[BUG] Cup does not ignore registries nor exclude images, throws error at startup

[GiamBoscaro]

Describe the bug
I am trying to ignore my own private images so I can avoid adding the GITHUB_TOKEN to the config. But anything I tried, CUP fails to startup because it tries to reach for my private repos.

To Reproduce
Use the config provided and run cup.

Expected behavior
Should ignore the registries listed in registries with ignore: true or/and images in the exclude list.

System info (please complete the following information):

• OS: Synology DSM 7.2
• Docker daemon version: 24.0.2
• Cup version: 3.4.3

Additional context

cup.json

{
  "refresh_interval": "0 0 */6 * * *",
  "registries": {
    "ghcr.io/giamboscaro": {
      "ignore": true
    }
  },
  "images": {
    "exclude": ["ghcr.io/giamboscaro"],
    "extra": [
      "ghcr.io/sergi0g/cup:latest",
      "glanceapp/glance:latest",
      "postgres:16-trixie",
      "robiningelbrecht/strava-statistics:latest",
      "traefik:latest",
      "linuxserver/transmission:latest"
    ]
  }
}

Logs:

WARN GET https://ghcr.io/token?&service=ghcr.io&scope=repository:user/image:pull&scope=repository:giamboscaro/..................................
Unauthorized! Please configure authentication for this registry or if you have already done so, please make sure it is correct.
ERROR GET https://ghcr.io/token?&service=ghcr.io&scope=repository:user/image:pull&scope=repository:giamboscaro/..................................
Request failed!

Test docker run to quickly deploy the container for testing:

docker run --rm --name cup-test -v /tmp/docker-test/config.json:/config/cup.json:ro -v /var/run/docker.sock:/var/run/docker.sock:ro ghcr.io/sergi0g/cup:latest -c /config/cup.json serve

[GiamBoscaro]

I have tested it again and I have seen that it works but only in this case:

"registries": {
    "ghcr.io": {
      "ignore": true
    }
  }

so I need to exclude the whole ghcr.io registry in registries. The other config options do not work for me.

[sergi0g]

Hey @GiamBoscaro!

I think you've misunderstood the config a bit, sorry if the docs aren't great. For an image reference ghcr.io/sergi0g/cup:latest, ghcr.io is the registry, sergi0g/cup is the repository and latest is the tag. The registry option considers only the registry of an image and ghcr.io/giamboscaro is not a registry, it's a registry with half a repository appended to it.

On the other hand, the exclude option for images matches based on prefix, so that can accomplish the job. Try excluding that same prefix you were trying to use as a repository. Here are the docs if you need them: https://cup.sergi0g.dev/docs/configuration/include-exclude-images

I mention this ability there, but maybe it's not clear enough in the docs, so if you have any suggestions, please let me know!

For an image to be excluded, it must start with one of the strings you specify above. That means you could use ghcr.io to exclude all images from ghcr.io or ghcr.io/sergi0g to exclude all my images (why would you do that?).

[GiamBoscaro]

Hey @GiamBoscaro!

I think you've misunderstood the config a bit, sorry if the docs aren't great. For an image reference ghcr.io/sergi0g/cup:latest, ghcr.io is the registry, sergi0g/cup is the repository and latest is the tag. The registry option considers only the registry of an image and ghcr.io/giamboscaro is not a registry, it's a registry with half a repository appended to it.

On the other hand, the exclude option for images matches based on prefix, so that can accomplish the job. Try excluding that same prefix you were trying to use as a repository. Here are the docs if you need them: https://cup.sergi0g.dev/docs/configuration/include-exclude-images

I mention this ability there, but maybe it's not clear enough in the docs, so if you have any suggestions, please let me know!

For an image to be excluded, it must start with one of the strings you specify above. That means you could use ghcr.io to exclude all images from ghcr.io or ghcr.io/sergi0g to exclude all my images (why would you do that?).

