From 4686ab975b97ddd534ef195c87081b930271d616 Mon Sep 17 00:00:00 2001 From: "Yann E. MORIN" Date: Thu, 19 Jun 2025 09:39:46 +0200 Subject: [PATCH] package/containers-image-config: new package The container/image repository is the standards regpository that drives the image management in container tools, like podman or skopeo. Besides a Go library, it also prodvides the template configuration files used by those tools; those files can also serve as default ones. Install those files instead of the canned ones we cary in podman, and change podman to use this new package too. The registry file needs a fixup, as it by default does not allow searching unqualified images (i.e. those that do not contain a registry name) in a default registry, for security reasons. However, the Docker Hub is traditionally a registry that can be accessed without being specified, so we make that possible. As was noted in ebbaac08e3f4 (package/podman: new package), "[p]roviding actual files is going to be use-case dependent, and interested parties will have to provide their own config files, e.g. in a rootfs overlay." Signed-off-by: Yann E. MORIN Cc: Thomas Petazzoni Signed-off-by: Julien Olivain --- package/Config.in | 1 + package/containers-image-config/Config.in | 8 ++++++ .../containers-image-config.hash | 3 +++ .../containers-image-config.mk | 25 +++++++++++++++++++ package/podman/Config.in | 1 + package/podman/podman.mk | 10 -------- package/podman/policy.json | 7 ------ package/podman/registries.conf | 1 - 8 files changed, 38 insertions(+), 18 deletions(-) create mode 100644 package/containers-image-config/Config.in create mode 100644 package/containers-image-config/containers-image-config.hash create mode 100644 package/containers-image-config/containers-image-config.mk delete mode 100644 package/podman/policy.json delete mode 100644 package/podman/registries.conf diff --git a/package/Config.in b/package/Config.in index ee0532a0d9..f2c868415f 100644 --- a/package/Config.in +++ b/package/Config.in @@ -2844,6 +2844,7 @@ menu "System tools" source "package/circus/Config.in" source "package/conmon/Config.in" source "package/containerd/Config.in" + source "package/containers-image-config/Config.in" source "package/coreutils/Config.in" source "package/cpulimit/Config.in" source "package/cpuload/Config.in" diff --git a/package/containers-image-config/Config.in b/package/containers-image-config/Config.in new file mode 100644 index 0000000000..d40712e56d --- /dev/null +++ b/package/containers-image-config/Config.in @@ -0,0 +1,8 @@ +config BR2_PACKAGE_CONTAINERS_IMAGE_CONFIG + bool "containers-image-config" + help + Install default, minimalist configuration files used by the + various tools dealing with containers images, like podman, + skopeo... + + https://github.com/containers/image diff --git a/package/containers-image-config/containers-image-config.hash b/package/containers-image-config/containers-image-config.hash new file mode 100644 index 0000000000..0159b0fc62 --- /dev/null +++ b/package/containers-image-config/containers-image-config.hash @@ -0,0 +1,3 @@ +# Locally computed: +sha256 afdbb1487571d4cc8974e11c72bc4e05043fb490cfc0581783789f414c64f87b containers-image-config-v5.35.0-git4.tar.gz +sha256 716a8b80635c394681e652823e1e42e411ad2d254e1f202403422d74f4b0b106 LICENSE diff --git a/package/containers-image-config/containers-image-config.mk b/package/containers-image-config/containers-image-config.mk new file mode 100644 index 0000000000..2f03f8e8fb --- /dev/null +++ b/package/containers-image-config/containers-image-config.mk @@ -0,0 +1,25 @@ +################################################################################ +# +# containers-image-config +# +################################################################################ + +CONTAINERS_IMAGE_CONFIG_VERSION = v5.35.0 +CONTAINERS_IMAGE_CONFIG_SITE = https://github.com/containers/image +CONTAINERS_IMAGE_CONFIG_SITE_METHOD = git + +CONTAINERS_IMAGE_CONFIG_LICENSE = Apache-2.0 +CONTAINERS_IMAGE_CONFIG_LICENSE_FILES = LICENSE + +define CONTAINERS_IMAGE_CONFIG_INSTALL_TARGET_CMDS + $(INSTALL) -D -m 0644 \ + $(@D)/default-policy.json \ + $(TARGET_DIR)/etc/containers/policy.json + $(INSTALL) -D -m 0644 \ + $(@D)/registries.conf \ + $(TARGET_DIR)/etc/containers/registries.conf + $(SED) '/^# unqualified-search-registries = .*/s//unqualified-search-registries = ["docker.io"]/' \ + $(TARGET_DIR)/etc/containers/registries.conf +endef + +$(eval $(generic-package)) diff --git a/package/podman/Config.in b/package/podman/Config.in index 2bcb8e71d2..6bfd477f38 100644 --- a/package/podman/Config.in +++ b/package/podman/Config.in @@ -12,6 +12,7 @@ config BR2_PACKAGE_PODMAN select BR2_PACKAGE_CA_CERTIFICATES # runtime select BR2_PACKAGE_CGROUPFS_V2_MOUNT if !BR2_PACKAGE_CGROUPFS_MOUNT && !BR2_INIT_SYSTEMD # runtime select BR2_PACKAGE_CONMON # runtime + select BR2_PACKAGE_CONTAINERS_IMAGE_CONFIG # runtime select BR2_PACKAGE_LIBGPGME select BR2_PACKAGE_LIBSECCOMP select BR2_PACKAGE_NETAVARK # runtime diff --git a/package/podman/podman.mk b/package/podman/podman.mk index 7ca9b9ddcb..27d9a84712 100644 --- a/package/podman/podman.mk +++ b/package/podman/podman.mk @@ -99,16 +99,6 @@ define PODMAN_LINUX_CONFIG_FIXUPS $(PODMAN_LINUX_CONFIG_FIXUPS_BTRFS) endef -define PODMAN_CONFIG - $(Q)$(INSTALL) -D -m 0644 \ - $(PODMAN_PKGDIR)/policy.json \ - $(TARGET_DIR)/etc/containers/policy.json - $(Q)$(INSTALL) -D -m 0644 \ - $(PODMAN_PKGDIR)/registries.conf \ - $(TARGET_DIR)/etc/containers/registries.conf -endef -PODMAN_POST_INSTALL_TARGET_HOOKS += PODMAN_CONFIG - define PODMAN_HELPERS $(Q)mkdir -p $(TARGET_DIR)/usr/libexec/podman $(Q)ln -sf ../../bin/aardvark-dns $(TARGET_DIR)/usr/libexec/podman/aardvark-dns diff --git a/package/podman/policy.json b/package/podman/policy.json deleted file mode 100644 index 9333053f93..0000000000 --- a/package/podman/policy.json +++ /dev/null @@ -1,7 +0,0 @@ -{ - "default": [ - { - "type": "insecureAcceptAnything" - } - ] -} diff --git a/package/podman/registries.conf b/package/podman/registries.conf deleted file mode 100644 index d44d892da3..0000000000 --- a/package/podman/registries.conf +++ /dev/null @@ -1 +0,0 @@ -unqualified-search-registries = ["docker.io"]