registries.conf parse failure: invalid condition: both location and prefix are unset

[addsoa]

I have my podman registry configured as:

$ podman -v
podman version 3.4.4
$ uname -a
Linux test 5.15.0-119-generic #129-Ubuntu SMP Fri Aug 2 19:25:20 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux

/etc/container/registries.conf

unqualified-search-registries = ['192.168.1.2:10080']

/home/user1/.config/containers/registries.conf

[[registry]]
[[registry.mirror]]
prefix="192.168.1.2:10080/myns"
location="192.168.1.2:10080/myns"
insecure=false

When I am trying to pull a random image as user1, the error output:

Error: loading registries configuration "/home/user1/.config/containers/registries.conf": invalid condition: both location and prefix are unset

How to configure these files if I just want to pull 192.168.1.2:10080/myns/busybox by command

podman pull busybox

Thank you very much!

[rhatdan]

@mtrmac PTAL

[GongT]

registry can not have only mirror. you can just use

[[registry]]
prefix="192.168.1.2:10080/myns"
insecure=true

prefix is the name you type-in, eg docker.io, required.
location is "physical" location, defaults to prefix, so same location and prefix is useless.
insecure default is false, mean it will request https://location and require valid https cert.
in your case, you must set it to true, you can use self-signed cert or plain-HTTP on this port.

[mtrmac]

This is correct — except that the example is missing a location line. This use case is just a redirect without adding additional mirrors.

---

But using registries.conf to configure handling of short names is not the expected way to do it. Short names are generally defined using aliases, as in https://www.redhat.com/sysadmin/container-image-short-names .

It might be the case that you want both:

• Configure an alias of busybox to, maybe, docker.io/library/busybox, to be explicit about how the short name should be interpreted
• Configure a redirect of docker.io/library/busybox to 192…, to use a local copy instead of using the global internet.

[addsoa]

Global registry configure:

user0@test:/etc/containers$ more registries.conf
unqualified-search-registries = ['192.168.1.2:10080']

Without rootless user registries.conf (i.e. remove ~/.config/containers/registries.conf), short name with namespace is workable:

user1@test:~/.config/containers$ podman pull basiliang/busybox
Resolving "myns/busybox" using unqualified-search registries (/etc/containers/registries.conf)
Trying to pull ip:port/myns/busybox:latest...
Getting image source signatures
Copying blob a10d77880eaf done
Copying config 87ff76f62d done
Writing manifest to image destination
Storing signatures
87ff76f62d367950186bde563642e39208c0e2b4afc833b4b3b01b8fef60ae9e
user1@test:~/.config/containers$

with rootless user registries.conf like following, error encountered:

user1@test:~/.config/containers$ more registries.conf
[[registry]]
prefix="192.168.1.2:10080/myns"
insecure=true
user1@test:~/.config/containers$ podman pull busybox
Error: loading registries configuration "/home/user1/.config/containers/registries.conf": invalid condition: location is unset and prefix is not in the format: *.example.com
user1@test:~/.config/containers$ podman pull myns/busybox
Error: loading registries configuration "/home/user1/.config/containers/registries.conf": invalid condition: location is unset and prefix is not in the format: *.example.com
user1@test:~/.config/containers$ podman pull ip:port/myns/busybox
Error: loading registries configuration "/home/user1/.config/containers/registries.conf": invalid condition: location is unset and prefix is not in the format: *.example.com

[mtrmac]

Use location= without prefix=. Yes, I’m afraid that’s confusing, and we should fix that. ( containers/image#1368 )

[addsoa]

Removed /etc/containers/registries.conf

• user1 configure

user1@test:~/.config/containers$ more registries.conf
unqualified-search-registries = ['192.168.1.2:10080']

