# For more information on this configuration file, see containers-registries.conf(5).

#

# There are multiple versions of the configuration syntax available, where the

# second iteration is backwards compatible to the first one. Mixing up both

# formats will result in an runtime error.

#

# The initial configuration format looks like this:

#

# Registries to search for images that are not fully-qualified.

# i.e. foobar.com/my_image:latest vs my_image:latest

#

# NOTE: RISK OF USING UNQUALIFIED IMAGE NAMES.

# Pulling an image that is not fully qualified, i.e., one that includes the

# image name but does not include the registry or  tag, is not recommended.

# There is a risk that the image being pulled could be spoofed. An example

# of this would be if a user wanted to pull an image named `foobar` from a

# registry and expect it to come from myregistry.com.  If myregistry.com is

# not first in the search list, an attacker could place a different `foobar`

# image at a registry earlier in the search list.  Now you would accidentally

# run the attackers code rather than the intended content. Registries that

# are added to this list should be completely controlled, i.e., not allow

# unknown/arbitrary users being able to create accounts with arbitrary names

# to prevent an image from being spoofed, squatted or otherwise made

# insecure.  If it is necessary to use one of these registries, it should be

# added at the end of the list.

#

# It is recommended to use fully-qualified images for pulling as the

# destination registry is unambiguous. Pulling by digest

# (i.e., quay.io/repository/name@digest) further eliminates the ambiguity of

# tags.

[registries.search]

registries = ['registry.fedoraproject.org', 'registry.access.redhat.com', 'registry.centos.org', 'docker.io']

# Registries that do not use TLS when pulling images or uses self-signed

# certificates.

[registries.insecure]

registries = []

# Blocked Registries, blocks the `docker daemon` from pulling from the blocked registry.  If you specify

# "*", then the docker daemon will only be allowed to pull from registries listed above in the search

# registries.  Blocked Registries is deprecated because other container runtimes and tools will not use it.

# It is recommended that you use the trust policy file /etc/containers/policy.json to control which

# registries you want to allow users to pull and push from.  policy.json gives greater flexibility, and

# supports all container runtimes and tools including the docker daemon, cri-o, buildah ...

# The atomic CLI `atomic trust` can be used to easily configure the policy.json file.

[registries.block]

registries = []

# The second version of the configuration format allows to specify registry

# mirrors:

#

# NOTE: Please read the note about the risk of unqualified images identified above.

# # An array of host[:port] registries to try when pulling an unqualified image, in order.

# unqualified-search-registries = ["example.com"]

#

# [[registry]]

# # The "prefix" field is used to choose the relevant [[registry]] TOML table;

# # (only) the TOML table with the longest match for the input image name

# # (taking into account namespace/repo/tag/digest separators) is used.

# #

# # If the prefix field is missing, it defaults to be the same as the "location" field.

# prefix = "example.com/foo"

#

# # If true, unencrypted HTTP as well as TLS connections with untrusted

# # certificates are allowed.

# insecure = false

#

# # If true, pulling images with matching names is forbidden.

# blocked = false

#

# # The physical location of the "prefix"-rooted namespace.

# #

# # By default, this equal to "prefix" (in which case "prefix" can be omitted

# # and the [[registry]] TOML table can only specify "location").

# #

# # Example: Given

# #   prefix = "example.com/foo"

# #   location = "internal-registry-for-example.net/bar"

# # requests for the image example.com/foo/myimage:latest will actually work with the

# # internal-registry-for-example.net/bar/myimage:latest image.

# location = internal-registry-for-example.com/bar"

#

# # (Possibly-partial) mirrors for the "prefix"-rooted namespace.

# #

# # The mirrors are attempted in the specified order; the first one that can be

# # contacted and contains the image will be used (and if none of the mirrors contains the image,

# # the primary location specified by the "registry.location" field, or using the unmodified

# # user-specified reference, is tried last).

# #

# # Each TOML table in the "mirror" array can contain the following fields, with the same semantics

# # as if specified in the [[registry]] TOML table directly:

# # - location

# # - insecure

# [[registry.mirror]]

# location = "example-mirror-0.local/mirror-for-foo"

# [[registry.mirror]]

# location = "example-mirror-1.local/mirrors/foo"

# insecure = true

# # Given the above, a pull of example.com/foo/image:latest will try:

# # 1. example-mirror-0.local/mirror-for-foo/image:latest

# # 2. example-mirror-1.local/mirrors/foo/image:latest

# # 3. internal-registry-for-example.net/bar/myimage:latest

# # in order, and use the first one that exists.