Shortnames are broken in 3.0.0 due to missing list of unqualified-search registries #9390

edigaryev · 2021-02-15T21:37:28Z

Shortname aliasing support has now been turned on by default. All Podman commands that must pull an image will, if a TTY is available, prompt the user about what image to pull.

As described in the RedHat blog about this feature, the user can expect some form of fallback in case no shortname alias is defined:

If no matching alias is found, Podman will now prompt the user to choose one of the unqualified-search registries.

However, because the 3.0.0 installation is missing these registries, pulling python:latest (or any other image not currently included in the shortnames list) results in an unexpected result:

$ podman version
Version:      3.0.0
API Version:  3.0.0
Go Version:   go1.14
Built:        Thu Jan  1 03:00:00 1970
OS/Arch:      linux/amd64
$ podman pull python:latest
Error: error getting default registries to try: short-name "python:latest" did not resolve to an alias and no unqualified-search registries are defined in ""

The package that presumably should ship the registries configuration:

$ dpkg -l | grep containers-common
ii  containers-common                100:1-7                           all          Configuration files for working with image signatures.
$ dpkg -L containers-common
/.
/etc
/etc/containers
/etc/containers/containers.conf
/etc/containers/policy.json
/etc/containers/registries.conf.d
/etc/containers/registries.conf.d/shortnames.conf
/etc/containers/registries.d
/etc/containers/registries.d/default.yaml
/etc/containers/storage.conf
/usr
/usr/share
/usr/share/containers
/usr/share/containers/containers.conf
/usr/share/doc
/usr/share/doc/containers-common
/usr/share/doc/containers-common/changelog.Debian.gz
/usr/share/doc/containers-common/copyright
/usr/share/man
/usr/share/man/man5
/usr/share/man/man5/containers-auth.json.5.gz
/usr/share/man/man5/containers-certs.d.5.gz
/usr/share/man/man5/containers-mounts.conf.5.gz
/usr/share/man/man5/containers-policy.json.5.gz
/usr/share/man/man5/containers-registries.conf.5.gz
/usr/share/man/man5/containers-registries.conf.d.5.gz
/usr/share/man/man5/containers-registries.d.5.gz
/usr/share/man/man5/containers-signature.5.gz
/usr/share/man/man5/containers-storage.conf.5.gz
/usr/share/man/man5/containers-transports.5.gz
/usr/share/man/man5/containers.conf.5.gz
/var
/var/lib
/var/lib/containers
/var/lib/containers/sigstore

It would be nice if this list would be included and contain at least something like:

unqualified-search-registries=["docker.io"]

...to adhere to the principle of least astonishment.

The text was updated successfully, but these errors were encountered:

rhatdan · 2021-02-15T22:04:47Z

Is this on Debian? Ubuntu?

The registries.conf file is invalid it should have at least that registry in the list/

mheon · 2021-02-15T22:06:06Z

I think this is a dupe, but I can't find the other bug.

Regardless, this is not the first I've heard of this - it seems like we're having packaging issues in OBS. @lsm5 PTAL

edigaryev · 2021-02-15T22:16:33Z

Is this on Debian? Ubuntu?

The registries.conf file is invalid it should have at least that registry in the list/

I'm observing this on both distros, the repos are:

The https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/Debian_10/all/containers-common_1-7_all.deb file doesn't seem to contain registries.conf at all.

* Work around containers/podman#9390 * Work around containers/podman#9393 * Stream launched container's logs to the CLI's logger * Work around containers/podman#9351 * Ignore bodyclose linter false-positive * .cirrus.yml: run "go test" on Windows verbosely * Use sub-context for the ContainerLogs() call To avoid potential hangs in stdcopy.StdCopy(). * ContainerLogs: use buffered channels To avoid a case when stdcopy.StdCopy() waits for the io.Pipe() to unlock, while the connection from which it reads the logs gets closed. This presumably results in the tail part of the logs getting lost. * TestContainerLogs: skip last line check for Podman

lsm5 · 2021-02-16T20:48:54Z

Should be fixed with podman 100:3.0.0-3. Building on OBS atm: https://build.opensuse.org/package/show/devel:kubic:libcontainers:stable/podman . Will be available hopefully in an hour or less.

I'll keep the bug open for now. Please close it if this resolves your issue.

edigaryev · 2021-02-17T02:06:18Z

I'll keep the bug open for now. Please close it if this resolves your issue.

Thanks! Closing because it works now.