[[registry]]
location="192.168.1.2:10080/myns"
insecure=true

pull without namespace output

user1@test:~/.config/containers$ podman pull busybox --log-level=debug
INFO[0000] podman filtering at log level debug
DEBU[0000] Called pull.PersistentPreRunE(podman pull busybox --log-level=debug)
DEBU[0000] cached value indicated that overlay is supported
DEBU[0000] Merged system config "/usr/share/containers/containers.conf"
DEBU[0000] cached value indicated that overlay is supported
DEBU[0000] Using conmon: "/usr/bin/conmon"
DEBU[0000] Initializing boltdb state at /home/user1/.local/share/containers/storage/libpod/bolt_state.db
DEBU[0000] Using graph driver overlay
DEBU[0000] Using graph root /home/user1/.local/share/containers/storage
DEBU[0000] Using run root /run/user/1001/containers
DEBU[0000] Using static dir /home/user1/.local/share/containers/storage/libpod
DEBU[0000] Using tmp dir /run/user/1001/libpod/tmp
DEBU[0000] Using volume path /home/user1/.local/share/containers/storage/volumes
DEBU[0000] cached value indicated that overlay is supported
DEBU[0000] Set libpod namespace to ""
DEBU[0000] [graphdriver] trying provided driver "overlay"
DEBU[0000] cached value indicated that overlay is supported
DEBU[0000] cached value indicated that metacopy is not being used
DEBU[0000] cached value indicated that native-diff is usable
DEBU[0000] backingFs=extfs, projectQuotaSupported=false, useNativeDiff=true, usingMetacopy=false
DEBU[0000] Initializing event backend journald
DEBU[0000] configured OCI runtime runc initialization failed: no valid executable found for OCI runtime runc: invalid argument
DEBU[0000] configured OCI runtime kata initialization failed: no valid executable found for OCI runtime kata: invalid argument
DEBU[0000] configured OCI runtime runsc initialization failed: no valid executable found for OCI runtime runsc: invalid argument
DEBU[0000] Using OCI runtime "/usr/bin/crun"
INFO[0000] Found CNI network podman (type=bridge) at /home/user1/.config/cni/net.d/87-podman.conflist
DEBU[0000] Default CNI network name podman is unchangeable
INFO[0000] Setting parallel job count to 37
DEBU[0000] Pulling image busybox (policy: always)
DEBU[0000] Looking up image "busybox" in local containers storage
DEBU[0000] Trying "busybox" ...
DEBU[0000] Loading registries configuration "/home/user1/.config/containers/registries.conf"
DEBU[0000] Trying "localhost/busybox:latest" ...
DEBU[0000] Trying "192.168.1.2:10080/busybox:latest" ...
DEBU[0000] Trying "docker.io/library/busybox:latest" ...
DEBU[0000] Attempting to pull candidate 192.168.1.2:10080/busybox:latest for busybox
DEBU[0000] parsed reference into "[overlay@/home/user1/.local/share/containers/storage+/run/user/1001/containers]192.168.1.2:10080/busybox:latest"
DEBU[0000] Resolving "busybox" using unqualified-search registries (/home/user1/.config/containers/registries.conf)
Resolving "busybox" using unqualified-search registries (/home/user1/.config/containers/registries.conf)
Trying to pull 192.168.1.2:10080/busybox:latest...
DEBU[0000] Copying source image //192.168.1.2:10080/busybox:latest to destination image [overlay@/home/user1/.local/share/containers/storage+/run/user/1001/containers]192.168.1.2:10080/busybox:latest
DEBU[0000] Trying to access "192.168.1.2:10080/busybox:latest"
DEBU[0000] No credentials for 192.168.1.2:10080 found
DEBU[0000] Using registries.d directory /etc/containers/registries.d for sigstore configuration
DEBU[0000]  No signature storage configuration found for 192.168.1.2:10080/busybox:latest, using built-in default file:///home/user1/.local/share/containers/sigstore
DEBU[0000] Looking for TLS certificates and private keys in /etc/docker/certs.d/192.168.1.2:10080
DEBU[0000] GET https://192.168.1.2:10080/v2/
DEBU[0000] Ping https://192.168.1.2:10080/v2/ status 401
DEBU[0000] GET https://192.168.1.2:10080/v2/token?scope=repository%3Abusybox%3Apull&service=container_registry
DEBU[0000] Accessing "192.168.1.2:10080/busybox:latest" failed: unable to retrieve auth token: invalid username/password: unauthorized
DEBU[0000] Error pulling candidate 192.168.1.2:10080/busybox:latest: initializing source docker://192.168.1.2:10080/busybox:latest: unable to retrieve auth token: invalid username/password: unauthorized
Error: initializing source docker://192.168.1.2:10080/busybox:latest: unable to retrieve auth token: invalid username/password: unauthorized
user1@test:~/.config/containers$

