Crane

Problem¶

Pulp allows to distribute Docker content via rsync to a remote server. There is a possible scenario where a Crane instance is running on this remote server to provide a local Docker registry.

Currently in this scenario Crane would serve 302 redirects to the actual files served by a web server on the same machine.

This creates a problem when trying to restrict access to these files:

• The Docker client is able to handle basic authentication, when accessing a registry. However when the Docker client follows a redirect it seems to forget any authentication data. Thus with Crane it is possible to restrict access to the 302 redirects but not to the actual files.

Solution¶

• Add an option to Crane to either serve Files locally or provide redirects.
• Use "X-Sendfile" support of flask when serving locally.
• Support V1 and V2 Docker API versions