Pulp

# Pulp Container Roadmap

~~~

This is a living document that is moving towards a long term plan to develop Container plugin for Pulp 3.0 and beyond.

~~~

~~~

With Pulp as a Container registry you can:

- Mirror container image repositories hosted on Docker-hub, Google Container Registry, Quay.io, etc

- Reduce disk use space by mirroring container image repositories using the "on demand" policy. An image is only downloaded once it has been requested by a client.

- Use local filesystem or an object storage store such as S3 to host all the container images TBD

- Curate container images by whitelisting what is mirrored from an external repository.

- Curate container images by creating repository versions with a specific set of images.

- Create versioned repositories that can be promoted or rolled back with a single operation.

Pulp also has:

- tasking system that can be used to perform a variety of specialized work such as analysis of content. e.g. integration with clair-scanner

- a large community of users

- a commuity of plugin developers

~~~

<span style="color: #458b74;">green</span>

### MVP

## Supported Content Types

  - <span style="color: #458b74;">Docker Image manifest schema2 and schema1</span>

  - {color: #458b74} Docker Manifest list

  - {color: #458b74} Docker Blob

  - {color: #458b74} OCI Image manifest schema1

  - {color: #458b74} OCI Image index

  - {color: #458b74} OCI Blob

  - {color: #458b74} Image Tag

## Pulp Container Plugin Use Cases

### MVP

##### Sync

  - <span style="color: #458b74;">As a user I can sync container repo from Container registry</span>

<!-- end list -->

  - {color: #458b74} assumes registry is compliant v2 api specs

  - {color: #458b74} with token based auth

  - {color: #458b74} with basic auth

  - {color: #458b74} specify \`feed\` and \`upstream_name\`

<!-- end list -->

  - {color: #458b74} As a user I can sync a registry by whitelisting tags ( Filtered Sync)

  - {color: #458b74} As a user i can lazily fetch container repo by specifying the download policy

  - {color: #458b74} As a user I can sync a private container repo from Container registry

  - {color: #458b74} As a user I can sync from a container repo published by Pulp ( pulp2pulp3 and pulp3pulp3 sync)

  - {color: #458b74} As a user, I can mirror the content of a remote repository with an additive behaviour, so content is never removed locally.

**NOTE**: dropping enable_v1, enable_v2, mask_id options

##### Publish

  - {color: #458b74} As a user I can distribute container content

  - {color: #458b74} As a user, I can specify publish_directory( i.e base_path) from which the content will be served( provided by pulp_core)

  - {color: #458b74} As a user, I can specify base_path that will be used in the Container registry

  - {color: #458b74} As a user I can pull docker content with older client (Pulp will convert on the fly docker image schema2 to schema1)

  - {color: #458b74} As a user I cam pull from Container registry that has auth mechanism  

    \*token auth

As a result the above section should enable clients to perform \`docker/podman pull\`

**NOTE** dropping protected option

##### Filtering

  - {color: #458b74} As a user I can filter tags and images by digest, media_type, tag_name

##### Addition of the content to the repo with deps

  - <span style="color: #458b74;">As a user I can add Manifest and all Blobs it references to the destination repo</span>

  - <span style="color: #458b74;">As a user I can add Manifest List and all Manifests and Blobs it references to the destination repo</span>

  - <span style="color: #458b74;">As a user I can add Tag and all its' associated content it references to the destination repo</span>

##### Removal of the content from the repo with deps

<span style="color: #458b74;">\* As a user I can remove Manifest and all Blobs it references from the repo</span>  

<span style="color: #458b74;">\* As a user I can remove Manifest List and all Manifests and Blobs it references from the repo</span>  

<span style="color: #458b74;">\* As a user I can remove Tag and all its' associated content it references from the repo</span>

**NOTE** units that are referenced by other units are not removed

##### Copy of the content form source repo to the dest repo with deps

  - {color: #458b74} As a user I can copy by digest, media_type Manifest and all Blobs it references from the source repo to the destination repo

  - {color: #458b74} As a user I can copy by digest , media_type Manifest List and all Manifests and Blobs it references from the source repo to the destination repo

  - {color: #458b74} As a user I can copy Tag by name and all its' associated content it references from the source repo to the destination repo

##### Adding/removing Tag via pulp api

  - <span style="color: #458b74;">As a user I can Tag an imagine in a repo</span>

  - <span style="color: #458b74;">As a user I can Untag an imagine in a repo</span>

  - <span style="color: #458b74;">As a user I can point existing Tag to a different image in a repo</span>

### Post-MVP 4.1+ ( subject to extension)

##### Sync

  - As a user, I can sync from a repository with Foreign Layers and save them in pulp for disconnected env.

  - As a user, I can exactly mirror the content of a remote repository( mirror on sync)

##### Publish

  - As a user I cam pull from Container registry that has auth mechanism  

    \*basic auth

##### Force removal of the content from the repo with deps

  - As a user I can remove Manifest and all Blobs it references from the repo

  - As a user I can remove Manifest List and all Manifests and Blobs it references from the repo

  - As a user I can remove Tag and all its' associated content it references from the repo

##### Export

  - As a user I can distribute Container content using a remote server ( rsync exporter)

##### Docker/podman push

  - As a user, I can 'docker push' to a Pulp repository

  - As a user I can 'docker tag' to a Pulp repository

##### Skopeo copy

  - As a user I can use skopeo pulp transport to push images to Pulp container registry

##### Enable v2/catalog endpoint

## What will be dropped in Pulp3

  - v1 API support. In Pulp3 we'll have just v2 api registry and corresponding v2 content types

  - v1/search. There is no v2/search so \`docker search\` for v2 content will not work. If upstream docker will add support for v2 docker content search by the time we deliver container plugin for pulp3 we will reconsider and include the endpoint.

  - content protection. In Pulp3 container repos will not support entitlement cert protection. ( option \`protected\` is dropped)

  - export content into a tar file. It was possible to do so for v1 content.

  - Crane is not longer used as a registry API. Pulp 3's ability to serve custom live APIs has made it possible for Crane's feature set to be incorporated into the pulp_container plugin