pull with namespace output

user1@test:~/.config/containers$ podman pull myns/busybox --log-level=debug
INFO[0000] podman filtering at log level debug
DEBU[0000] Called pull.PersistentPreRunE(podman pull myns/busybox --log-level=debug)
DEBU[0000] cached value indicated that overlay is supported
DEBU[0000] Merged system config "/usr/share/containers/containers.conf"
DEBU[0000] cached value indicated that overlay is supported
DEBU[0000] Using conmon: "/usr/bin/conmon"
DEBU[0000] Initializing boltdb state at /home/user1/.local/share/containers/storage/libpod/bolt_state.db
DEBU[0000] Using graph driver overlay
DEBU[0000] Using graph root /home/user1/.local/share/containers/storage
DEBU[0000] Using run root /run/user/1001/containers
DEBU[0000] Using static dir /home/user1/.local/share/containers/storage/libpod
DEBU[0000] Using tmp dir /run/user/1001/libpod/tmp
DEBU[0000] Using volume path /home/user1/.local/share/containers/storage/volumes
DEBU[0000] cached value indicated that overlay is supported
DEBU[0000] Set libpod namespace to ""
DEBU[0000] [graphdriver] trying provided driver "overlay"
DEBU[0000] cached value indicated that overlay is supported
DEBU[0000] cached value indicated that metacopy is not being used
DEBU[0000] cached value indicated that native-diff is usable
DEBU[0000] backingFs=extfs, projectQuotaSupported=false, useNativeDiff=true, usingMetacopy=false
DEBU[0000] Initializing event backend journald
DEBU[0000] configured OCI runtime kata initialization failed: no valid executable found for OCI runtime kata: invalid argument
DEBU[0000] configured OCI runtime runsc initialization failed: no valid executable found for OCI runtime runsc: invalid argument
DEBU[0000] configured OCI runtime runc initialization failed: no valid executable found for OCI runtime runc: invalid argument
DEBU[0000] Using OCI runtime "/usr/bin/crun"
INFO[0000] Found CNI network podman (type=bridge) at /home/user1/.config/cni/net.d/87-podman.conflist
DEBU[0000] Default CNI network name podman is unchangeable
INFO[0000] Setting parallel job count to 37
DEBU[0000] Pulling image myns/busybox (policy: always)
DEBU[0000] Looking up image "myns/busybox" in local containers storage
DEBU[0000] Trying "myns/busybox" ...
DEBU[0000] Loading registries configuration "/home/user1/.config/containers/registries.conf"
DEBU[0000] Trying "localhost/myns/busybox:latest" ...
DEBU[0000] Trying "192.168.1.2:10080/myns/busybox:latest" ...
DEBU[0000] Trying "docker.io/myns/busybox:latest" ...
DEBU[0000] Attempting to pull candidate 192.168.1.2:10080/myns/busybox:latest for myns/busybox
DEBU[0000] parsed reference into "[overlay@/home/user1/.local/share/containers/storage+/run/user/1001/containers]192.168.1.2:10080/myns/busybox:latest"
DEBU[0000] Resolving "myns/busybox" using unqualified-search registries (/home/user1/.config/containers/registries.conf)
Resolving "myns/busybox" using unqualified-search registries (/home/user1/.config/containers/registries.conf)
Trying to pull 192.168.1.2:10080/myns/busybox:latest...
DEBU[0000] Copying source image //192.168.1.2:10080/myns/busybox:latest to destination image [overlay@/home/user1/.local/share/containers/storage+/run/user/1001/containers]192.168.1.2:10080/myns/busybox:latest
DEBU[0000] Trying to access "192.168.1.2:10080/myns/busybox:latest"
DEBU[0000] Found credentials for 192.168.1.2:10080 in credential helper containers-auth.json
DEBU[0000] Using registries.d directory /etc/containers/registries.d for sigstore configuration
DEBU[0000]  No signature storage configuration found for 192.168.1.2:10080/myns/busybox:latest, using built-in default file:///home/user1/.local/share/containers/sigstore
DEBU[0000] Looking for TLS certificates and private keys in /etc/docker/certs.d/192.168.1.2:10080
DEBU[0000] GET https://192.168.1.2:10080/v2/
DEBU[0000] Ping https://192.168.1.2:10080/v2/ status 401
