@@ -5,8 +5,8 @@ import (

 	"github.com/docker/docker/daemon/config"

 	"github.com/docker/docker/daemon/pkg/opts"

+	"github.com/docker/docker/daemon/pkg/registry"

 	dopts "github.com/docker/docker/internal/opts"

-	"github.com/docker/docker/registry"

 	"github.com/spf13/pflag"

 )

@@ -14,8 +14,8 @@ import (

 	"dario.cat/mergo"

 	"github.com/containerd/log"

 	"github.com/docker/docker/daemon/pkg/opts"

+	"github.com/docker/docker/daemon/pkg/registry"

 	dopts "github.com/docker/docker/internal/opts"

-	"github.com/docker/docker/registry"

 	"github.com/moby/moby/api"

 	"github.com/moby/moby/api/types/versions"

 	"github.com/pkg/errors"

@@ -13,7 +13,7 @@ import (

 	"dario.cat/mergo"

 	"github.com/docker/docker/daemon/libnetwork/ipamutils"

 	"github.com/docker/docker/daemon/pkg/opts"

-	"github.com/docker/docker/registry"

+	"github.com/docker/docker/daemon/pkg/registry"

 	"github.com/google/go-cmp/cmp"

 	"github.com/google/go-cmp/cmp/cmpopts"

 	"github.com/spf13/pflag"

@@ -10,9 +10,9 @@ import (

 	cerrdefs "github.com/containerd/errdefs"

 	"github.com/containerd/log"

 	"github.com/distribution/reference"

+	"github.com/docker/docker/daemon/pkg/registry"

 	"github.com/docker/docker/dockerversion"

 	"github.com/docker/docker/pkg/useragent"

-	"github.com/docker/docker/registry"

 	registrytypes "github.com/moby/moby/api/types/registry"

 )

@@ -55,6 +55,7 @@ import (

 	dlogger "github.com/docker/docker/daemon/logger"

 	"github.com/docker/docker/daemon/network"

 	"github.com/docker/docker/daemon/pkg/plugin"

+	"github.com/docker/docker/daemon/pkg/registry"

 	"github.com/docker/docker/daemon/snapshotter"

 	"github.com/docker/docker/daemon/stats"

 	volumesservice "github.com/docker/docker/daemon/volume/service"

@@ -64,7 +65,6 @@ import (

 	"github.com/docker/docker/pkg/idtools"

 	"github.com/docker/docker/pkg/plugingetter"

 	"github.com/docker/docker/pkg/sysinfo"

-	"github.com/docker/docker/registry"

 	"github.com/moby/buildkit/util/grpcerrors"

 	"github.com/moby/buildkit/util/tracing"

 	"github.com/moby/locker"

@@ -16,7 +16,7 @@ import (

 	"github.com/containerd/containerd/v2/core/remotes/docker"

 	hostconfig "github.com/containerd/containerd/v2/core/remotes/docker/config"

 	cerrdefs "github.com/containerd/errdefs"

-	"github.com/docker/docker/registry"

+	"github.com/docker/docker/daemon/pkg/registry"

 	"github.com/pkg/errors"

 )

@@ -19,13 +19,13 @@ import (

 	"github.com/docker/docker/daemon/internal/filedescriptors"

 	"github.com/docker/docker/daemon/internal/metrics"

 	"github.com/docker/docker/daemon/logger"

+	"github.com/docker/docker/daemon/pkg/registry"

 	"github.com/docker/docker/dockerversion"

 	"github.com/docker/docker/internal/platform"

 	"github.com/docker/docker/pkg/meminfo"

 	"github.com/docker/docker/pkg/parsers/kernel"

 	"github.com/docker/docker/pkg/parsers/operatingsystem"

 	"github.com/docker/docker/pkg/sysinfo"

-	"github.com/docker/docker/registry"

 	"github.com/moby/moby/api/types"

 	"github.com/moby/moby/api/types/system"

 	"github.com/opencontainers/selinux/go-selinux"

@@ -14,8 +14,8 @@ import (

 	"github.com/docker/docker/daemon/internal/image"

 	"github.com/docker/docker/daemon/internal/layer"

 	refstore "github.com/docker/docker/daemon/internal/refstore"

+	registrypkg "github.com/docker/docker/daemon/pkg/registry"

 	"github.com/docker/docker/pkg/progress"

-	registrypkg "github.com/docker/docker/registry"

