Skip to content

implement image check for oci pull #635

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mac641 wants to merge 7 commits into
base: master
Choose a base branch
from
+111 −14
Open

implement image check for oci pull #635

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
dacbfd7
feat(service): implement checkOciImageURI in order to support pulling…
mac641 Jan 22, 2026
b72964a
refactor(service): merge checkOciImageURI into checkImageURL in order…
mac641 Jan 29, 2026
78341c2
chore: format go.mod properly
mac641 Jan 29, 2026
ea8bd2b
refactor: address changes requested by @majst01
mac641 Jan 29, 2026
f9486a4
test(image-service): add tests for checkImageURL and fix issues encou…
mac641 Feb 17, 2026
cfe5e20
fix(image-service): add separate url parsing check for http-based images
mac641 Feb 19, 2026
bdefed1
fix: address changes requested by @vknabel
mac641 Apr 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
46 changes: 38 additions & 8 deletions cmd/metal-api/internal/service/image-service.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,9 @@ import (
"fmt"
"log/slog"
"net/http"
"net/url"
"strconv"
"strings"
"time"

"github.com/metal-stack/metal-api/cmd/metal-api/internal/datastore"
Expand All @@ -16,6 +18,9 @@ import (

restfulspec "github.com/emicklei/go-restful-openapi/v2"
restful "github.com/emicklei/go-restful/v3"
"github.com/google/go-containerregistry/pkg/authn"
"github.com/google/go-containerregistry/pkg/name"
"github.com/google/go-containerregistry/pkg/v1/remote"
"github.com/metal-stack/metal-lib/httperrors"
)

Expand Down Expand Up @@ -317,7 +322,7 @@ func (r *imageResource) createImage(request *restful.Request, response *restful.
}
}

err = checkImageURL(requestPayload.ID, requestPayload.URL)
err = checkImageURL(requestPayload.ID, requestPayload.URL, nil)
if err != nil {
r.sendError(request, response, httperrors.BadRequest(err))
return
Expand Down Expand Up @@ -346,15 +351,40 @@ func (r *imageResource) createImage(request *restful.Request, response *restful.
r.send(request, response, http.StatusCreated, v1.NewImageResponse(img))
}

func checkImageURL(id, url string) error {
// nolint
res, err := http.Head(url)
func checkImageURL(id, inputURL string, ociCredentials authn.Authenticator) error {
parsedURL, err := url.Parse(inputURL)
if err != nil {
return fmt.Errorf("image:%s is not accessible under:%s error:%w", id, url, err)
return fmt.Errorf("inputURL: %q could not be parsed, error: %w", inputURL, err)
}
if res.StatusCode >= 400 {
return fmt.Errorf("image:%s is not accessible under:%s status:%s", id, url, res.Status)

switch parsedURL.Scheme {
case "http", "https":
res, err := http.Head(parsedURL.String())
if err != nil {
return fmt.Errorf("image: %q is not accessible under:%s, error: %w", id, inputURL, err)
}
if res.StatusCode >= 400 {
return fmt.Errorf("image:%q is not accessible under:%s, status:%s", id, inputURL, res.Status)
}
case "oci":
parsedURLWithoutScheme := strings.TrimPrefix(parsedURL.String(), "oci://")
ref, err := name.ParseReference(parsedURLWithoutScheme)
if err != nil {
return fmt.Errorf("image reference: %q could not be parsed, error: %w", inputURL, err)
}

if ociCredentials == nil {
ociCredentials = authn.Anonymous
}

_, err = remote.Image(ref, remote.WithAuth(ociCredentials))
if err != nil {
return fmt.Errorf("image: %q is not accessible under: %s, error: %w", id, inputURL, err)
}
default:
return fmt.Errorf("image: %q with url: %s has unknown protocol", id, inputURL)
}

return nil
}

Expand Down Expand Up @@ -411,7 +441,7 @@ func (r *imageResource) updateImage(request *restful.Request, response *restful.
newImage.Description = *requestPayload.Description
}
if requestPayload.URL != nil {
err = checkImageURL(requestPayload.ID, *requestPayload.URL)
err = checkImageURL(requestPayload.ID, *requestPayload.URL, nil)
if err != nil {
r.sendError(request, response, httperrors.BadRequest(err))
return
Expand Down
44 changes: 43 additions & 1 deletion cmd/metal-api/internal/service/image-service_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -108,6 +108,48 @@ func TestDeleteImage(t *testing.T) {
require.Equal(t, testdata.Img3.Name, *result.Name)
}