DEBU[0000] GET https://192.168.1.2:10080/v2/token?account=zhangfan&scope=repository%3Amyns%2Fbusybox%3Apull&service=container_registry
DEBU[0000] Increasing token expiration to: 60 seconds
DEBU[0000] GET https://192.168.1.2:10080/v2/myns/busybox/manifests/latest
DEBU[0000] Content-Type from manifest GET is "application/vnd.docker.distribution.manifest.v2+json"
DEBU[0000] Using blob info cache at /home/user1/.local/share/containers/cache/blob-info-cache-v1.boltdb
DEBU[0000] IsRunningImageAllowed for image docker:192.168.1.2:10080/myns/busybox:latest
DEBU[0000]  Using default policy section
DEBU[0000]  Requirement 0: allowed
DEBU[0000] Overall: allowed
DEBU[0000] Downloading /v2/myns/busybox/blobs/sha256:87ff76f62d367950186bde563642e39208c0e2b4afc833b4b3b01b8fef60ae9e
DEBU[0000] GET https://192.168.1.2:10080/v2/myns/busybox/blobs/sha256:87ff76f62d367950186bde563642e39208c0e2b4afc833b4b3b01b8fef60ae9e
Getting image source signatures
DEBU[0000] Reading /home/user1/.local/share/containers/sigstore/myns/busybox@sha256=82aa24d3db93c8ce7b8f32a19265f572cc7a0eff79f5a9862536d4b4b1992b98/signature-1
DEBU[0000] Manifest has MIME type application/vnd.docker.distribution.manifest.v2+json, ordered candidate list [application/vnd.docker.distribution.manifest.v2+json, application/vnd.docker.distribution.manifest.v1+prettyjws, application/vnd.oci.image.manifest.v1+json, application/vnd.docker.distribution.manifest.v1+json]
DEBU[0000] ... will first try using the original manifest unmodified
DEBU[0000] Failed to retrieve partial blob: blob type not supported for partial retrieval
DEBU[0000] Downloading /v2/myns/busybox/blobs/sha256:a10d77880eaf7e9f53f332b86ff61f9c2b9dfe41900762958e19614687a7cb05
DEBU[0000] GET https://192.168.1.2:10080/v2/myns/busybox/blobs/sha256:a10d77880eaf7e9f53f332b86ff61f9c2b9dfe41900762958e19614687a7cb05
DEBU[0000] Detected compression format gzip
DEBU[0000] Using original blob without modification
Copying blob a10d77880eaf done
DEBU[0000] Applying tar in /home/user1/.local/share/containers/storage/overlay/e215fa422c604a8ea57ffcf6abc11e686d50a89f861c9b90adbb76033a956c66/diff
DEBU[0000] No compression detected
DEBU[0000] Using original blob without modification
Copying config 87ff76f62d done
Writing manifest to image destination
Storing signatures
DEBU[0000] setting image creation date to 2023-05-18 22:34:17 +0000 UTC
DEBU[0000] created new image ID "87ff76f62d367950186bde563642e39208c0e2b4afc833b4b3b01b8fef60ae9e"
DEBU[0000] saved image metadata "{\"signatures-sizes\":{\"sha256:82aa24d3db93c8ce7b8f32a19265f572cc7a0eff79f5a9862536d4b4b1992b98\":[]}}"
DEBU[0000] set names of image "87ff76f62d367950186bde563642e39208c0e2b4afc833b4b3b01b8fef60ae9e" to [192.168.1.2:10080/myns/busybox:latest]
DEBU[0000] Pulled candidate 192.168.1.2:10080/myns/busybox:latest successfully
DEBU[0000] Looking up image "87ff76f62d367950186bde563642e39208c0e2b4afc833b4b3b01b8fef60ae9e" in local containers storage
DEBU[0000] Trying "87ff76f62d367950186bde563642e39208c0e2b4afc833b4b3b01b8fef60ae9e" ...
DEBU[0000] parsed reference into "[overlay@/home/user1/.local/share/containers/storage+/run/user/1001/containers]@87ff76f62d367950186bde563642e39208c0e2b4afc833b4b3b01b8fef60ae9e"
DEBU[0000] Found image "87ff76f62d367950186bde563642e39208c0e2b4afc833b4b3b01b8fef60ae9e" as "87ff76f62d367950186bde563642e39208c0e2b4afc833b4b3b01b8fef60ae9e" in local containers storage
DEBU[0000] Found image "87ff76f62d367950186bde563642e39208c0e2b4afc833b4b3b01b8fef60ae9e" as "87ff76f62d367950186bde563642e39208c0e2b4afc833b4b3b01b8fef60ae9e" in local containers storage ([overlay@/home/user1/.local/share/containers/storage+/run/user/1001/containers]@87ff76f62d367950186bde563642e39208c0e2b4afc833b4b3b01b8fef60ae9e)
87ff76f62d367950186bde563642e39208c0e2b4afc833b4b3b01b8fef60ae9e
DEBU[0000] Called pull.PersistentPostRunE(podman pull myns/busybox --log-level=debug)
user1@test:~/.config/containers$