 	"github.com/moby/moby/api/types/events"

 	"github.com/moby/moby/api/types/registry"

 	"github.com/opencontainers/go-digest"

@@ -15,7 +15,7 @@ import (

 	"github.com/docker/distribution"

 	"github.com/docker/distribution/manifest/manifestlist"

 	"github.com/docker/distribution/manifest/schema2"

-	"github.com/docker/docker/registry"

+	"github.com/docker/docker/daemon/pkg/registry"

 	"github.com/opencontainers/go-digest"

 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"

 	"github.com/pkg/errors"

@@ -7,7 +7,7 @@ import (

 	"github.com/containerd/log"

 	"github.com/distribution/reference"

 	refstore "github.com/docker/docker/daemon/internal/refstore"

-	"github.com/docker/docker/registry"

+	"github.com/docker/docker/daemon/pkg/registry"

 	"github.com/moby/moby/api/types/events"

 	"github.com/opencontainers/go-digest"

 	"github.com/pkg/errors"

@@ -22,10 +22,10 @@ import (

 	"github.com/docker/docker/daemon/internal/image"

 	"github.com/docker/docker/daemon/internal/layer"

 	refstore "github.com/docker/docker/daemon/internal/refstore"

+	"github.com/docker/docker/daemon/pkg/registry"

 	"github.com/docker/docker/pkg/ioutils"

 	"github.com/docker/docker/pkg/progress"

 	"github.com/docker/docker/pkg/stringid"

-	"github.com/docker/docker/registry"

 	"github.com/opencontainers/go-digest"

 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"

 	"github.com/pkg/errors"

@@ -12,7 +12,7 @@ import (

 	"github.com/distribution/reference"

 	"github.com/docker/docker/daemon/internal/image"

-	"github.com/docker/docker/registry"

+	"github.com/docker/docker/daemon/pkg/registry"

 	registrytypes "github.com/moby/moby/api/types/registry"

 	"github.com/opencontainers/go-digest"

 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"

@@ -17,10 +17,10 @@ import (

 	"github.com/docker/docker/daemon/internal/distribution/metadata"

 	"github.com/docker/docker/daemon/internal/distribution/xfer"

 	"github.com/docker/docker/daemon/internal/layer"

+	"github.com/docker/docker/daemon/pkg/registry"

 	"github.com/docker/docker/pkg/ioutils"

 	"github.com/docker/docker/pkg/progress"

 	"github.com/docker/docker/pkg/stringid"

-	"github.com/docker/docker/registry"

 	apitypes "github.com/moby/moby/api/types"

 	"github.com/opencontainers/go-digest"

 	"github.com/pkg/errors"

@@ -13,8 +13,8 @@ import (

 	"github.com/docker/docker/daemon/internal/distribution/metadata"

 	"github.com/docker/docker/daemon/internal/layer"

 	refstore "github.com/docker/docker/daemon/internal/refstore"

+	registrypkg "github.com/docker/docker/daemon/pkg/registry"

 	"github.com/docker/docker/pkg/progress"

-	registrypkg "github.com/docker/docker/registry"

 	"github.com/moby/moby/api/types/registry"

 	"github.com/opencontainers/go-digest"

 	"gotest.tools/v3/assert"

@@ -12,8 +12,8 @@ import (

 	"github.com/docker/distribution/manifest/schema2"

 	"github.com/docker/distribution/registry/client"

 	"github.com/docker/distribution/registry/client/auth"

+	"github.com/docker/docker/daemon/pkg/registry"

 	"github.com/docker/docker/dockerversion"

-	"github.com/docker/docker/registry"

 	registrytypes "github.com/moby/moby/api/types/registry"

 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"

 )

@@ -9,7 +9,7 @@ import (

 	"testing"

 	"github.com/distribution/reference"

-	registrypkg "github.com/docker/docker/registry"

+	registrypkg "github.com/docker/docker/daemon/pkg/registry"

 	"github.com/moby/moby/api/types/registry"

 	"gotest.tools/v3/assert"

 )

@@ -16,10 +16,10 @@ import (

 	"github.com/containerd/containerd/v2/plugins/content/local"

 	"github.com/containerd/log"

 	v2 "github.com/docker/docker/daemon/pkg/plugin/v2"

+	"github.com/docker/docker/daemon/pkg/registry"

 	"github.com/docker/docker/internal/containerfs"

