repository·main·Indexed 26 days ago
https://github.com/google/go-containerregistryA Go library for interacting with container registries, providing immutable abstractions for images, layers, and image indexes. It includes tools like crane, gcrane, and krane for managing container artifacts across remote registries, local filesystems, and container daemons, as well as support for various authentication keychains including k8schain for Kubernetes environments.
layout package provides support for interacting with the OCI Image Layout specification. Use this package when you need to read from or write to local directories that follow the OCI image layout format.The pkg/registry package implements a Docker v2 registry and the OCI distribution specification. It is designed for scenarios requiring a low-dependency container registry, primarily intended for use in tests.
Note on Production Use: This package is currently considered a "low flightmiles system." While it is suitable for testing, use in production environments is at your own risk. If you intend to use it in production, the maintainers request that you provide feedback and submit PRs for integration tests.
krane is a drop-in replacement for crane that supports common Kubernetes-based workload identity mechanisms. It uses k8schain as a fallback to traditional authentication methods.krane is a variant of the crane tool designed to support authentication against registries using common credential helpers that retrieve credentials from the environment.
It is specifically built to support "workload identity" mechanisms on platforms like GKE (Google Kubernetes Engine) and EKS (Amazon Elastic Kubernetes Service).
Key Behavior:
crane.crane would otherwise attempt the command without credentials.The google package provides specialized support for interacting with Google Container Registry (GCR). It includes:
gcr.io registries.v1.Image, v1.ImageIndex, and v1.Layer interfaces are immutable and only provide accessor methods. To modify an image, you must use the mutate package to produce a new instance of the interface. A typical workflow involves reading an image from a source, applying mutations, and writing the resulting image to a sink.Crane is a CLI tool designed for managing container images. It provides a variety of commands for interacting with remote registries, such as copying, tagging, pulling, and pushing images, often without needing to download the full image content locally.
crane [flags]daemon package allows you to read and write container images directly from or to a running Docker daemon. This is useful for interoperability between the go-containerregistry library and local Docker environments. Note that this package is not yet fully featured and may have limitations.The empty package provides an empty base for constructing a v1.Image or v1.ImageIndex. This is primarily used as a starting point when building new container images or manifests from scratch, typically in conjunction with the mutate package.
Common use cases include:
mutate.Append to add layers to an empty image.mutate.AppendManifests to build an image index (multi-arch manifest) starting from an empty index.The library is designed around immutable interfaces that represent container resources. These interfaces can be backed by various mediums such as remote registries, local tarballs, or the local container daemon.
Key interfaces include:
v1.Image: Represents a container image.v1.ImageIndex: Represents an image index (e.g., for multi-architecture images).v1.Layer: Represents a single layer within an image.Most operations follow a pattern of reading from a 'Source' and writing to a 'Sink'. For example, crane pull reads from a remote.Image and writes to a tarball.Write.
gcrane is a variant of crane optimized for GCR. It provides richer output for the ls subcommand and includes basic support for garbage collection.The authn package supports two primary methods for authenticating against a container registry to acquire a Bearer token for the Authorization header:
AuthConfig containing a Username/Password or Auth field. This is the standard approach for basic authentication challenges.AuthConfig containing an IdentityToken.Note on OAuth 2 implementation: The package specifically supports the refresh_token grant_type for OAuth 2. This is triggered when a credential helper returns a response where the Username is set to the literal string <token>.