• user1 configure

user1@test:~/.config/containers$ more registries.conf
unqualified-search-registries = ['192.168.1.2:10080/myns']

[[registry]]
location="192.168.1.2:10080/myns"
insecure=true

output

user1@test:~/.config/containers$ podman pull busybox --log-level=debug
INFO[0000] podman filtering at log level debug
DEBU[0000] Called pull.PersistentPreRunE(podman pull busybox --log-level=debug)
DEBU[0000] cached value indicated that overlay is supported
DEBU[0000] Merged system config "/usr/share/containers/containers.conf"
DEBU[0000] cached value indicated that overlay is supported
DEBU[0000] Using conmon: "/usr/bin/conmon"
DEBU[0000] Initializing boltdb state at /home/user1/.local/share/containers/storage/libpod/bolt_state.db
DEBU[0000] Using graph driver overlay
DEBU[0000] Using graph root /home/user1/.local/share/containers/storage
DEBU[0000] Using run root /run/user/1001/containers
DEBU[0000] Using static dir /home/user1/.local/share/containers/storage/libpod
DEBU[0000] Using tmp dir /run/user/1001/libpod/tmp
DEBU[0000] Using volume path /home/user1/.local/share/containers/storage/volumes
DEBU[0000] cached value indicated that overlay is supported
DEBU[0000] Set libpod namespace to ""
DEBU[0000] [graphdriver] trying provided driver "overlay"
DEBU[0000] cached value indicated that overlay is supported
DEBU[0000] cached value indicated that metacopy is not being used
DEBU[0000] cached value indicated that native-diff is usable
DEBU[0000] backingFs=extfs, projectQuotaSupported=false, useNativeDiff=true, usingMetacopy=false
DEBU[0000] Initializing event backend journald
DEBU[0000] configured OCI runtime runc initialization failed: no valid executable found for OCI runtime runc: invalid argument
DEBU[0000] configured OCI runtime kata initialization failed: no valid executable found for OCI runtime kata: invalid argument
DEBU[0000] configured OCI runtime runsc initialization failed: no valid executable found for OCI runtime runsc: invalid argument
DEBU[0000] Using OCI runtime "/usr/bin/crun"
INFO[0000] Found CNI network podman (type=bridge) at /home/user1/.config/cni/net.d/87-podman.conflist
DEBU[0000] Default CNI network name podman is unchangeable
INFO[0000] Setting parallel job count to 37
DEBU[0000] Pulling image busybox (policy: always)
DEBU[0000] Looking up image "busybox" in local containers storage
DEBU[0000] Trying "busybox" ...
DEBU[0000] Loading registries configuration "/home/user1/.config/containers/registries.conf"
DEBU[0000] Loading registries configuration "/home/user1/.config/containers/registries.conf"
Error: loading registries configuration "/home/user1/.config/containers/registries.conf": Invalid unqualified-search-registries entry "192.168.1.2:10080/myns"
user1@test:~/.config/containers$