push just a manifest to a remote

[deitch]

Is there a way to push just a manifest to a remote? I can write a layer. I also can write a whole image or index, which (by looking at the code, appear to) actually write the individual layers.

The simplest use case is if I have a manifest that points to blobs that already are in the remote registry. I don't want to pull and push the whole image, just to create either a new (slightly different) manifest (image/index) for the root with a different tag, or even the identical manifest (image/index) with a different tag.

[jonjohnsonjr]

I believe remote.Tag does what you want. I've updated the godoc in the linked PR to (hopefully) make this clearer.

[deitch]

Hmm. Is there a practical example?

[jonjohnsonjr]

We use this to implement crane tag: https://github.com/google/go-containerregistry/blob/master/pkg/crane/tag.go

If you're interested in something like this that just pushes by digest, it doesn't exist, but it seems like you are okay with just tag?

[jonjohnsonjr]

Arguably, this should have been named remote.WriteTag so that it's more easily recognizable as a write method, but at the time I was thinking of the verb form of tag. I have very mild regrets about this, but I think it's fine.

[deitch]

Oh excellent. Thank you. Closing this out.

[deitch]

I was sure there was a bug, because it kept erroring, but I realized that it was defaulting to anonymous auth. Is there some painfully obvious way from here that I am just missing for authenticating using your default docker credentials, whatever they are?

[jonjohnsonjr]

The magic incantation you want is remote.WithAuthFromKeychain(authn.DefaultKeychain).

The name is too long, and I'd like to add remote.WithKeychain to make it a bit easier to type.

[deitch]

Magic indeed.

[jonjohnsonjr]

This is documented here but let me know what we can improve to make this more discoverable.

My thinking was that by default, we don't want to read and transmit credentials over the internet, even if that's what you usually want to do. Making this explicit requires you to wire this up yourself and shifts some of that custody responsibility onto the library consumer. I think it would be even more magic if it just worked by default :P