Ability to use a docker mirror repository to avoid docker API limits

[mmerrill3]

For starboard, when images are pulled from docker, it would be nice to pull from a docker mirror repository instead. This is to avoid new API limits with dockerhub.

[mmerrill3]

Also, trying not to use the docker socket as root within starboard/trivy.

[danielpacak]

👋 @mmerrill3 I'm not quite sure I got your points. Could you elaborate please on the following items:

• Are you concerned about container images of the integrates scanners, which are by default pulled from DockerHub? Or container images of the scanned workloads? We've have a task to allow configuring scanner images in [cli] Allow configuring custom Docker image for each scanner #181
• Starboard does not mount docker socket because it's not required by Trivy. The current version of Trivy must run as root.

[mmerrill3]

Container images of the scanned workloads. I think #181 is to allow for a custom image for trivy again, but what I'm looking for is a way to avoid docker hub API rate limits. I was hoping to use a docker mirror.

[danielpacak]

The Trivy plugin does not mount / required Docker socket. It pull a container image as specified in the workload configuration. That way Trivy adds up to requests count. To avoid rate limits workload configs should be updated to refer to registry mirrors / proxy. There's nothing we can do about that in Starboard.

[shaardie]

Unfortunately it is not always possible to simply change the config in the workload, especially in multi tenant situations.

We are using harbor as a self hosted docker registry mirrors and configured kubernetes to those mirrors instead of docker.io, gcr.io, etc, so our customers really do not see any difference and can e.g. still use short image paths, like ubuntu:20.04 to get images from the mirrors. The same kind of feature would be nice for starboard.

See #673 for my attempt to implement this feature.

[danielpacak]

That's interesting idea @shaardie To see the whole picture before we jump on code review, could you explain how you configured K8s to use registry mirrors? Is it at admission controller level, kubelet, container runtime, or something else?

[shaardie]

The configuration is set in /etc/containerd/config.toml on every Node of our cluster. We are using Openstack together with Cluster API to automatically create the VMs for our nodes and during initialization of the nodes Cluster API is setting those values.

[danielpacak]

Just to confirm my understanding and share with all readers: You're proposing new settings for Trivy plugin, which will be equivalent to Configuring Registry Mirrors in containerd. Is that correct?

# Contents of /etc/containerd/config.toml
version = 2

[plugins."io.containerd.grpc.v1.cri".registry.mirrors]
  [plugins."io.containerd.grpc.v1.cri".registry.mirrors."docker.io"]
    endpoint = ["https://use-my-harbor-registry-instead.org"]

[shaardie]

Yes, I think you can frame it like that. I did not take a look at the code from containerd while writing my PR #673, but the functionality should be pretty similar.