Output list of cached docker hub images in Harbor

user_385622 0
Viewed 415

In order to figure out if there are any Docker images we routinely depend on and cache I'm trying to figure out a way to list out all cached public dependencies: Docker Hub images that were pulled and cached by Harbor.

The idea is that we'd want to list out any images that don't have an explicit support for a specific platform like ARM64 in order to know whether it's safe for us to use Apple Silicon machines with Docker for Mac for example.

I went through the Harbor API endpoints listed in the internal API documentation but couldn't find any endpoints that specifically list out cached public images regardless of specific projects. Understandably there might be a privacy concern but I don't think pulling images via Harbor is necessarily tied to a project.

Maybe that's my misunderstanding. Or maybe this is something docker (compose) pull should provide under the hood given a list of images to pull from a specific platform.

harbor docker
1 Answers

My smart co-worker John Meyers helped me out with this one and he got a good list out using this command:

curl -X GET -u 'your-username:your-password!' https://harbor.vnerd.com/v2/_catalog

It looks like you can only get the tags that are in the registry/local that have already been pulled down. It gets you a list of everything in proxy project which should be everything you care about?

He followed with this script:

Assuming so, a bit of googling cobbled this nonsense together to grab the “fat manifests” out of a registry and look for arm64 architecture.

#!/bin/sh

images=($@)

for image in "${images[@]}"; do
    scope="scope=repository:${image}:pull&"
    token=$(curl -s "https://auth.docker.io/token?service=registry.docker.io&${scope}" | jq -r '.token')

    echo ${image}
    if curl -H "Accept: application/vnd.docker.distribution.manifest.list.v2+json" \
                  -H "Authorization: Bearer $token" \
                  -s "https://registry-1.docker.io/v2/${image}/manifests/latest" | jq -r '.manifests|.[] | select(.platform.architecture | ascii_downcase =="arm")' &> /dev/null; then
        echo "Has an ARM image"
    else
        echo "Bad news"
    fi
done

Allowed us to figure out that a lot of Confluent (Kafka) images don't have ARM64 versions as of yet, which is a concern. Ditto for Helm.

confluentinc/cp-kafka
confluentinc/cp-kafka-connect-base
confluentinc/cp-schema-registry
confluentinc/cp-server
confluentinc/cp-zookeeper
cypress/base
devth/helm
user_3856220
Related