novox/mesh-catalog
18
0
Fork 0
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

docker: trust the store at the image seat's reach (ADR 0632 §1; issue 1966)

Browse Source 
Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig
This commit is contained in:
jschoubben
2026-11-04 21:11:15 +01:00
parent 1bf98663c6
commit bbb9e37df4
3 changed files with 10 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/docker/README.md
+3 -3
View File
@@ -36,10 +36,10 @@ either. Under ADR 0196 a container copies its machine's resolvers, so no module
controller's private network wrote `insecure-registries`; under ADR 0222 the controller writes controller's private network wrote `insecure-registries`; under ADR 0222 the controller writes
nothing into this file, and this module states the registry itself (the order below). nothing into this file, and this module states the registry itself (the order below).
- `daemon`: `{"live-restore": true, "insecure-registries": ["${seat:mesh-artifact-store:reach}"]}`, - `daemon`: `{"live-restore": true, "insecure-registries": ["${seat:container-image-registry:reach}"]}`,
merged into the file beside the keys others write. merged into the file beside the keys others write.
- `${seat:mesh-artifact-store:reach}` is where this machine reaches the mesh's artifact store - `${seat:container-image-registry:reach}` is where this machine reaches the mesh's artifact store
(host:port), filled in by the controller: no binding, no credential, the same address the mesh (host:port), the image seat holder's listen open to the mesh (ADR 0632 §1), filled in by the node-engine: no binding, no credential, the same address the mesh
composes into every image it built. Trusting it in the clear is ADR 0082's decision: every path to composes into every image it built. Trusting it in the clear is ADR 0082's decision: every path to
it is inside the private network's encryption. While no machine on the network holds the store the it is inside the private network's encryption. While no machine on the network holds the store the
answer is empty, and the controller drops the empty member, so the list gets nothing. answer is empty, and the controller drops the empty member, so the list gets nothing.
modules/docker/cmd/docker-tools/logrotation_test.go
+6 -1
View File
@@ -68,7 +68,12 @@ func filled(t *testing.T, m manifestForLogs, content string) string {
if len(missing) > 0 { if len(missing) > 0 {
t.Fatalf("the content asks for %v, which the manifest gives no preference default", missing) t.Fatalf("the content asks for %v, which the manifest gives no preference default", missing)
} }
return strings.ReplaceAll(out, "${seat:mesh-artifact-store:reach}", "registry.example:5100") // The store's address is the image seat holder's listen (novox/hq ADR 0632 §1), never the retired provision's.
const reach = "${seat:container-image-registry:reach}"
if strings.Contains(content, "insecure-registries") && !strings.Contains(content, reach) {
t.Fatalf("the runtime trusts no %s: %s", reach, content)
}
return strings.ReplaceAll(out, reach, "registry.example:5100")
} }
func TestTheDefaultLogRotationIsTheOneTheHandSetMachineHas(t *testing.T) { func TestTheDefaultLogRotationIsTheOneTheHandSetMachineHas(t *testing.T) {
modules/docker/files/daemon.json
+1 -1
View File
@@ -1 +1 @@
{"live-restore": true, "insecure-registries": ["${seat:mesh-artifact-store:reach}"], "log-driver": "json-file", "log-opts": {"max-size": "${config:log-max-size}", "max-file": "${config:log-max-file}"}} {"live-restore": true, "insecure-registries": ["${seat:container-image-registry:reach}"], "log-driver": "json-file", "log-opts": {"max-size": "${config:log-max-size}", "max-file": "${config:log-max-file}"}}