25

I've been setting up my kubernetes cluster and I have been using the Google Container Registry for storing images.

As a part of my setup I am building some tooling where I need to search the remote repository for images, including tags.

So my question is: How do I search Google Cloud Registry for images?

I've tried without luck to use docker cli to do the search:

$ docker search eu.gcr.io/project-101
Error response from daemon: Unexpected status code 403

$ gcloud docker search eu.gcr.io/project-101
Error response from daemon: Unexpected status code 403

$ docker login -e not@val.id -u _token -p mytoken https://eu.gcr.io
WARNING: login credentials saved in /Users/drwho/.docker/config.json
Login Succeeded

$ docker search eu.gcr.io/project-101
Error response from daemon: Unexpected status code 403

$ docker search eu.gcr.io/not-known
Error response from daemon: Unexpected status code 404

As you see I've tried a good deal of different approaches. The last option could be using the Google Storage Bucket API and search the file system "manually".

Emil Ingerslev
  • 4,645
  • 2
  • 24
  • 18

2 Answers2

19

Strangely, gcr.io doesn't support search in any obvious way. Use https://console.cloud.google.com/gcr/images/google-containers/GLOBAL to search.

Chris Jones
  • 4,815
  • 6
  • 34
  • 28
16

Docker clients through 1.7.0 only support unauthenticated search. For example if you search for:

$ docker search gcr.io/google-containers/kube
NAME                                        DESCRIPTION   STARS     OFFICIAL   AUTOMATED
google-containers/hyperkube                               0                    
google-containers/kube-apiserver                          0                    
google-containers/kube-controller-manager                 0                    
google-containers/kube-scheduler                          0                    
google-containers/kube-ui                                 0                    
google-containers/kube2sky                                0                    
google-containers/kubectl                                 0

I submitted a PR into 1.8.0 that will authenticate searches, and work similarly for private repositories.

Today the 403 (Forbidden) is because the Docker client isn't actually passing the authentication that is setup via gcloud docker or docker login.

EDIT: As a workaround, it isn't too bad to just CURL the endpoint:

$ curl -u _token:TOKEN "https://gcr.io/v1/search?q=QUERY" | \
    python -mjson.tool

You can generate TOKEN with gcloud auth print-access-token.

We support queries of the form <project-id>[/image-substring], e.g. google-containers/ube would match google-containers/kube2sky.

mattmoor
  • 1,677
  • 14
  • 9
  • Is it possible to do the search without the docker client then? – Emil Ingerslev Jul 22 '15 at 14:58
  • LOL, I was just editing to provide the workaround, see above. – mattmoor Jul 22 '15 at 14:59
  • Hehe, awesome :) I just tested it out though and with a minor problem with base64 not supporting `-w` on mac out of the way I got through to either this: `Access denied` when search for the project name or `Not found` when searching for anything else. I've tested it both with a token generated for _server_ and one for _browser_. – Emil Ingerslev Jul 22 '15 at 15:22
  • I was able to just drop the `-w0` on my macbook, and it worked. For generating the token, you should use: `gcloud auth print-access-token`. Access tokens typically look like `ya29.{long string}`, so if it doesn't you might be using the wrong kind of token. – mattmoor Jul 22 '15 at 16:15
  • Great! That was the cause. I used the tokens made through the _cloud console_. Did not now about the `gcloud auth print-access-token` stuff. Thank you very much for your help! – Emil Ingerslev Jul 22 '15 at 16:18
  • 3
    A bit simpler command you can use with curl is `curl -u _token:token https://eu.gcr.io/v1/search?q=search`. That will do the basic auth encoding for you :) – Emil Ingerslev Jul 22 '15 at 16:20
  • Great. Could you for reference give a link to the PR you submitted? – Emil Ingerslev Jul 22 '15 at 16:40
  • @mattmoor how would you search for a image with a specific tag? ie. I don't care if there's an image demo, if it's not tagged with 1.1.0 – srcspider Aug 04 '15 at 09:16
  • There is no way to tell from the search results, and there isn't really a natural way of asking that question thru the CLI search AFAIK. I tried: ```$ docker search ubuntu:14.04 Error response from daemon: Invalid repository name (ubuntu:14.04), only [a-z0-9-_.] are allowed``` – mattmoor Aug 04 '15 at 15:16
  • Note that our Web UI does support this. – mattmoor Aug 04 '15 at 15:18
  • How to list tags it has? `curl https://gcr.io/google-containers/hyperkube/tags` is not working. – yunfan Dec 07 '15 at 07:53
  • 7
    I had luck with curl and jq to view all tags - `curl -k -s -X GET https://gcr.io/v2/google_containers/kube-apiserver/tags/list | jq -r '.tags[]'` – jdf Jan 15 '16 at 23:48
  • 2
    Apparently, `gcloud` has new `alpha` commands for listing tags as well: `gcloud alpha container images list-tags gcr.io/google-containers/kube-apiserver` – TrinitronX Jun 30 '16 at 18:07
  • 2
    gcloud container is now available in GA, so you should skip `alpha`: `gcloud container images list-tags gcr.io/google-containers/kube-apiserver` – Jean Spector Jun 01 '20 at 14:54