func TestCheckImageURL(t *testing.T) {
t.Run("Invalid URL", func(t *testing.T) {
err := checkImageURL("testID", "http://invalid url", nil)
require.EqualError(t, err, "inputURL: \"http://invalid url\" could not be parsed, error: parse \"http://invalid url\": invalid character \" \" in host name")
})

t.Run("HTTP URL with successful HEAD request", func(t *testing.T) {
server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
w.WriteHeader(http.StatusOK)
}))
defer server.Close()

err := checkImageURL("testID", server.URL, nil)
require.NoError(t, err)
})

t.Run("HTTP URL with unsuccessful HEAD request", func(t *testing.T) {
server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
w.WriteHeader(http.StatusNotFound)
}))
defer server.Close()

err := checkImageURL("testID", server.URL, nil)
require.EqualError(t, err, "image:\"testID\" is not accessible under:"+server.URL+", status:404 Not Found")
})

t.Run("Unsupported scheme", func(t *testing.T) {
err := checkImageURL("testID", "ftp://unsupported.url", nil)
require.EqualError(t, err, "image: \"testID\" with url: ftp://unsupported.url has unknown protocol")
})

t.Run("valid OCI URL", func(t *testing.T) {
err := checkImageURL("testID", "oci://ghcr.io/metal-stack/debian:latest", nil)
require.NoError(t, err)
})

t.Run("OCI URL with invalid reference", func(t *testing.T) {
err := checkImageURL("testID", "oci://inva lid", nil)
require.EqualError(t, err, "inputURL: \"oci://inva lid\" could not be parsed, error: parse \"oci://inva lid\": invalid character \" \" in host name")
})
}

func TestCreateImage(t *testing.T) {
ds, mock := datastore.InitMockDB(t)
testdata.InitMockDBData(mock)
Expand Down Expand Up @@ -202,7 +244,7 @@ func TestCreateImageWithBrokenURL(t *testing.T) {

err = json.NewDecoder(resp.Body).Decode(&result)
require.NoError(t, err)
require.Equal(t, "image:image-1 is not accessible under:http://images.metal-stack.io/this-file-does-not-exist status:404 Not Found", result.Message)
require.Equal(t, "image:\"image-1\" is not accessible under:http://images.metal-stack.io/this-file-does-not-exist, status:404 Not Found", result.Message)
}

func TestCreateImageWithClassification(t *testing.T) {
Expand Down
14 changes: 9 additions & 5 deletions cmd/metal-api/internal/service/partition-service.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -175,7 +175,7 @@ func (r *partitionResource) createPartition(request *restful.Request, response *
imageURL = *requestPayload.PartitionBootConfiguration.ImageURL
}

err = checkImageURL("image", imageURL)
err = checkImageURL("image", imageURL, nil)
Copy link
Copy Markdown
Contributor

@vknabel vknabel Apr 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same here and within that file: is nil intentional?

Copy link
Copy Markdown
Contributor Author

@mac641 mac641 Apr 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since we don't have any registry yet that needs authentication, but still want to support it, I can't think of a better way than passing over nil for now.

Feel free to suggest a solution that's more to your liking and I'm happy to add it.

Copy link
Copy Markdown
Contributor

@vknabel vknabel Apr 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not right now. Could you create an issue for this? Then we can tackle this in the future.

if err != nil {
r.sendError(request, response, httperrors.BadRequest(err))
return
Expand All @@ -186,7 +186,7 @@ func (r *partitionResource) createPartition(request *restful.Request, response *
kernelURL = *requestPayload.PartitionBootConfiguration.KernelURL
}

err = checkImageURL("kernel", kernelURL)
err = checkImageURL("kernel", kernelURL, nil)
if err != nil {
r.sendError(request, response, httperrors.BadRequest(err))
return
Expand Down Expand Up @@ -275,7 +275,10 @@ func (r *partitionResource) deletePartition(request *restful.Request, response *
}

func (r *partitionResource) updatePartition(request *restful.Request, response *restful.Response) {
var requestPayload v1.PartitionUpdateRequest
var (
requestPayload v1.PartitionUpdateRequest
)

err := request.ReadEntity(&requestPayload)
if err != nil {
r.sendError(request, response, httperrors.BadRequest(err))
Expand Down Expand Up @@ -303,7 +306,7 @@ func (r *partitionResource) updatePartition(request *restful.Request, response *
newPartition.Labels = requestPayload.Labels
}
if requestPayload.PartitionBootConfiguration.ImageURL != nil {
err = checkImageURL("image", *requestPayload.PartitionBootConfiguration.ImageURL)
err = checkImageURL("image", *requestPayload.PartitionBootConfiguration.ImageURL, nil)
if err != nil {
r.sendError(request, response, httperrors.BadRequest(err))
return
Expand All @@ -313,11 +316,12 @@ func (r *partitionResource) updatePartition(request *restful.Request, response *
}

