Remove legacy (v1) registry support #35479

thaJeztah · 2017-11-13T13:31:52Z

Version 1.8.3 added a flag (--disable-legacy-registry=false) which prevents the docker daemon from pull, push, and login operations against v1 registries. Though enabled by default, this signals the intent to deprecate the v1 protocol.

Support for the v1 protocol to the public registry was removed in 1.13. Any mirror configurations using v1 should be updated to use a v2 registry mirror.

Support for v1 registries is scheduled for removal in the next Docker 17.12 release

- Description for the changelog

* Remove support for legacy (v1) registries. Support for v1 registries was deprecated in docker 1.8, disabled by default in docker 17.06, and is now removed. [moby/moby#35479](https://github.com/moby/moby/pull/35479)

- A picture of a cute animal (not mandatory but encouraged)

jpetazzo, dekkagaijin, vdemeester, and tao12345666333 reacted with heart emoji

thaJeztah · 2017-11-13T13:35:29Z

registry/service.go

Wondering if V1 login should still be a thing (IIRC "authentication" is separate from the registry specs, but I may be wrong here)

thaJeztah · 2017-11-13T13:39:07Z

daemon/image_pull.go

Instead of removing this; should we produce an error here? Although the codebase in this repository should no longer return v1 endpoints, the code is just one implementation of the interface; other implementations may still return v1 endpoints (or mixed v1/v2 endpoints); https://github.com/moby/moby/blob/master/registry/service.go#L28-L29

We could remove registry.APIVersion1 so that it could no longer be used by other implementations

thaJeztah · 2017-11-13T13:39:55Z

Pushing this as a WIP. There's a couple of things that I need input on (also see inline comments above);

Should we remove support for "Schema 1" images? They seem to be tightly coupled to the V1/V2 registry protocol

moby/distribution/push.go

Lines 94 to 96 in 4a244c3

    
           if imagePushConfig.RequireSchema2 && endpoint.Version == registry.APIVersion1 { 
        
           	continue 
        
           }

(if so, the extra registry can also be removed from the dockerfile; https://github.com/moby/moby/blob/master/Dockerfile#L106-L110)

ping @dmcgowan @stevvooe @aaronlehmann

thaJeztah · 2017-11-13T13:42:14Z

hm Windows CI is failing, looks like a --disable-legacy-registry option may be set; oh! or I should not be checking if the flag was changed (because that flag isn't there on Windows 🤔 )

13:37:19 ----------- DAEMON LOG ------------
13:37:19 interacting with legacy (v1) registries is no longer supported

edit: think I found the culprit; updated

aaronlehmann · 2017-11-13T15:23:37Z

I don't think it will be possible to remove "schema 1" support for some time. Any image pushed with Docker < 1.10, or pushed to a registry that didn't support schema 2 at the time (including Docker Hub for quite some time after the 1.10 release) uses this format.

You would have to deprecate push support long before pull, and check that all registry implementations support the new format.

thaJeztah · 2017-11-13T16:40:17Z

Ah, right, I also see I was reading it wrong; the correct way to interpret those condition is (I think):

A schema 2 image requires a V2 registry, but
A schema 1 image can be pulled/pushed to both a V1 or a V2 registry
The registry used in the tests is likely only used to guarantee we get a schema 1 manifest (because a newer registry may return either)

So looks like I can remove the checks in

moby/distribution/push.go

Lines 94 to 96 in 4a244c3

    
           if imagePushConfig.RequireSchema2 && endpoint.Version == registry.APIVersion1 { 
        
           	continue 
        
           }

, just replacing them with either a skip if V1-endpoint or error if V1 endpoint (depending on the outcome of #35479 (comment))

aaronlehmann · 2017-11-13T16:48:11Z

I don't think that's right. "schema 1" means "registry V2, schema 1". While the schema 1 format inherits a lot from the V1 protocol, this manifest format is specific to V2.

thaJeztah · 2017-11-13T16:54:36Z

Sorry, they must be silly questions; was trying to find the logic where it prevents a "schema1" image to be pushed to a V2 registry;

moby/distribution/push.go

Lines 93 to 140 in 4a244c3

    
           for _, endpoint := range endpoints { 
        
           	if imagePushConfig.RequireSchema2 && endpoint.Version == registry.APIVersion1 { 
        
           		continue 
        
           	} 
        
           	if confirmedV2 && endpoint.Version == registry.APIVersion1 { 
        
           		logrus.Debugf("Skipping v1 endpoint %s because v2 registry was detected", endpoint.URL) 
        
           		continue 
        
           	} 
        
           	if endpoint.URL.Scheme != "https" { 
        
           		if _, confirmedTLS := confirmedTLSRegistries[endpoint.URL.Host]; confirmedTLS { 
        
           			logrus.Debugf("Skipping non-TLS endpoint %s for host/port that appears to use TLS", endpoint.URL) 
        
           			continue 
        
           		} 
        
           	} 
        
           	logrus.Debugf("Trying to push %s to %s %s", repoInfo.Name.Name(), endpoint.URL, endpoint.Version) 
        
           	pusher, err := NewPusher(ref, endpoint, repoInfo, imagePushConfig) 
        
           	if err != nil { 
        
           		lastErr = err 
        
           		continue 
        
           	} 
        
           	if err := pusher.Push(ctx); err != nil { 
        
           		// Was this push cancelled? If so, don't try to fall 
        
           		// back. 
        
