3 ms·
The reason layers are scoped is so that they can be authed to something. Public only registries don't have this restriction, but otherwise if you saw a referenc
by justincormack 6y ago
The reason layers are scoped is so that they can be authed to something. Public only registries don't have this restriction, but otherwise if you saw a reference to a layer then you would be able to access it. The alternatives are to encrypt everything, or shard by access control (potentially to larger chunks than they are now.
- jacques_chester 6y agoI almost mentioned the auth thing but left it out as a bit of an implementation detail. It would not be difficult to map from a digest to a list of repositories.
- justincormack 6y agoThats a information disclosure potentially.
- jacques_chester 6y agoI disagree. You can still apply rules to repo/image and have those descend to blobs, just as happens now. If you ask for a blob and have access to repo/image with that blob, you see it. Otherwise not.