if requestPayload.PartitionBootConfiguration.KernelURL != nil {
err = checkImageURL("kernel", *requestPayload.PartitionBootConfiguration.KernelURL)
err = checkImageURL("kernel", *requestPayload.PartitionBootConfiguration.KernelURL, nil)
if err != nil {
r.sendError(request, response, httperrors.BadRequest(err))
return
}

newPartition.BootConfiguration.KernelURL = *requestPayload.PartitionBootConfiguration.KernelURL
}
if requestPayload.PartitionBootConfiguration.CommandLine != nil {
Expand Down
7 changes: 7 additions & 0 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@ require (
github.com/emicklei/go-restful/v3 v3.13.0
github.com/go-openapi/spec v0.22.3
github.com/google/go-cmp v0.7.0
github.com/google/go-containerregistry v0.20.7
github.com/google/uuid v1.6.0
github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus v1.1.0
github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.3
Expand Down Expand Up @@ -55,6 +56,7 @@ require (
github.com/containerd/errdefs/pkg v0.3.0 // indirect
github.com/containerd/log v0.1.0 // indirect
github.com/containerd/platforms v0.2.1 // indirect
github.com/containerd/stargz-snapshotter/estargz v0.18.1 // indirect
github.com/coreos/go-oidc/v3 v3.17.0 // indirect
github.com/coreos/go-semver v0.3.1 // indirect
github.com/coreos/go-systemd/v22 v22.6.0 // indirect
Expand All @@ -63,7 +65,10 @@ require (
github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0 // indirect
github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
github.com/distribution/reference v0.6.0 // indirect
github.com/docker/cli v29.0.3+incompatible // indirect
github.com/docker/distribution v2.8.3+incompatible // indirect
github.com/docker/docker v28.5.2+incompatible // indirect
github.com/docker/docker-credential-helpers v0.9.3 // indirect
github.com/docker/go-connections v0.6.0 // indirect
github.com/docker/go-units v0.5.0 // indirect
github.com/ebitengine/purego v0.8.4 // indirect
Expand Down Expand Up @@ -123,6 +128,7 @@ require (
github.com/mattn/go-colorable v0.1.14 // indirect
github.com/mattn/go-isatty v0.0.20 // indirect
github.com/minio/minlz v1.0.1 // indirect
github.com/mitchellh/go-homedir v1.1.0 // indirect
github.com/moby/docker-image-spec v1.3.1 // indirect
github.com/moby/go-archive v0.1.0 // indirect
github.com/moby/patternmatcher v0.6.0 // indirect
Expand Down Expand Up @@ -165,6 +171,7 @@ require (
github.com/tailscale/hujson v0.0.0-20221223112325-20486734a56a // indirect
github.com/tklauser/go-sysconf v0.3.15 // indirect
github.com/tklauser/numcpus v0.10.0 // indirect
github.com/vbatts/tar-split v0.12.2 // indirect
github.com/xdg-go/pbkdf2 v1.0.0 // indirect
github.com/xdg-go/scram v1.1.2 // indirect
github.com/xdg-go/stringprep v1.0.4 // indirect
Expand Down
14 changes: 14 additions & 0 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,8 @@ github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
github.com/containerd/platforms v0.2.1 h1:zvwtM3rz2YHPQsF2CHYM8+KtB5dvhISiXh5ZpSBQv6A=
github.com/containerd/platforms v0.2.1/go.mod h1:XHCb+2/hzowdiut9rkudds9bE5yJ7npe7dG/wG+uFPw=
github.com/containerd/stargz-snapshotter/estargz v0.18.1 h1:cy2/lpgBXDA3cDKSyEfNOFMA/c10O1axL69EU7iirO8=
github.com/containerd/stargz-snapshotter/estargz v0.18.1/go.mod h1:ALIEqa7B6oVDsrF37GkGN20SuvG/pIMm7FwP7ZmRb0Q=