 	"github.com/docker/docker/internal/lazyregexp"

 	"github.com/docker/docker/pkg/authorization"

-	"github.com/docker/docker/registry"

 	"github.com/moby/moby/api/types"

 	"github.com/moby/moby/api/types/events"

 	"github.com/moby/pubsub"

new file mode 100644

@@ -0,0 +1,205 @@

+package registry

+

+import (

+	"context"

+	"net/http"

+	"net/url"

+	"strings"

+	"time"

+

+	"github.com/containerd/log"

+	"github.com/docker/distribution/registry/client/auth"

+	"github.com/docker/distribution/registry/client/auth/challenge"

+	"github.com/docker/distribution/registry/client/transport"

+	"github.com/moby/moby/api/types/registry"

+	"github.com/pkg/errors"

+)

+

+// AuthClientID is used the ClientID used for the token server

+const AuthClientID = "docker"

+

+type loginCredentialStore struct {

+	authConfig *registry.AuthConfig

+}

+

+func (lcs loginCredentialStore) Basic(*url.URL) (string, string) {

+	return lcs.authConfig.Username, lcs.authConfig.Password

+}

+

+func (lcs loginCredentialStore) RefreshToken(*url.URL, string) string {

+	return lcs.authConfig.IdentityToken

+}

+

+func (lcs loginCredentialStore) SetRefreshToken(u *url.URL, service, token string) {

+	lcs.authConfig.IdentityToken = token

+}

+

+type staticCredentialStore struct {

+	auth *registry.AuthConfig

+}

+

+// NewStaticCredentialStore returns a credential store

+// which always returns the same credential values.

+func NewStaticCredentialStore(ac *registry.AuthConfig) auth.CredentialStore {

+	return staticCredentialStore{

+		auth: ac,

+	}

+}

+

+func (scs staticCredentialStore) Basic(*url.URL) (string, string) {

+	if scs.auth == nil {

+		return "", ""

+	}

+	return scs.auth.Username, scs.auth.Password

+}

+

+func (scs staticCredentialStore) RefreshToken(*url.URL, string) string {

+	if scs.auth == nil {

+		return ""

+	}

+	return scs.auth.IdentityToken

+}

+

+func (staticCredentialStore) SetRefreshToken(*url.URL, string, string) {

+}

+

+// loginV2 tries to login to the v2 registry server. The given registry

+// endpoint will be pinged to get authorization challenges. These challenges

+// will be used to authenticate against the registry to validate credentials.

+func loginV2(ctx context.Context, authConfig *registry.AuthConfig, endpoint APIEndpoint, userAgent string) (token string, _ error) {

+	endpointStr := strings.TrimRight(endpoint.URL.String(), "/") + "/v2/"

+	log.G(ctx).WithField("endpoint", endpointStr).Debug("attempting v2 login to registry endpoint")

+

+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpointStr, http.NoBody)

+	if err != nil {

+		return "", err

+	}

+

+	var (

+		modifiers            = Headers(userAgent, nil)

+		authTrans            = transport.NewTransport(newTransport(endpoint.TLSConfig), modifiers...)

+		credentialAuthConfig = *authConfig

+		creds                = loginCredentialStore{authConfig: &credentialAuthConfig}

+	)

+

+	loginClient, err := v2AuthHTTPClient(endpoint.URL, authTrans, modifiers, creds, nil)

+	if err != nil {

+		return "", err

+	}

+

+	resp, err := loginClient.Do(req)

+	if err != nil {

+		err = translateV2AuthError(err)

+		return "", err

+	}

+	defer resp.Body.Close()

+

+	if resp.StatusCode != http.StatusOK {

+		// TODO(dmcgowan): Attempt to further interpret result, status code and error code string

+		return "", errors.Errorf("login attempt to %s failed with status: %d %s", endpointStr, resp.StatusCode, http.StatusText(resp.StatusCode))

+	}

+

+	return credentialAuthConfig.IdentityToken, nil

+}

+

+func v2AuthHTTPClient(endpoint *url.URL, authTransport http.RoundTripper, modifiers []transport.RequestModifier, creds auth.CredentialStore, scopes []auth.Scope) (*http.Client, error) {

+	challengeManager, err := PingV2Registry(endpoint, authTransport)

+	if err != nil {

+		return nil, err

+	}

+

+	authHandlers := []auth.AuthenticationHandler{

+		auth.NewTokenHandlerWithOptions(auth.TokenHandlerOptions{

+			Transport:     authTransport,

+			Credentials:   creds,

+			OfflineAccess: true,

+			ClientID:      AuthClientID,

+			Scopes:        scopes,

+		}),

+		auth.NewBasicHandler(creds),

+	}

+

+	modifiers = append(modifiers, auth.NewAuthorizer(challengeManager, authHandlers...))

