{"action":"created","issue":{"url":"https://api.github.com/repos/opencontainers/image-spec/issues/11","repository_url":"https://api.github.com/repos/opencontainers/image-spec","labels_url":"https://api.github.com/repos/opencontainers/image-spec/issues/11/labels{/name}","comments_url":"https://api.github.com/repos/opencontainers/image-spec/issues/11/comments","events_url":"https://api.github.com/repos/opencontainers/image-spec/issues/11/events","html_url":"https://github.com/opencontainers/image-spec/issues/11","id":146471736,"number":11,"title":"Name Delegation Design Discussion","user":{"login":"philips","id":33544,"avatar_url":"https://avatars.githubusercontent.com/u/33544?v=3","gravatar_id":"","url":"https://api.github.com/users/philips","html_url":"https://github.com/philips","followers_url":"https://api.github.com/users/philips/followers","following_url":"https://api.github.com/users/philips/following{/other_user}","gists_url":"https://api.github.com/users/philips/gists{/gist_id}","starred_url":"https://api.github.com/users/philips/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/philips/subscriptions","organizations_url":"https://api.github.com/users/philips/orgs","repos_url":"https://api.github.com/users/philips/repos","events_url":"https://api.github.com/users/philips/events{/privacy}","received_events_url":"https://api.github.com/users/philips/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/opencontainers/image-spec/labels/component/naming%20spec","name":"component/naming spec","color":"0052cc"},{"url":"https://api.github.com/repos/opencontainers/image-spec/labels/kind/design","name":"kind/design","color":"c7def8"},{"url":"https://api.github.com/repos/opencontainers/image-spec/labels/kind/enhancement","name":"kind/enhancement","color":"c7def8"},{"url":"https://api.github.com/repos/opencontainers/image-spec/labels/priority/P2","name":"priority/P2","color":"fbca04"}],"state":"open","locked":false,"assignee":{"login":"brendandburns","id":5751682,"avatar_url":"https://avatars.githubusercontent.com/u/5751682?v=3","gravatar_id":"","url":"https://api.github.com/users/brendandburns","html_url":"https://github.com/brendandburns","followers_url":"https://api.github.com/users/brendandburns/followers","following_url":"https://api.github.com/users/brendandburns/following{/other_user}","gists_url":"https://api.github.com/users/brendandburns/gists{/gist_id}","starred_url":"https://api.github.com/users/brendandburns/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brendandburns/subscriptions","organizations_url":"https://api.github.com/users/brendandburns/orgs","repos_url":"https://api.github.com/users/brendandburns/repos","events_url":"https://api.github.com/users/brendandburns/events{/privacy}","received_events_url":"https://api.github.com/users/brendandburns/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/opencontainers/image-spec/milestones/1","html_url":"https://github.com/opencontainers/image-spec/milestones/v0.1.0","labels_url":"https://api.github.com/repos/opencontainers/image-spec/milestones/1/labels","id":1705175,"number":1,"title":"v0.1.0","description":"Spec factored for top to bottom reading with three audiences in-mind:\r\n- Build system creators\r\n- Image registry creators\r\n- Container engine creators","creator":{"login":"philips","id":33544,"avatar_url":"https://avatars.githubusercontent.com/u/33544?v=3","gravatar_id":"","url":"https://api.github.com/users/philips","html_url":"https://github.com/philips","followers_url":"https://api.github.com/users/philips/followers","following_url":"https://api.github.com/users/philips/following{/other_user}","gists_url":"https://api.github.com/users/philips/gists{/gist_id}","starred_url":"https://api.github.com/users/philips/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/philips/subscriptions","organizations_url":"https://api.github.com/users/philips/orgs","repos_url":"https://api.github.com/users/philips/repos","events_url":"https://api.github.com/users/philips/events{/privacy}","received_events_url":"https://api.github.com/users/philips/received_events","type":"User","site_admin":false},"open_issues":4,"closed_issues":7,"state":"open","created_at":"2016-04-14T04:42:03Z","updated_at":"2016-05-02T14:55:26Z","due_on":"2016-04-28T04:00:00Z","closed_at":null},"comments":38,"created_at":"2016-04-07T00:15:43Z","updated_at":"2016-05-02T17:30:33Z","closed_at":null,"body":"DNS delegation is the idea that I can own the domain `example.com` but delegate hosting of my container images to `container.hosting`. Think MX records, where I have a DNS name that tells me where to send email for a domain without the dedicated special DNS record.