` to make sure the default settings of Podman Machine continue being applied.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is misleading/wrong, consider that podman machine init now pull the disk image from a oci registry on the host it makes the situation even worse as files are used both on the host and VM. So users need to configure settings in either one depending on what they are trying to do.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good point. Do you have a proposal for rewording? The text here refers to pulling container images.

Pulling a machine image would read registries.conf on the host. But we need to be careful to not overload the user with information and implementation details. Yet it's a fair point to make that differentiation.

Maybe dedicated section for Podman?

Copy link
Member

@Luap99 Luap99 Jan 8, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah that is the hard problem really. What is to much or to little, I don't know.
However I would assume in some customer envs where public pulls are not allowed they would like some local mirror of the machine image. And if a admin then goes to this docs that says it is read on the server side only that is confusing. Also looking at this again I think we are missing the import point to define what server-side means in such context. Of course we both know that but users might not. Which server? A normal user is on mac/windows and starts a VM. They may not consider the VM part to be the server as our docs really like to hide the fact that they are using a remote client.

Maybe the best wording would be to say the registries.conf file read on the system where the image is being pulled. When using Podman Machine/the podman remote client that means the image is pulled in the VM/server. As such the config file must be placed on the VM side... then continue your text how to do so.

As special case podman machine init pulls down the VM image also from a registry by default. In this case it will read the registries.conf on the host.

And I guess the new artifact work could make this even more confusing if we were to ever add "native" artifacts support on mac/windows on not vie the remote API.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All good points. It's clear we need to be more nuanced than the current proposal. I will wait for @mtrmac's feedback and will give it another try then.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe the best wording would be to say the registries.conf file read on the system where the image is being pulled.

That… amounts to “a config file on a computer affects that computer”, and … said that way, that feels like an obvious thing and saying that helps no-one — even users of podman machine would not realize that applies to them in some particular way. That’s one way to express the conflicts involved, and how I struggle with this PR.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Paul already said this, but to highlight separately, “server—side” vs. “inside” is confusing here. Within one paragraph, use only one way to refer to a concept.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not “implies”, changing files in the Mac home directory does not do anything inside the VM (or does it?).

What do you want to say?

A configuration that affects podman machine needs to be set in $location, e.g. using $command

?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Make sure to not add registries.conf to a non-root user's home directory

  • (I’m mildly curious why that should be a problem. Does that interfere with the *.d lookup where some of the *.d files are software-managed, or something like that?)
  • If this should be here at all, I think it needs to be much more strongly scoped to that specific situation. As is, I could read this as a general recommendation against home-directory configs, applying to everyone, not just podman machine.


### GLOBAL SETTINGS

`unqualified-search-registries`
Expand Down
Loading