+

+	return &http.Client{

+		Transport: transport.NewTransport(authTransport, modifiers...),

+		Timeout:   15 * time.Second,

+	}, nil

+}

+

+// ConvertToHostname normalizes a registry URL which has http|https prepended

+// to just its hostname. It is used to match credentials, which may be either

+// stored as hostname or as hostname including scheme (in legacy configuration

+// files).

+func ConvertToHostname(maybeURL string) string {

+	stripped := maybeURL

+	if scheme, remainder, ok := strings.Cut(stripped, "://"); ok {

+		switch scheme {

+		case "http", "https":

+			stripped = remainder

+		default:

+			// unknown, or no scheme; doing nothing for now, as we never did.

+		}

+	}

+	stripped, _, _ = strings.Cut(stripped, "/")

+	return stripped

+}

+

+// ResolveAuthConfig matches an auth configuration to a server address or a URL

+func ResolveAuthConfig(authConfigs map[string]registry.AuthConfig, index *registry.IndexInfo) registry.AuthConfig {

+	configKey := GetAuthConfigKey(index)

+	// First try the happy case

+	if c, found := authConfigs[configKey]; found || index.Official {

+		return c

+	}

+

+	// Maybe they have a legacy config file, we will iterate the keys converting

+	// them to the new format and testing

+	for registryURL, ac := range authConfigs {

+		if configKey == ConvertToHostname(registryURL) {

+			return ac

+		}

+	}

+

+	// When all else fails, return an empty auth config

+	return registry.AuthConfig{}

+}

+

+// PingResponseError is used when the response from a ping

+// was received but invalid.

+type PingResponseError struct {

+	Err error

+}

+

+func (err PingResponseError) Error() string {

+	return err.Err.Error()

+}

+

+// PingV2Registry attempts to ping a v2 registry and on success return a

+// challenge manager for the supported authentication types.

+// If a response is received but cannot be interpreted, a PingResponseError will be returned.

+func PingV2Registry(endpoint *url.URL, authTransport http.RoundTripper) (challenge.Manager, error) {

+	pingClient := &http.Client{

+		Transport: authTransport,

+		Timeout:   15 * time.Second,

+	}

+	endpointStr := strings.TrimRight(endpoint.String(), "/") + "/v2/"

+	req, err := http.NewRequest(http.MethodGet, endpointStr, http.NoBody)

+	if err != nil {

+		return nil, err

+	}

+	resp, err := pingClient.Do(req)

+	if err != nil {

+		return nil, err

+	}

+	defer resp.Body.Close()

+

+	challengeManager := challenge.NewSimpleManager()

+	if err := challengeManager.AddResponse(resp); err != nil {

+		return nil, PingResponseError{

+			Err: err,

+		}

+	}

+

+	return challengeManager, nil

+}

new file mode 100644

@@ -0,0 +1,106 @@

+package registry

+

+import (

+	"testing"

+

+	"github.com/moby/moby/api/types/registry"

+	"gotest.tools/v3/assert"

+)

+

+func buildAuthConfigs() map[string]registry.AuthConfig {

+	authConfigs := map[string]registry.AuthConfig{}

+

+	for _, reg := range []string{"testIndex", IndexServer} {

+		authConfigs[reg] = registry.AuthConfig{

+			Username: "docker-user",

+			Password: "docker-pass",

+		}

+	}

+

+	return authConfigs

+}

+

+func TestResolveAuthConfigIndexServer(t *testing.T) {

+	authConfigs := buildAuthConfigs()

+	indexConfig := authConfigs[IndexServer]

+

+	officialIndex := &registry.IndexInfo{

+		Official: true,

+	}

+	privateIndex := &registry.IndexInfo{

+		Official: false,

+	}

+

+	resolved := ResolveAuthConfig(authConfigs, officialIndex)

+	assert.Equal(t, resolved, indexConfig, "Expected ResolveAuthConfig to return IndexServer")

+

+	resolved = ResolveAuthConfig(authConfigs, privateIndex)