\r\n\r\nToday, AppC supports a method for doing this type of delegation that uses [HTTPS, and HTML meta tags](https://github.com/appc/spec/blob/master/spec/discovery.md). This type of delegation is inspired by the method used by the `go get` package management system as well.\r\n\r\nOne critique of this method is that there is an RFC for this sort of meta information called '[well-known URIs](https://github.com/appc/spec/issues/160)'. I believe that using this type of well-known scheme is a better choice today and will stay out of people's way better; in fact we prototyped this in a project called [abd](https://github.com/appc/abd).\r\n\r\n**FAQ**\r\n**Why not DNS**: If we used DNS it would make it hard to bootstrap trust of this source based on the existing well understood TLS infrastructure on the internet today. With systems like Let's Encrypt in place today I think it would be smart to rely on this existing trust root. We do this in [rkt today](https://coreos.com/rkt/docs/latest/subcommands/trust.html#trust-a-key-using-meta-discovery) and it works nicely. \r\n\r\n**But I have this way better way of doing delegation**: We can add additional methods, but having some method to start for delegation is super helpful.\r\n\r\n**I don't want to allow outbound traffic to the internet**: Container engines can allow for this feature to be turned off or configure that certain domains are statically delegated to internal mirrors. This is all about having a default UX."},"comment":{"url":"https://api.github.com/repos/opencontainers/image-spec/issues/comments/216303345","html_url":"https://github.com/opencontainers/image-spec/issues/11#issuecomment-216303345","issue_url":"https://api.github.com/repos/opencontainers/image-spec/issues/11","id":216303345,"user":{"login":"wking","id":209920,"avatar_url":"https://avatars.githubusercontent.com/u/209920?v=3","gravatar_id":"","url":"https://api.github.com/users/wking","html_url":"https://github.com/wking","followers_url":"https://api.github.com/users/wking/followers","following_url":"https://api.github.com/users/wking/following{/other_user}","gists_url":"https://api.github.com/users/wking/gists{/gist_id}","starred_url":"https://api.github.com/users/wking/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wking/subscriptions","organizations_url":"https://api.github.com/users/wking/orgs","repos_url":"https://api.github.com/users/wking/repos","events_url":"https://api.github.com/users/wking/events{/privacy}","received_events_url":"https://api.github.com/users/wking/received_events","type":"User","site_admin":false},"created_at":"2016-05-02T17:30:33Z","updated_at":"2016-05-02T17:30:33Z","body":"On Mon, May 02, 2016 at 10:12:42AM -0700, Brendan Burns wrote:\n> Basically `registryLookup(...)` in your above requires the name of\n> an actual, functioning registry.\n\nI was imagining users could configure their client to use a number of\nregistries, over a number of registry protocols.  Then the client\ncould check them all (“Registry1, have you heard of image ‘debian’?\nNo?  Registry2, have you heard of image ‘debian’?  Ah you have three\nimages called ‘debian’.  It looks like I only trust the second and\nthird, and the third is newer, so off to the CAS engine to resolve\nsha256:ca6e…”).\n\nBut yeah, clients would have to have registry configuration trasmitted\nout-of-band.\n\n> So the code looks like this…\n\nOk, so this is optional pre-processing for image names that look like\ndomains.  That sounds good to me, and explains why the delegation\nfunctions are domain/IP → domain/IP mappings.\n"}}