Skip to content

image pull: enforce shortnames #9401

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Sep 10, 2025
Merged

image pull: enforce shortnames #9401

merged 1 commit into from
Sep 10, 2025
+86 −6

Conversation

haircommander
Copy link
Member

I personally thought "disable" here meant "don't allow shortnames to be resolved" actually, it means "allow any shortname to be resolved if one is found in the unqualified search registry"

I think CRI-O's official position should be to discourage the use of 'unqualified-search-registries', but if there are some present, we should block if there's ambiguity in which image to pull from which, so we can prevent squatting issues

What type of PR is this?

What this PR does / why we need it:

Which issue(s) this PR fixes:

Special notes for your reviewer:

Does this PR introduce a user-facing change?

Enable shortname enforcement, requiring shortnames to be unambiguous if there are multiple entries that could be pulled from the list of 'unqualified-search-registries'. Generally, users should not enable 'unqualified-search-registries' but if they must be used, they should be unambiguous

@haircommander haircommander requested a review from mrunalp as a code owner August 12, 2025 20:21
@openshift-ci openshift-ci bot added release-note Denotes a PR that will be considered when it comes time to generate release notes. dco-signoff: yes Indicates the PR's author has DCO signed all their commits. labels Aug 12, 2025
@openshift-ci openshift-ci bot requested review from hasan4791 and littlejawa August 12, 2025 20:21
@openshift-ci openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 12, 2025
@haircommander
Copy link
Member Author

/retest
I would not be surprised if a bunch of stuff breaks

@codecov Codecov
Copy link

codecov bot commented Aug 12, 2025 •
edited
Loading

Codecov Report

❌ Patch coverage is 77.77778% with 8 lines in your changes missing coverage. Please review.
✅ Project coverage is 67.06%. Comparing base (aea52d6) to head (a8b550a).
⚠️ Report is 6 commits behind head on main.

Additional details and impacted files 
@@            Coverage Diff             @@
##             main    #9401      +/-   ##
==========================================
- Coverage   67.07%   67.06%   -0.01%     
==========================================
  Files         202      202              
  Lines       27997    28025      +28     
==========================================
+ Hits        18779    18796      +17     
- Misses       7644     7654      +10     
- Partials     1574     1575       +1
🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

bitoku
bitoku reviewed Aug 13, 2025
View reviewed changes
Copy link
Contributor

@bitoku bitoku left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It can be a follow up, but we can change the name CandidatesForPotentiallyShortImageName and return value type because it will always return a single image.

internal/storage/image.go Outdated
Comment on lines 1020 to 1021
enforcing := types.ShortNameModeEnforcing
sc.ShortNameMode = &enforcing
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit:
I'd suggest ensuring the length == 1 instead of using types.ShortNameModeEnforcing because the error message is not user-friendly.

cri-o/vendor/github.com/containers/image/v5/pkg/shortnames/shortnames.go

Lines 351 to 353 in c36f2b5

case types.ShortNameModeEnforcing:
// Enforcing errors out without a prompt.
return nil, errors.New("short-name resolution enforced but cannot prompt without a TTY")

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fixed!

@haircommander
Copy link
Member Author

/retest

@jlebon jlebon mentioned this pull request Aug 13, 2025
Closed
@jlebon jlebon mentioned this pull request Aug 25, 2025
Closed
@haircommander haircommander added this to the 1.34 milestone Sep 4, 2025
@haircommander haircommander force-pushed the enforce-shortnames branch 4 times, most recently from eac5417 to cd8d336 Compare September 8, 2025 20:52
@haircommander
Copy link
Member Author

okay I think this is good now (unless unit tests fail, I'm letting CI test that)

@cri-o/cri-o-maintainers PTAL

bitoku
bitoku reviewed Sep 9, 2025
View reviewed changes
@haircommander
config: configure shortname through configuration and enforce shortnames
a8b550a 
I personally thought "disable" here meant "don't allow shortnames to be resolved"
actually, it means "allow any shortname to be resolved if one is found in the unqualified search registry"

I think CRI-O's official position should be to discourage the use of 'unqualified-search-registries', but
if there are some present, we should block if there's ambiguity in which image to pull from which, so we can prevent
squatting issues

Signed-off-by: Peter Hunt <pehunt@redhat.com>
@haircommander
Copy link
Member Author

@cri-o/cri-o-maintainers PTAL

bitoku
bitoku reviewed Sep 10, 2025
View reviewed changes
Copy link
Contributor

@bitoku bitoku left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Sep 10, 2025
@openshift-ci OpenShift CI
Copy link
Contributor

openshift-ci bot commented Sep 10, 2025

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: haircommander, saschagrunert

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:
  • OWNERS [haircommander,saschagrunert]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-merge-bot openshift-merge-bot bot merged commit d91a449 into cri-o:main Sep 10, 2025
89 of 90 checks passed
@github-actions github-actions bot mentioned this pull request Sep 14, 2025
Open
@brianmcarey brianmcarey mentioned this pull request Sep 15, 2025
Open
@kevinastone
Copy link

kevinastone commented Sep 23, 2025 •
edited
Loading

Is there a mechanism to override this? It's causing image pull failures when I upgrade to v1.34.

@haircommander
Copy link
Member Author

yup! a drop-in cri-o configuration would do it

[crio.image]
short_name_mode = "disabled

anywhere in /etc/crio/crio.conf.d :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@bitoku bitoku bitoku left review comments

@saschagrunert saschagrunert saschagrunert approved these changes

@mrunalp mrunalp Awaiting requested review from mrunalp mrunalp is a code owner

@hasan4791 hasan4791 Awaiting requested review from hasan4791

@littlejawa littlejawa Awaiting requested review from littlejawa

Assignees

@saschagrunert saschagrunert

@bitoku bitoku

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. dco-signoff: yes Indicates the PR's author has DCO signed all their commits. lgtm Indicates that a PR is ready to be merged. release-note Denotes a PR that will be considered when it comes time to generate release notes.
Projects
None yet
Milestone
1.34
Development

Successfully merging this pull request may close these issues.
4 participants
@haircommander @kevinastone @saschagrunert @bitoku