Unable to import image encrypted by ctr-enc

user_10340384 0
Viewed 520

I am trying to encrypt the docker images using this tutorial. I have images stored in Azure Container Registry and I want to encrypt them .

As images from Azure CR are not supported in ctr-enc environment so I am pulling image from Azure CR, tagging it to local registry(sudo docker tag "azure-cr-image-name" localhost:5000/test:0.1) and pushing it(sudo docker push localhost:5000/test:0.1) and then pulling it in ctr-enc from local registry.

All the steps works fine. The image runs successfully so I exported it to a tar file. The error comes when I try to import the tar file in any other device. The error is as follows

unpacking localhost:5000/test:0.1 (sha256:7b60c337c1d319c682369508673f8da65ce027cd95917d80abec71c753f90341)...INFO[0119] apply failure, attempting cleanup             error="failed to extract layer sha256:0447c1aa276497ad5424dd1f8597b7f667126d868489277bab7aea547a4aa982: mount callback failed on /var/lib/containerd/tmpmounts/containerd-mount138280154: archive/tar: invalid tar header: unknown" key="extract-395814385-sMwu sha256:0447c1aa276497ad5424dd1f8597b7f667126d868489277bab7aea547a4aa982"
ctr: failed to extract layer sha256:0447c1aa276497ad5424dd1f8597b7f667126d868489277bab7aea547a4aa982: mount callback failed on /var/lib/containerd/tmpmounts/containerd-mount138280154: archive/tar: invalid tar header: unknown

All I want to know is will this flow work and am I missing something or this entire flow is wrong. I don't have much idea about it so any help will be appreciated.

azure-container-registry docker
1 Answers

I resolved the error with the help of following steps. Tried re-creating the flow and I used this link to setup my local repository. Pulled image from acr, encrypted it and pushed it to the local registry and started pulling the encrypted image from local registry to the other devices

I got following error in the device

unpacking linux/arm64/v8 sha256:cfd940f7d5d6a6817e8d4f4a811a27263fa11dc00507ebf638ff24be703e5320...
INFO[0293] apply failure, attempting cleanup             error="failed to extract layer sha256:0447c1aa276497ad5424dd1f8597b7f667126d868489277bab7aea547a4aa982: call to DecryptLayer failed: missing private key needed for decryption\n: unknown" key="extract-20510027-zCdy sha256:0447c1aa276497ad5424dd1f8597b7f667126d868489277bab7aea547a4aa982"
ctr: failed to extract layer sha256:0447c1aa276497ad5424dd1f8597b7f667126d868489277bab7aea547a4aa982: call to DecryptLayer failed: missing private key needed for decryption
: unknown

After providing the secret key in the pull command itself the image got downloaded and it ran without any errors. Pull command example: sudo ctr-enc images pull --plain-http=true --key mykey.pem registry.local.com:5000/encrypted-image/test:0.1

Key Points: 1] Add following line in the hosts file in the device where you are setting up the repository as well as the device in which you want to run the encrypted image. Replace it with your actual IP

Ex:- 192.168.0.1  repository.local.com

2] Add following line in the /docker/daemon.json file for the devices where you are planning to run encrypted image

 "insecure-registries":["registry.local.com:5000"]
user_103403840
Related