Add OCI registry browser #97
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Adds functions for browsing OCI registries: - ParseRegistryURL: splits URLs like "quay.io/nebari" into host and namespace - ListRepositories: queries the standard /v2/_catalog endpoint - ListRepositoriesViaQuayAPI: fallback for Quay.io which does not support /v2/_catalog, uses the Quay.io REST API with public=true and optional Bearer token auth for private repos - ListTags: lists tags for a given repository - PullEnvironment: fetches pixi.toml and pixi.lock layers from a manifest - RepositoryInfo now includes an is_public field from the Quay.io API
Quay.io robot account credentials (username/password) work for Docker push/pull but not for the Quay.io REST API. Adds a separate api_token field so admins can configure an OAuth Application Token for listing private repositories. - New APIToken field on OCIRegistry model (json:"-", never serialized) - GORM AutoMigrate will add the column automatically - Responses expose has_api_token boolean, never the actual value - ListPublicRegistries masks both username and has_api_token for non-admin users - Create and Update handlers accept and persist the new field
Three new endpoints under /api/v1/registries/:id (authenticated): - GET /repositories: lists repos via OCI catalog, falls back to Quay.io API for quay.io hosts (using api_token for private repos), then merges known publications from DB. Supports search filtering. - GET /tags?repo=org/name: lists tags for a repository - POST /import: pulls pixi.toml/pixi.lock from a tag and creates a new workspace All handlers use ParseRegistryURL to correctly handle registry URLs that include a namespace path (e.g. quay.io/nebari).
Use ParseRegistryURL to separate host from namespace when constructing the repository reference and setting RegistryHost for publishing. This fixes broken OCI references when the registry URL contains a path component (e.g. quay.io/nebari would previously produce quay.io/nebari/nebari/repo instead of quay.io/nebari/repo).
New Registries page with three-level drill-down: - Registry list with Browse button - Repository list with search, manual path entry, and visibility badges (Public/Private) from the Quay.io API response - Tag list with Import button and workspace name dialog Other frontend changes: - API client functions and React Query hooks for browse/import - RegistryRepository type now includes is_public field - Registries nav tab uses device-ipad-horizontal-search icon - Admin Create/Edit registry dialogs include an API Token field with help text explaining its purpose for Quay.io private repos - OCIRegistry type includes has_api_token boolean, Edit dialog shows hint when a token is already configured
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Users can now browse OCI registries, view repositories/tags, and import environments as workspaces directly from the UI.
Backend
internal/oci/browser.go) with catalog listing, tag listing, and environment pulling/v2/_catalogis not supported by Quay.io, so we hit their REST API (/api/v1/repository?namespace=...&public=true) insteadapi_tokenfield on registry model — Quay.io robot account creds don't work for their REST API, so admins can set a separate OAuth token for listing private reposquay.io/nebariwas producing double-namespaced refs likequay.io/nebari/nebari/repo)API
/registries/:id/repositories/registries/:id/tags?repo=org/name/registries/:id/importFrontend
Known limitations