Allow for configurable `skopeo` credentials during pulling of the ROCK base image.
Metadata
Current evaluation
Feature request to add configurable skopeo credentials (via --src-creds) when pulling the ROCK base image from ECR, to work around registry rate limits. Open 763 days, no maintainer response, no labels; related issue #655 (configurable registry) also open and untriaged.
Suggested action: needs triage
Reason: The issue has no labels, no maintainer comments, and no assignee after 763 days, so it has never been triaged. It is a legitimate feature request (not stale-irrelevant): the current rockcraft/oci.py still hardcodes ECR_URL/REGISTRY_URL with no credential support, and the related issue #655 (configurable base image registry) remains open and untriaged, indicating the underlying rate-limit problem is still unaddressed.
Impact:
45
Quick Win:
20.25
Staleness:
85
Complexity:
55
Confidence:
70
Support Request:
10
Issue body
### What needs to get done
[`rockcraft.oci.Image` class](https://github.com/canonical/rockcraft/blob/d09ad13493b8dc0cbb95db7285ef4a6d8a166f67/rockcraft/oci.py#L54) needs extending to add configurable credentials during the `skopeo copy` of the base image from Amazon ECR.
Will probably need adding the args as top-level `rockcraft` args themselves and transparently propagating the arguments down to the actual `skopeo copy` command using `--src-creds` as seen in [`man skopeo-copy`](https://manpages.ubuntu.com/manpages/mantic/man1/skopeo-copy.1.html).
### Why it needs to get done
Although ECR is considerably more lenient than DockeHub in terms of data pull limits for unverified requests, it still has them, leading to errors like these:
```python3
024-07-29 11:06:56.991 Execute process: ['/snap/rockcraft/1783/bin/skopeo', '--insecure-policy', '--override-arch', 'amd64', 'copy', '--retry-times', '5', 'docker://public.ecr.aws/ubuntu/ubuntu:22.04', 'oci:/root/images/ubuntu:22.04'], kwargs={}
2024-07-29 11:10:30.466 Failed to copy image: Command '['/snap/rockcraft/1783/bin/skopeo', '--insecure-policy', '--override-arch', 'amd64', 'copy', '--retry-times', '5', 'docker://public.ecr.aws/ubuntu/ubuntu:22.04', 'oci:/root/images/ubuntu:22.04']' returned non-zero exit status 1. (time="2024-07-29T11:07:28Z" level=warning msg="Failed, retrying in 1s ... (1/5). Error: initializing source docker://public.ecr.aws/ubuntu/ubuntu:22.04: reading manifest 22.04 in public.ecr.aws/ubuntu/ubuntu: toomanyrequests: Data limit exceeded"
```
Depending on the project being rock'd, these limits can be quite the nuisance.
The [`canonical/harbor-rocks` repo](https://github.com/canonical/harbor-rocks) for example defines rocks for 10 components x 3 versions x 2 architectures = 60 whole images, and it's virtually guaranteed that 2-3 of the build workflows will fail.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.8-27b |
Impact:
45
Quick Win:
20.25
Staleness:
85
Complexity:
55
Confidence:
70
Support Request:
10
|
needs triage | Feature request to add configurable skopeo credentials (via --src-creds) when pulling the ROCK base image from ECR, to work around registry rate limits. Open 763 days, no maintainer response, no labels; related issue #655 (configurable registry) also open and untriaged. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
95
Complexity:
20
Confidence:
85
Support Request:
10
|
needs triage | Request to add configurable skopeo credentials for pulling base images to bypass rate limits. Unlabeled, inactive for over two years, no maintainer response. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
95
Complexity:
20
Confidence:
80
Support Request:
10
|
needs triage | Request to add configurable skopeo credentials for pulling base images to bypass ECR rate limits. Unlabeled, inactive for nearly two years, and awaiting maintainer assessment. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
95
Complexity:
45
Confidence:
80
Support Request:
10
|
needs triage | Feature request to pass configurable skopeo credentials for base image pulls to avoid ECR rate limits. Untriaged, inactive for nearly two years, with no maintainer response or labels. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
90
Complexity:
40
Confidence:
85
Support Request:
0
|
needs triage | Proposes adding configurable credentials to skopeo for pulling ROCK base images, preventing ECR rate-limit failures. Currently unassigned, unlabeled, and inactive for over a year with a single comment noting related but independent functionality. |
Update history
No update history recorded yet.
Related work
-
Related To:
canonical/rockcraft#655
(confidence 85%)
Issue body explicitly links #655 (Make ROCK base image registry configurable) as related in cause but functionally independent; both address ECR/DockerHub pull rate limits.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #991 Provide instructions on authentication using Skopeo when publishing rock | rockcraft | open | Doc enhancement request to add a skopeo --dest-creds authentication section to the publish-a-rock how-to. 329 days old, 0 comments, no maintainer interaction; author promised a PR that never landed. The doc gap still exists. | |
| #655 Make ROCK base image registry configurable. | rockcraft | open | Feature request to make the hardcoded ECR base image registry URL configurable in rockcraft.oci.Image to allow pulling from non-ECR registries and avoid rate-limit failures. Untriaged, no maintainer response, no labels, 763 days old. Code still uses hardcoded REGISTRY_URL = ECR_URL. |