           		select { 
        
           		case <-ctx.Done(): 
        
           		default: 
        
           			if fallbackErr, ok := err.(fallbackError); ok { 
        
           				confirmedV2 = confirmedV2 || fallbackErr.confirmedV2 
        
           				if fallbackErr.transportOK && endpoint.URL.Scheme == "https" { 
        
           					confirmedTLSRegistries[endpoint.URL.Host] = struct{}{} 
        
           				} 
        
           				err = fallbackErr.err 
        
           				lastErr = err 
        
           				logrus.Infof("Attempting next endpoint for push after error: %v", err) 
        
           				continue 
        
           			} 
        
           		} 
        
           		logrus.Errorf("Not continuing with push after error: %v", err) 
        
           		return err 
        
           	} 
        
           	imagePushConfig.ImageEventLogger(reference.FamiliarString(ref), reference.FamiliarName(repoInfo.Name), "push") 
        
           	return nil 
        
           }

, but possibly there isn't any (or it's elsewhere)

dmcgowan · 2017-11-16T18:40:23Z

Sorry, they must be silly questions; was trying to find the logic where it prevents a "schema1" image to be pushed to a V2 registry

To do that we would have to explicitly deprecate some version of the v2 registry, which we should be careful about. Some other implementations of the v2 registry protocol have only recently updated to schema2, so it might be a bit early for preventing push.

dmcgowan · 2017-11-16T18:44:50Z

registry/config.go

There is a check now that is enforcing this is not false, what is defaulting it to true?

The flag is still there, and has true as default; https://github.com/moby/moby/pull/35479/files#diff-fe42cd3c297bb829e5e2d79a7640a52dR94

Although not strictly necessary, I thought keeping the flag around (but producing a proper error) was better than removing the flag (and getting an "unknown flag: --disable-legacy-registry") - same for existing daemon.json files

stevvooe · 2017-11-21T01:44:43Z

Love the idea!

thaJeztah · 2017-11-30T02:23:19Z

ping @dmcgowan @aaronlehmann I removed "WIP" from this one, but could use some eyes to check if it all looks good (also re: some of my inline comments)

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

AkihiroSuda · 2017-12-20T12:58:29Z

What's s current status?

thaJeztah · 2017-12-20T13:16:49Z

We merged #35751 to address the deprecation itself, so that removing the actual code (this PR) could be reviewed separately. But definitely could use some eyes/reviews here 😅

AkihiroSuda · 2018-02-14T05:20:10Z

ping^^ @thaJeztah

https://github.com/moby/moby/pull/35751/files#diff-fe42cd3c297bb829e5e2d79a7640a52dR95

I guess we can now remove v1 codes completely toward Docker v18.03?

AkihiroSuda · 2018-03-09T07:02:09Z

ping^^ @thaJeztah

thaJeztah · 2018-03-09T09:45:58Z

Oh, yes, I need to find time to work on this again, but recall that I could use some help on some things. I'll try to make some time soon 😅

tao12345666333 · 2018-08-28T10:23:25Z

@thaJeztah Can I help with this?

olljanat · 2018-12-21T18:29:35Z

@thaJeztah this one needs to be rebased

thaJeztah · 2018-12-24T16:32:31Z

There's a newer PR to remove this #37874, but looks like that one stalled 😕

thaJeztah requested review from dnephin and vdemeester as code owners November 13, 2017 13:31

GordonTheTurtle added the status/0-triage label Nov 13, 2017

thaJeztah commented Nov 13, 2017

View reviewed changes

thaJeztah force-pushed the remove-legacy-registry-support branch 2 times, most recently from 008a75f to 46ac931 Compare November 13, 2017 13:56

dmcgowan reviewed Nov 16, 2017

View reviewed changes

vdemeester added status/1-design-review and removed status/0-triage labels Nov 27, 2017

GordonTheTurtle assigned thaJeztah Nov 28, 2017

thaJeztah changed the title ~~[WIP] Remove legacy (v1) registry support~~ Remove legacy (v1) registry support Nov 30, 2017

tonistiigi added status/2-code-review and removed status/1-design-review labels Nov 30, 2017

thaJeztah removed their assignment Nov 30, 2017

GordonTheTurtle assigned johnstep Dec 1, 2017

thaJeztah force-pushed the remove-legacy-registry-support branch from 46ac931 to 0945340 Compare December 4, 2017 22:27

thaJeztah added rebuild/experimental labels Dec 7, 2017

GordonTheTurtle removed rebuild/experimental labels Dec 7, 2017

thaJeztah mentioned this pull request Dec 8, 2017

Disallow using legacy (V1) registries #35751

Merged

thaJeztah force-pushed the remove-legacy-registry-support branch 4 times, most recently from 4adb5ce to f5fdc51 Compare December 9, 2017 10:28

thaJeztah added 2 commits December 11, 2017 19:52

Remove legacy (v1) registry support

0a04bf3

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

Remove use of confirmedV2

4c9380b

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

thaJeztah force-pushed the remove-legacy-registry-support branch from f5fdc51 to 4c9380b Compare December 12, 2017 03:53

thaJeztah added the rebuild/* label Dec 20, 2017

GordonTheTurtle removed the rebuild/* label Dec 20, 2017

derek bot added the status/failing-ci Indicates that the PR in its current state fails the test suite label Dec 22, 2018

justincormack mentioned this pull request Dec 24, 2018

Remove the rest of v1 manifest support #37874

Merged

AkihiroSuda closed this in #37874 Mar 6, 2019

thaJeztah deleted the remove-legacy-registry-support branch March 6, 2019 08:32

thaJeztah added area/distribution Image Distribution impact/deprecation labels Jun 24, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Remove legacy (v1) registry support #35479

Remove legacy (v1) registry support #35479

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Remove legacy (v1) registry support #35479

Remove legacy (v1) registry support #35479

Uh oh!

Conversation

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!