+	assert.Check(t, resolved != indexConfig, "Expected ResolveAuthConfig to not return IndexServer")

+}

+

+func TestResolveAuthConfigFullURL(t *testing.T) {

+	authConfigs := buildAuthConfigs()

+

+	registryAuth := registry.AuthConfig{

+		Username: "foo-user",

+		Password: "foo-pass",

+	}

+	localAuth := registry.AuthConfig{

+		Username: "bar-user",

+		Password: "bar-pass",

+	}

+	officialAuth := registry.AuthConfig{

+		Username: "baz-user",

+		Password: "baz-pass",

+	}

+	authConfigs[IndexServer] = officialAuth

+

+	expectedAuths := map[string]registry.AuthConfig{

+		"registry.example.com": registryAuth,

+		"localhost:8000":       localAuth,

+		"example.com":          localAuth,

+	}

+

+	validRegistries := map[string][]string{

+		"registry.example.com": {

+			"https://registry.example.com/v1/",

+			"http://registry.example.com/v1/",

+			"registry.example.com",

+			"registry.example.com/v1/",

+		},

+		"localhost:8000": {

+			"https://localhost:8000/v1/",

+			"http://localhost:8000/v1/",

+			"localhost:8000",

+			"localhost:8000/v1/",

+		},

+		"example.com": {

+			"https://example.com/v1/",

+			"http://example.com/v1/",

+			"example.com",

+			"example.com/v1/",

+		},

+	}

+

+	for configKey, registries := range validRegistries {

+		configured, ok := expectedAuths[configKey]

+		if !ok {

+			t.Fail()

+		}

+		index := &registry.IndexInfo{

+			Name: configKey,

+		}

+		for _, reg := range registries {

+			authConfigs[reg] = configured

+			resolved := ResolveAuthConfig(authConfigs, index)

+			if resolved.Username != configured.Username || resolved.Password != configured.Password {

+				t.Errorf("%s -> %v != %v\n", reg, resolved, configured)

+			}

+			delete(authConfigs, reg)

+			resolved = ResolveAuthConfig(authConfigs, index)

+			if resolved.Username == configured.Username || resolved.Password == configured.Password {

+				t.Errorf("%s -> %v == %v\n", reg, resolved, configured)

+			}

+		}

+	}

+}

new file mode 100644

@@ -0,0 +1,449 @@

+// FIXME(thaJeztah): remove once we are a module; the go:build directive prevents go from downgrading language version to go1.16:

+//go:build go1.23

+

+package registry

+

+import (

+	"context"

+	"net"

+	"net/url"

+	"os"

+	"path/filepath"

+	"regexp"

+	"runtime"

+	"strconv"

+	"strings"

+	"sync"

+

+	"github.com/containerd/log"

+	"github.com/distribution/reference"

+	"github.com/moby/moby/api/types/registry"

+)

+

+// ServiceOptions holds command line options.

+type ServiceOptions struct {

+	Mirrors            []string `json:"registry-mirrors,omitempty"`

+	InsecureRegistries []string `json:"insecure-registries,omitempty"`

+}

+

+// serviceConfig holds daemon configuration for the registry service.

+type serviceConfig registry.ServiceConfig

+

+// TODO(thaJeztah) both the "index.docker.io" and "registry-1.docker.io" domains

+// are here for historic reasons and backward-compatibility. These domains

+// are still supported by Docker Hub (and will continue to be supported), but

+// there are new domains already in use, and plans to consolidate all legacy

+// domains to new "canonical" domains. Once those domains are decided on, we

+// should update these consts (but making sure to preserve compatibility with

+// existing installs, clients, and user configuration).

+const (

+	// DefaultNamespace is the default namespace

+	DefaultNamespace = "docker.io"

+	// DefaultRegistryHost is the hostname for the default (Docker Hub) registry

+	// used for pushing and pulling images. This hostname is hard-coded to handle

+	// the conversion from image references without registry name (e.g. "ubuntu",

+	// or "ubuntu:latest"), as well as references using the "docker.io" domain

+	// name, which is used as canonical reference for images on Docker Hub, but

+	// does not match the domain-name of Docker Hub's registry.

+	DefaultRegistryHost = "registry-1.docker.io"

+	// IndexHostname is the index hostname, used for authentication and image search.

