🐳 Container Registry

docker pull against a MeshWeaver instance. No ACR, no second access model.

OCI Distribution is a small HTTP surface, and blob storage is already content-addressed by digest — which is exactly what an OCI blob is. This package serves the pull half of that surface: the mesh answers the small JSON (manifests, indexes) and applies access control, then hands a layer fetch over to blob storage with a short-lived pre-signed URL. The portal never carries a gigabyte.

What ships

• GET /v2/, manifests, blobs, tags — the five routes a pull needs, plus the token endpoint the WWW-Authenticate challenge names.
• Multi-architecture — image indexes and Docker manifest lists are first-class. An index that resolved only one architecture would ship an image matching no runtime on the other.
• One access model — a caller presents its mwi_ instance key (Bearer or Basic, so docker login works unchanged) and the decision is AuthenticatedInstance.Allows(source, packageId, tier): the same predicate /api/plugins uses. An instance already granted Plugins/* can pull plugins/* images with no new grant.
• ContainerRegistry/Repository — the mesh node holding a repository's tags. The one mutable thing in a registry, versioned and access-controlled like anything else.

What does NOT ship yet

Push. POST /v2/<name>/blobs/uploads/ and its chunked, resumable friends are a much larger surface, and the first slice does not need them: images are written to the registry's storage directly, at a documented and content-addressed layout. Read the design page for what push would cost.

Contents