Giszmo · 2021-07-08T02:55:05Z

$ podman --version
podman version 3.0.1
$ podman pull python:latest
Error: error getting default registries to try: short-name "python:latest" did not resolve to an alias and no unqualified-search registries are defined in "/etc/containers/registries.conf"

Is this issue back? Maybe the message should suggest what most people probably want anyway: "Try docker.io/python:latest instead".

rhatdan · 2021-07-08T11:56:50Z

This is up to the distribution to decide. We don't want to force user to docker.io. A reasonable site might decide to have no default registry, so this error message is valid.

Giszmo · 2021-07-08T19:40:50Z

@rhatdan yours is the principled approach but it's also ignorant to people who just want to get things done. I lost 20 minutes on this because I didn't know if docker uses hub.docker.com or docker.io or ... as default and neither did I know how to provide the url. Is it url:image:version or url/with/repo/path:image:version, ... I never cared and never had to and when searching for a python image, the run instructions usually do not include that part neither.

The current error message is just a terrible time-waster and frustrates the user, especially if he's trying to migrate from docker where it "just works". Add a link to an explainer with examples please!

vrothberg · 2021-07-09T07:58:56Z

Note that there is a security issue behind these changes: https://www.redhat.com/sysadmin/container-image-short-names

Which distribution are you running on, @Giszmo?

I sympathize with the frustration but our hands are tied. Do you think pointing to the containers-registries.conf(5) man page in the error message would have helped you resolve the issue faster?

For the record, the fix in this case would be adding the following line to /etc/containers/registries.conf:
unqualified-search-registries=["docker.io"]

rhatdan · 2021-07-09T14:23:01Z

@Giszmo How did you get the Podman that you are using? I would figure most naive users get their Podman from a distribution? If a distribution gave you a version without a configured registry, then I could see this as a problem.

If you just grabbed the static version, then you have a point, but there are lots of config files that we need that are not shipped with a static version.

Giszmo · 2021-07-10T03:12:39Z

I run podman on my Ubuntu 20.04. So if others have the same issue, Ubuntu should be poked. I'm fine with @vrothberg's config I guess. Thanks.

rhatdan · 2021-07-10T10:36:16Z

Where did you get the Podman from? It looks like it did not pull in containers-common which should have the registries.conf settings.

Giszmo · 2021-07-10T22:25:31Z

@rhatdan:

$ sudo apt search containers-common
Sorting... Done
Full Text Search... Done
golang-github-containers-common/hirsute,hirsute,now 0.33.4+ds1-1 all [installed,automatic]
  Common files for github.com/containers repositories

golang-github-containers-common-dev/hirsute,hirsute 0.33.4+ds1-1 all
  Common files for github.com/containers repositories (library)
$ sudo apt list podman
Listing... Done
podman/hirsute,now 3.0.1+dfsg1-1ubuntu1 amd64 [installed]

what exactly should I check?

rhatdan · 2021-07-11T10:36:47Z

I don't know apt, but this looks like containers-common is installed, did it come with a registries.conf file?

@lsm5 PTAL

Giszmo · 2021-07-11T17:23:21Z

The podman package did come with a registries.conf ... in /usr/share/doc/podman/examples/registries.conf.

podman depends on golang-github-containers-common which comes with:

$ dpkg -L golang-github-containers-common | grep 'conf$'
/etc/containers/registries.conf.d/shortnames.conf
/usr/share/containers/containers.conf
/etc/containers/containers.conf

but those define no such defaults:

