Run image-factory in locally(airgap)

[6547709]

I plan to deploy the Omni environment locally(airgap), but when running Image-factory locally, I encountered a problem:

{"level":"info","ts":1728096785.065096,"caller":"cmd/service.go:57","msg":"shutting down","name":"image-factory"}
2024/10/05 02:53:05 getting Fulcio roots: initializing tuf: updating local metadata and targets: error updating to TUF remote mirror: tuf: failed to download 10.root.json: Get "https://tuf-repo-cdn.sigstore.dev/10.root.json": EOF

Image-Factory,Docker-Compose.yml

  image-factory:
    image: "ghcr.io/siderolabs/image-factory:v0.5.0"
    restart: unless-stopped
    container_name: image-factory
    privileged: true
    ports:
      - "8080:8080"
    volumes:
      - /dev:/dev
      - /sys:/sys
      - ./cache-signing-key.key:/cache-signing-key.key
      - ./cosign.key:/cosign.key
      - ./cosign.pub:/cosign.pub
      - ./tmp:/tmp
      - ./certs/omni-ca.pem:/root.pem
      - ./10.root.json:/10.root.json
    command: >
      -http-port=0.0.0.0:8080
      -image-registry ${OMNI_IP}:5000
      -external-url http://${OMNI_IP}/
      -schematic-service-repository ${OMNI_IP}:5000/image-factory/schematic
      -installer-internal-repository ${OMNI_IP}:5000/siderolabs
      -installer-external-repository ${OMNI_IP}:5000/siderolabs
      -cache-repository ${OMNI_IP}:5000/cache
      -insecure-image-registry
      -insecure-cache-repository
      -insecure-schematic-service-repository
      -insecure-installer-internal-repository
      -cache-signing-key-path /cache-signing-key.key
      -container-signature-pubkey /cosign.pub
      -container-signature-issuer http://${OMNI_IP}

Requesting help, does Image-Factory support local deployment, if so, is there any documentation or guidance for this.

I have also explored deploying sigstore locally, but I don't see those parameters/environment variables to use local sigstore.

[6547709]

I've made some progress on resolving the issue and can now run and build the image in an offline environment. Here’s a summary of my approach, though I’m not sure if it’s the best solution:

  image-factory:
    image: "ghcr.io/siderolabs/image-factory:v0.5.0"
    restart: unless-stopped
    container_name: image-factory
    privileged: true
    ports:
      - "8080:8080"
    environment:
      SIGSTORE_ROOT_FILE: /root.pem
      SIGSTORE_REKOR_PUBLIC_KEY: /cosign.pub
      SIGSTORE_CT_LOG_PUBLIC_KEY_FILE: /cosign.pub
    volumes:
      - /dev:/dev
      - /sys:/sys
      - ./cache-signing-key.key:/cache-signing-key.key
      - ./certs/import-cosign.key:/cosign.key
      - ./certs/import-cosign.pub:/cosign.pub
      - ./tmp:/tmp
      - ./certs/omni-ca.pem:/root.pem
      - ./10.root.json:/root.json
    command: >
      -http-port=0.0.0.0:8080
      -image-registry ${OMNI_IP}:5000
      -external-url http://${OMNI_IP}:8080
      -schematic-service-repository ${OMNI_IP}:5000/image-factory/schematic
      -installer-internal-repository ${OMNI_IP}:5000/siderolabs
      -installer-external-repository ${OMNI_IP}:5000/siderolabs
      -cache-repository ${OMNI_IP}:5000/cache
      -insecure-image-registry
      -insecure-cache-repository
      -insecure-schematic-service-repository
      -insecure-installer-internal-repository
      -cache-signing-key-path /cache-signing-key.key
      -container-signature-pubkey /cosign.pub
      -container-signature-issuer http://localhost

1. Handling Sigstore components offline: This can be achieved using three environment variables: SIGSTORE_ROOT_FILE, SIGSTORE_REKOR_PUBLIC_KEY, and SIGSTORE_CT_LOG_PUBLIC_KEY_FILE.

2. Image synchronization: I used the command below to download images to a local directory and then copied them to the offline registry:

   --all and --preserve-digests，It can ensure that the digest of the image remains unchanged, which is very important because Image-Factory pulls extentions through digest;

   skopeo copy --retry-times 3 --all --preserve-digests "docker://${image}" "dir:dynamic_images/$(echo "$image" | tr '/:' '_')"

   • 2.1: Use the API from factory.talos.dev to obtain the corresponding versions of extensions and overlays images.
   • 2.2: Download the corresponding versions of the following images:
   • ghcr.io/siderolabs/extensions:${version}
   • ghcr.io/siderolabs/installer:${version}
   • ghcr.io/siderolabs/imager:${version}

3. Image signing certificates: I used CFSSL to create an internal CA and issued the following certificates:

   • SSL certificate for omni
   • Signing certificate for cosign
   • cache-signing-key.key

4. Image signing: Images were signed using the command:

   cosign sign --key "${COSIGN_KEY}" --cert "${COSIGN_CERT}" --cert-chain="${COSIGN_CERT_CHAIN}" --tlog-upload=false "${image}"

As a result, the setup can now run completely in an offline environment.

[smira]

Thank you, that's an awesome write up!

Btw, crane cp is way easier and works better than skopeo.