github.com/coreos/go-oidc/v3 v3.17.0 h1:hWBGaQfbi0iVviX4ibC7bk8OKT5qNr4klBaCHVNvehc=
github.com/coreos/go-oidc/v3 v3.17.0/go.mod h1:wqPbKFrVnE90vty060SB40FCJ8fTHTxSwyXJqZH+sI8=
github.com/coreos/go-semver v0.3.1 h1:yi21YpKnrx1gt5R+la8n5WgS0kCrsPp33dmEyHReZr4=
Expand All @@ -71,8 +73,14 @@ github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/r
github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc=
github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
github.com/docker/cli v29.0.3+incompatible h1:8J+PZIcF2xLd6h5sHPsp5pvvJA+Sr2wGQxHkRl53a1E=
github.com/docker/cli v29.0.3+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
github.com/docker/docker v28.5.2+incompatible h1:DBX0Y0zAjZbSrm1uzOkdr1onVghKaftjlSWt4AFexzM=
github.com/docker/docker v28.5.2+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
github.com/docker/docker-credential-helpers v0.9.3 h1:gAm/VtF9wgqJMoxzT3Gj5p4AqIjCBS4wrsOh9yRqcz8=
github.com/docker/docker-credential-helpers v0.9.3/go.mod h1:x+4Gbw9aGmChi3qTLZj8Dfn0TD20M/fuWy0E5+WDeCo=
github.com/docker/go-connections v0.6.0 h1:LlMG9azAe1TqfR7sO+NJttz1gy6KO7VJBh+pMmjSD94=
github.com/docker/go-connections v0.6.0/go.mod h1:AahvXYshr6JgfUJGdDCs2b5EZG/vmaMAntpSFH5BFKE=
github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
Expand Down Expand Up @@ -180,6 +188,8 @@ github.com/golang/snappy v1.0.0 h1:Oy607GVXHs7RtbggtPBnr2RmDArIsAefDwvrdWvRhGs=
github.com/golang/snappy v1.0.0/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
github.com/google/go-containerregistry v0.20.7 h1:24VGNpS0IwrOZ2ms2P1QE3Xa5X9p4phx0aUgzYzHW6I=
github.com/google/go-containerregistry v0.20.7/go.mod h1:Lx5LCZQjLH1QBaMPeGwsME9biPeo1lPx6lbGj/UmzgM=
github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
github.com/google/pprof v0.0.0-20240829160300-da1f7e9f2b25 h1:sEDPKUw6iPjczdu33njxFjO6tYa9bfc0z/QyB/zSsBw=
github.com/google/pprof v0.0.0-20240829160300-da1f7e9f2b25/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144=
Expand Down Expand Up @@ -301,6 +311,8 @@ github.com/metal-stack/v v1.0.3 h1:Sh2oBlnxrCUD+mVpzfC8HiqL045YWkxs0gpTvkjppqs=
github.com/metal-stack/v v1.0.3/go.mod h1:YTahEu7/ishwpYKnp/VaW/7nf8+PInogkfGwLcGPdXg=
github.com/minio/minlz v1.0.1 h1:OUZUzXcib8diiX+JYxyRLIdomyZYzHct6EShOKtQY2A=
github.com/minio/minlz v1.0.1/go.mod h1:qT0aEB35q79LLornSzeDH75LBf3aH1MV+jB5w9Wasec=
github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
github.com/moby/go-archive v0.1.0 h1:Kk/5rdW/g+H8NHdJW2gsXyZ7UnzvJNOy6VKJqueWdcQ=
Expand Down Expand Up @@ -429,6 +441,8 @@ github.com/tklauser/numcpus v0.10.0 h1:18njr6LDBk1zuna922MgdjQuJFjrdppsZG60sHGfj
github.com/tklauser/numcpus v0.10.0/go.mod h1:BiTKazU708GQTYF4mB+cmlpT2Is1gLk7XVuEeem8LsQ=
github.com/valyala/fastjson v1.6.7 h1:ZE4tRy0CIkh+qDc5McjatheGX2czdn8slQjomexVpBM=
github.com/valyala/fastjson v1.6.7/go.mod h1:CLCAqky6SMuOcxStkYQvblddUtoRxhYMGLrsQns1aXY=
github.com/vbatts/tar-split v0.12.2 h1:w/Y6tjxpeiFMR47yzZPlPj/FcPLpXbTUi/9H7d3CPa4=
github.com/vbatts/tar-split v0.12.2/go.mod h1:eF6B6i6ftWQcDqEn3/iGFRFRo8cBIMSJVOpnNdfTMFA=
github.com/xdg-go/pbkdf2 v1.0.0 h1:Su7DPu48wXMwC3bs7MCNG+z4FhcyEuz5dlvchbq0B0c=
github.com/xdg-go/pbkdf2 v1.0.0/go.mod h1:jrpuAogTd400dnrH08LKmI/xc1MbPOebTwRqcT5RDeI=
github.com/xdg-go/scram v1.1.2 h1:FHX5I5B4i4hKRVRBCFRxq1iQRej7WO3hhBuJf+UUySY=
Expand Down
Loading