$ cat /etc/containers/registries.conf.d/shortnames.conf | grep -v '^#\|^$'
[aliases]
  # centos
  "centos" = "registry.centos.org/centos"
  # containers
  "skopeo" = "quay.io/skopeo/stable"
  "buildah" = "quay.io/buildah/stable"
  "podman" = "quay.io/podman/stable"
  # docker
  "alpine" = "docker.io/library/alpine"
  "docker" = "docker.io/library/docker"
  "registry" = "docker.io/library/registry"
  "hello-world" = "docker.io/library/hello-world"
  "swarm" = "docker.io/library/swarm"
  # Fedora
  "fedora-minimal" = "registry.fedoraproject.org/fedora-minimal"
  "fedora" = "registry.fedoraproject.org/fedora"
  # openSUSE
  "opensuse/tumbleweed" = "registry.opensuse.org/opensuse/tumbleweed"
  "opensuse/leap" = "registry.opensuse.org/opensuse/leap"
  "opensuse/busybox" = "registry.opensuse.org/opensuse/busybox"
  "tumbleweed" = "registry.opensuse.org/opensuse/tumbleweed"
  "leap" = "registry.opensuse.org/opensuse/leap"
  "tw-busybox" = "registry.opensuse.org/opensuse/busybox"
  # SUSE
  "suse/sle15" = "registry.suse.com/suse/sle15"
  "suse/sles12sp5" = "registry.suse.com/suse/sles12sp5"
  "suse/sles12sp4" = "registry.suse.com/suse/sles12sp4"
  "suse/sles12sp3" = "registry.suse.com/suse/sles12sp3"
  "sle15" = "registry.suse.com/suse/sle15"
  "sles12sp5" = "registry.suse.com/suse/sles12sp5"
  "sles12sp4" = "registry.suse.com/suse/sles12sp4"
  "sles12sp3" = "registry.suse.com/suse/sles12sp3"
  # Red Hat Enterprise Linux
  "rhel" = "registry.access.redhat.com/rhel"
  "rhel6" = "registry.access.redhat.com/rhel6"
  "rhel7" = "registry.access.redhat.com/rhel7"
  "ubi7" = "registry.access.redhat.com/ubi7"
  "ubi7-init" = "registry.access.redhat.com/ubi7-init"
  "ubi7-minimal" = "registry.access.redhat.com/ubi7-minimal"
  "ubi8" = "registry.access.redhat.com/ubi8"
  "ubi8-minimal" = "registry.access.redhat.com/ubi8-minimal"
  "ubi8-init" = "registry.access.redhat.com/ubi8-init"
  # Debian
  "debian" = "docker.io/library/debian"
  # Ubuntu
  "ubuntu" = "docker.io/library/ubuntu"
$ cat /usr/share/containers/containers.conf | grep -v '^#\|^$'
[containers]
default_capabilities = [
    "CHOWN",
    "DAC_OVERRIDE",
    "FOWNER",
    "FSETID",
    "KILL",
    "NET_BIND_SERVICE",
    "SETFCAP",
    "SETGID",
    "SETPCAP",
    "SETUID",
    "SYS_CHROOT"
]
default_sysctls = [
 "net.ipv4.ping_group_range=0 0",
]
[network]
[engine]
[engine.runtimes]
[engine.volume_plugins]
$ cat /etc/containers/containers.conf | grep -v '^#\|^$'
[containers]
[network]
[engine]
[engine.runtimes]

so if I read that correctly, it makes things work as with docker before, for select few images (alpine, hello-world, ...) but does not default to docker.io for non-listed images.

rhatdan · 2021-07-11T17:58:54Z

Right this is a packaging issue with Ubuntu. It should ship /etc/containers/registries.comf

alexander-manley · 2021-10-22T23:42:46Z

Quick fix for the majority of users is to alter one line:
sudo vim /etc/containers/registries.conf
unqualified-search-registries=["docker.io"]

pgampe · 2021-11-16T14:03:27Z

Even better, add a file /etc/containers/registries.conf.d/docker.conf with just the line unqualified-search-registries=["docker.io"]

BiggerPicture2 · 2023-01-06T20:14:55Z

Quick fix for the majority of users is to alter one line: sudo vim /etc/containers/registries.conf unqualified-search-registries=["docker.io"]

So for this issue do we edit the .conf or the .conf.d?

rhatdan · 2023-01-06T20:24:47Z

Either is fine.

BiggerPicture2 · 2023-01-06T21:47:17Z

unqualified-search-registries=["docker.io"]
This is the error i get after updating the conf file

rhatdan · 2023-01-06T22:11:09Z

I guess you need to edit the registries.conf, or there is something wrong with the file.

BiggerPicture2 · 2023-01-06T22:23:46Z

I guess you need to edit the registries.conf, or there is something wrong with the file.

This is what my file consist of

vrothberg · 2023-01-09T08:48:49Z

It looks more like the /etc/containers/registries.conf.d/shortnames.conf file has an issue.

BiggerPicture2 · 2023-01-09T14:57:18Z

It looks more like the /etc/containers/registries.conf.d/shortnames.conf file has an issue.

vrothberg · 2023-01-09T15:13:01Z

@BiggerPicture2, the last line 79 shouldn't be there. shortnames.conf should only be for shortnames.

BiggerPicture2 · 2023-01-09T15:19:57Z

Thanks for the help, idk where the error is coming from. maybe its my ubuntu and nvidia/cuda runtime

vrothberg · 2023-01-09T15:21:52Z

Without a reproducer and/or the exact file, there's not much I can do.

The error message includes the path to the config file that fails to be loaded.

BiggerPicture2 · 2023-01-09T15:26:54Z

you would need to see the container file or the shortnames.conf?

BiggerPicture2 · 2023-01-09T16:48:34Z

Without a reproducer and/or the exact file, there's not much I can do.

The error message includes the path to the config file that fails to be loaded.