I actually read the documentation and I know how Docker images urls and tags works, but I still had some trouble making this work as I want.
The first configuration I tried after reading the docs is this one:

{
  "refresh_interval": "0 0 */6 * * *",
  "images": {
    "exclude": [
      "ghcr.io/giamboscaro",
      "docker.elastic.co/elasticsearch/elasticsearch:8.14.3"
    ]
  }
}

To me this one made sense because I wanted to ignore and not track all my custom images, and also that specific elasticsearch version (for a reason outside this scope).
This one did not work as I got thrown multiple authentication errors from ghcr.io. This is why then I tried some more different configurations, some of them that are indeed quite confusing. I was trying some stuff basically.

Now, since all the ghcr.io images that I have are public, I though this configuration could avoid making me authentication to GitHub, as the authentication errors should be thrown only when Cup tries to access the ghcr.io/giamboscaro url.

I then put

"registries": {
    "ghcr.io": {
      "ignore": true
    }
}

This worked but also ignores all the images from GitHub, thus a lot of images that I actually need to track.

I then also tried:

{
  "refresh_interval": "0 0 */6 * * *",
  "registries": {
    "ghcr.io": {
      "authentication": "<token>"
    }
  },
  "images": {
    "exclude": [
      "ghcr.io/giamboscaro",
      "docker.elastic.co/elasticsearch/elasticsearch:8.14.3"
    ]
  }
}

But still got the authentication error. The token that I have used is a GitHub Classic Token, with permissions: public_repo and read:packages. I suppose Cup should not need anything more. But it does not work unfortunately.

At the moment I am stuck with this config that is actually working:

{
  "refresh_interval": "0 0 */6 * * *",
  "registries": {
    "ghcr.io": {
      "ignore": true
    }
  },
  "images": {
    "exclude": [
      "ghcr.io/giamboscaro",
      "docker.elastic.co/elasticsearch/elasticsearch:8.14.3"
    ]
  }
}

[sergi0g]

Huh, not even the token works? I'll have to try to reproduce this when I can. I'm guessing that the images in question are not being excluded when retrieving a token (although that's weird, I've already checked this logic a few times before) and because you happen to have private images, there's a hard error from the API. I've been excluding ghcr.io/immich-app just fine for example.

[GiamBoscaro]

Huh, not even the token works? I'll have to try to reproduce this when I can. I'm guessing that the images in question are not being excluded when retrieving a token (although that's weird, I've already checked this logic a few times before) and because you happen to have private images, there's a hard error from the API. I've been excluding ghcr.io/immich-app just fine for example.

Well but if I actually have the token, then even private packages should not be a problem right? If the permissions that I gave are correct.
Let's say that I would really like to be able to just exclude my private repos. If that is not possible, then I can just inject a GitHub token to avoid the errors. The problem is that I get the errors anyway.

[sergi0g]

Yeah, that's why I'm surprised. Of course it shouldn't be a problem. I'll try to take a look as soon as I can

[ramiuslr]

Hello, I am experimenting the same issue with the latest version v3.5.1.
Here is my config:

{
  "images": {
    "exclude": [
      "ghcr.io/ramiuslr"
    ]
  },
  "refresh_interval": "0 0 */12 * * *"
}

[teruncius]

I think there could be something wrong with getting the api token for excluded images from the container registry. This was my config file:

{
    "images": {
        "exclude": ["ghcr.io/teruncius/redacted"]
    }
}

The -d flag showed me a warning when getting the token from this URL in the logs:

https://ghcr.io/token?&service=ghcr.io&scope=repository:user/image:pull&scope=repository:teruncius/redacted:pull&scope=repository:sergi0g/cup:pull&scope=repository:sergi0g/cup:pull&scope=repository:teruncius/redacted:pull

• teruncius/redacted is my private container repository in the ghcr.io registry.
• sergi0g/cup is the only other image from the ghcr.io registry currently in use my stack.

Changing the config file to this works now, because cup won't try to get the token for the ghcr.io registry anymore.

{
    "registries": {
        "ghcr.io": {
            "ignore": true
        }
    },
    "images": {
        "exclude": ["ghcr.io/teruncius/redacted"]
    }
}