opencontainers / distribution-spec

OCI Distribution Specification
https://opencontainers.org
Apache License 2.0
780 stars 201 forks source link

Define sane limits on the repository name #530

Open ozairasim opened 3 months ago

ozairasim commented 3 months ago

https://github.com/distribution/distribution currently defines a limit of 255 on the repository name. Until recently it was also including the domain length in the repository name limit calculation which is being addressed in https://github.com/distribution/reference/pull/9.

It would also be beneficial to document these limits in the spec officially so there is less confusion on should be the limits for repository name and the domain. Common registries also have enforced limits on the repository name. For example:

sudo-bmitch commented 3 months ago

I'm really torn on this one. Lots of registries have various restrictions, like character restrictions on user names, that impact the repository name in a way I don't think we want to include in the spec. And yet this is a limit that has existed for at least 9 years in a widely copied and imported implementation of the "reference".

Are there technical reasons that we need to limit this to 255? Is there a risk that registries will come along in the future and want a larger limit?

I feel like the safest option is to allow clients to send request for any length of repository, and registries can implement individual limits. That makes it easier for the registry to increase that limit in the future without requiring every client to upgrade.

tianon commented 3 months ago

Perhaps some advisory text about 255 being a good limit for clients/content producers if they want maximum compatibility/portability, similar to the 4MiB maximum suggestion?

(ie, for registries that want to implement a limit, it should not be LESS than 255, or something like that?)

sudo-bmitch commented 3 months ago

Perhaps an implementers note for registries. They should avoid allowing repositories plus a hostname more than 255 characters long to support older clients. And clients should avoid length limits to support future registries.