Yeah its most likely the container file now. It says it built the image but this error is unusual.

ryanotella · 2023-04-11T02:05:05Z

For Podman Desktop on MacOS you can get the docker behaviour...
https://www.linkedin.com/pulse/podman-installation-macos-vikas-sharma

rhatdan assigned lsm5 Feb 15, 2021

edigaryev added a commit to cirruslabs/cirrus-cli that referenced this issue Feb 16, 2021

Work around containers/podman#9390

0b78d8b

lsm5 added In Progress This issue is actively being worked by the assignee, please do not work on this at this time. Packaging Bug is in a Podman package labels Feb 16, 2021

edigaryev mentioned this issue Feb 16, 2021

Podman: remove missing search registries workaround cirruslabs/cirrus-cli#296

Merged

edigaryev closed this as completed Feb 17, 2021

christophetd mentioned this issue Dec 20, 2021

docker build problem on kali linux christophetd/log4shell-vulnerable-app#23

Closed

Jayy001 mentioned this issue Oct 2, 2022

install in docker error Ciphey/Ciphey#749

Open

github-actions bot added the locked - please file new issue/PR Assist humans wanting to comment on an old issue or PR with locked comments. label Aug 27, 2023

github-actions bot locked as resolved and limited conversation to collaborators Aug 27, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Shortnames are broken in 3.0.0 due to missing list of unqualified-search registries #9390

Shortnames are broken in 3.0.0 due to missing list of unqualified-search registries #9390

edigaryev commented Feb 15, 2021 •

edited

Loading

rhatdan commented Feb 15, 2021

mheon commented Feb 15, 2021

edigaryev commented Feb 15, 2021

lsm5 commented Feb 16, 2021

edigaryev commented Feb 17, 2021

Giszmo commented Jul 8, 2021

rhatdan commented Jul 8, 2021

Giszmo commented Jul 8, 2021

vrothberg commented Jul 9, 2021 •

edited

Loading

rhatdan commented Jul 9, 2021

Giszmo commented Jul 10, 2021

rhatdan commented Jul 10, 2021

Giszmo commented Jul 10, 2021

rhatdan commented Jul 11, 2021

Giszmo commented Jul 11, 2021 •

edited

Loading

rhatdan commented Jul 11, 2021

alexander-manley commented Oct 22, 2021

pgampe commented Nov 16, 2021

BiggerPicture2 commented Jan 6, 2023

rhatdan commented Jan 6, 2023

BiggerPicture2 commented Jan 6, 2023

rhatdan commented Jan 6, 2023

BiggerPicture2 commented Jan 6, 2023

vrothberg commented Jan 9, 2023

BiggerPicture2 commented Jan 9, 2023

vrothberg commented Jan 9, 2023

BiggerPicture2 commented Jan 9, 2023

vrothberg commented Jan 9, 2023

BiggerPicture2 commented Jan 9, 2023

BiggerPicture2 commented Jan 9, 2023

ryanotella commented Apr 11, 2023

Shortnames are broken in 3.0.0 due to missing list of unqualified-search registries #9390

Shortnames are broken in 3.0.0 due to missing list of unqualified-search registries #9390

Comments

edigaryev commented Feb 15, 2021 • edited Loading

rhatdan commented Feb 15, 2021

mheon commented Feb 15, 2021

edigaryev commented Feb 15, 2021

lsm5 commented Feb 16, 2021

edigaryev commented Feb 17, 2021

Giszmo commented Jul 8, 2021

rhatdan commented Jul 8, 2021

Giszmo commented Jul 8, 2021

vrothberg commented Jul 9, 2021 • edited Loading

rhatdan commented Jul 9, 2021

Giszmo commented Jul 10, 2021

rhatdan commented Jul 10, 2021

Giszmo commented Jul 10, 2021

rhatdan commented Jul 11, 2021

Giszmo commented Jul 11, 2021 • edited Loading

rhatdan commented Jul 11, 2021

alexander-manley commented Oct 22, 2021

pgampe commented Nov 16, 2021

BiggerPicture2 commented Jan 6, 2023

rhatdan commented Jan 6, 2023

BiggerPicture2 commented Jan 6, 2023

rhatdan commented Jan 6, 2023

BiggerPicture2 commented Jan 6, 2023

vrothberg commented Jan 9, 2023

BiggerPicture2 commented Jan 9, 2023

vrothberg commented Jan 9, 2023

BiggerPicture2 commented Jan 9, 2023

vrothberg commented Jan 9, 2023

BiggerPicture2 commented Jan 9, 2023

BiggerPicture2 commented Jan 9, 2023

ryanotella commented Apr 11, 2023

edigaryev commented Feb 15, 2021 •

edited

Loading

vrothberg commented Jul 9, 2021 •

edited

Loading

Giszmo commented Jul 11, 2021 •

edited

Loading