+	IndexHostname = "index.docker.io"

+	// IndexServer is used for user auth and image search

+	IndexServer = "https://" + IndexHostname + "/v1/"

+	// IndexName is the name of the index

+	IndexName = "docker.io"

+)

+

+var (

+	// DefaultV2Registry is the URI of the default (Docker Hub) registry.

+	DefaultV2Registry = &url.URL{

+		Scheme: "https",

+		Host:   DefaultRegistryHost,

+	}

+

+	validHostPortRegex = sync.OnceValue(func() *regexp.Regexp {

+		return regexp.MustCompile(`^` + reference.DomainRegexp.String() + `$`)

+	})

+)

+

+// runningWithRootlessKit is a fork of [rootless.RunningWithRootlessKit],

+// but inlining it to prevent adding that as a dependency for docker/cli.

+//

+// [rootless.RunningWithRootlessKit]: https://github.com/moby/moby/blob/b4bdf12daec84caaf809a639f923f7370d4926ad/pkg/rootless/rootless.go#L5-L8

+func runningWithRootlessKit() bool {

+	return runtime.GOOS == "linux" && os.Getenv("ROOTLESSKIT_STATE_DIR") != ""

+}

+

+// CertsDir is the directory where certificates are stored.

+//

+// - Linux: "/etc/docker/certs.d/"

+// - Linux (with rootlessKit): $XDG_CONFIG_HOME/docker/certs.d/" or "$HOME/.config/docker/certs.d/"

+// - Windows: "%PROGRAMDATA%/docker/certs.d/"

+//

+// TODO(thaJeztah): certsDir but stored in our config, and passed when needed. For the CLI, we should also default to same path as rootless.

+func CertsDir() string {

+	certsDir := "/etc/docker/certs.d"

+	if runningWithRootlessKit() {

+		if configHome, _ := os.UserConfigDir(); configHome != "" {

+			certsDir = filepath.Join(configHome, "docker", "certs.d")

+		}

+	} else if runtime.GOOS == "windows" {

+		certsDir = filepath.Join(os.Getenv("programdata"), "docker", "certs.d")

+	}

+	return certsDir

+}

+

+// newServiceConfig returns a new instance of ServiceConfig

+func newServiceConfig(options ServiceOptions) (*serviceConfig, error) {

+	config := &serviceConfig{}

+	if err := config.loadMirrors(options.Mirrors); err != nil {

+		return nil, err

+	}

+	if err := config.loadInsecureRegistries(options.InsecureRegistries); err != nil {

+		return nil, err

+	}

+

+	return config, nil

+}

+

+// copy constructs a new ServiceConfig with a copy of the configuration in config.

+func (config *serviceConfig) copy() *registry.ServiceConfig {

+	ic := make(map[string]*registry.IndexInfo)

+	for key, value := range config.IndexConfigs {

+		ic[key] = value

+	}

+	return &registry.ServiceConfig{

+		InsecureRegistryCIDRs: append([]*registry.NetIPNet(nil), config.InsecureRegistryCIDRs...),

+		IndexConfigs:          ic,

+		Mirrors:               append([]string(nil), config.Mirrors...),

+	}

+}

+

+// loadMirrors loads mirrors to config, after removing duplicates.

+// Returns an error if mirrors contains an invalid mirror.

+func (config *serviceConfig) loadMirrors(mirrors []string) error {

+	mMap := map[string]struct{}{}

+	unique := []string{}

+

+	for _, mirror := range mirrors {

+		m, err := ValidateMirror(mirror)

+		if err != nil {

+			return err

+		}

+		if _, exist := mMap[m]; !exist {

+			mMap[m] = struct{}{}

+			unique = append(unique, m)

+		}

+	}

+

+	config.Mirrors = unique

+

+	// Configure public registry since mirrors may have changed.

+	config.IndexConfigs = map[string]*registry.IndexInfo{

+		IndexName: {

+			Name:     IndexName,

+			Mirrors:  unique,

+			Secure:   true,

+			Official: true,

+		},

+	}

+

+	return nil

+}

+

+// loadInsecureRegistries loads insecure registries to config

+func (config *serviceConfig) loadInsecureRegistries(registries []string) error {

+	// Localhost is by default considered as an insecure registry. This is a

+	// stop-gap for people who are running a private registry on localhost.

+	registries = append(registries, "::1/128", "127.0.0.0/8")

+

+	var (

+		insecureRegistryCIDRs = make([]*registry.NetIPNet, 0)

+		indexConfigs          = make(map[string]*registry.IndexInfo)

+	)

+

+skip:

+	for _, r := range registries {

+		// validate insecure registry

+		if _, err := ValidateIndexName(r); err != nil {

+			return err

+		}

+		if scheme, host, ok := strings.Cut(r, "://"); ok {

+			switch strings.ToLower(scheme) {

+			case "http", "https":

+				log.G(context.TODO()).Warnf("insecure registry %[1]s should not contain '%[2]s' and '%[2]ss' has been removed from the insecure registry config", r, scheme)

+				r = host

+			default:

+				// unsupported scheme

+				return invalidParamf("insecure registry %s should not contain '://'", r)

+			}

+		}

+		// Check if CIDR was passed to --insecure-registry

+		_, ipnet, err := net.ParseCIDR(r)

+		if err == nil {

+			// Valid CIDR. If ipnet is already in config.InsecureRegistryCIDRs, skip.

+			data := (*registry.NetIPNet)(ipnet)

+			for _, value := range insecureRegistryCIDRs {

+				if value.IP.String() == data.IP.String() && value.Mask.String() == data.Mask.String() {

+					continue skip

+				}

+			}

+			// ipnet is not found, add it in config.InsecureRegistryCIDRs

+			insecureRegistryCIDRs = append(insecureRegistryCIDRs, data)

+		} else {

+			if err := validateHostPort(r); err != nil {

+				return invalidParamWrapf(err, "insecure registry %s is not valid", r)

+			}

+			// Assume `host:port` if not CIDR.

+			indexConfigs[r] = &registry.IndexInfo{

+				Name:     r,

+				Mirrors:  []string{},

+				Secure:   false,

+				Official: false,

+			}

+		}

+	}

+

+	// Configure public registry.

+	indexConfigs[IndexName] = &registry.IndexInfo{

+		Name:     IndexName,

+		Mirrors:  config.Mirrors,

+		Secure:   true,

+		Official: true,

+	}

+	config.InsecureRegistryCIDRs = insecureRegistryCIDRs

+	config.IndexConfigs = indexConfigs

+

+	return nil

+}

+

+// isSecureIndex returns false if the provided indexName is part of the list of insecure registries

+// Insecure registries accept HTTP and/or accept HTTPS with certificates from unknown CAs.

+//

+// The list of insecure registries can contain an element with CIDR notation to specify a whole subnet.

+// If the subnet contains one of the IPs of the registry specified by indexName, the latter is considered

+// insecure.

+//

+// indexName should be a URL.Host (`host:port` or `host`) where the `host` part can be either a domain name

+// or an IP address. If it is a domain name, then it will be resolved in order to check if the IP is contained

+// in a subnet. If the resolving is not successful, isSecureIndex will only try to match hostname to any element

+// of insecureRegistries.

+func (config *serviceConfig) isSecureIndex(indexName string) bool {

+	// Check for configured index, first.  This is needed in case isSecureIndex

+	// is called from anything besides newIndexInfo, in order to honor per-index configurations.

+	if index, ok := config.IndexConfigs[indexName]; ok {

+		return index.Secure

+	}

+

+	return !isCIDRMatch(config.InsecureRegistryCIDRs, indexName)

+}

+

+// for mocking in unit tests.

+var lookupIP = net.LookupIP

+

+// isCIDRMatch returns true if urlHost matches an element of cidrs. urlHost is a URL.Host ("host:port" or "host")

+// where the `host` part can be either a domain name or an IP address. If it is a domain name, then it will be

+// resolved to IP addresses for matching. If resolution fails, false is returned.

+func isCIDRMatch(cidrs []*registry.NetIPNet, urlHost string) bool {

+	if len(cidrs) == 0 {

+		return false

+	}

+

+	host, _, err := net.SplitHostPort(urlHost)

+	if err != nil {

+		// Assume urlHost is a host without port and go on.

+		host = urlHost

+	}

+

+	var addresses []net.IP

+	if ip := net.ParseIP(host); ip != nil {

+		// Host is an IP-address.

+		addresses = append(addresses, ip)

+	} else {

+		// Try to resolve the host's IP-address.

+		addresses, err = lookupIP(host)

+		if err != nil {

+			// We failed to resolve the host; assume there's no match.

+			return false

+		}

+	}

+

+	for _, addr := range addresses {

+		for _, ipnet := range cidrs {

+			// check if the addr falls in the subnet

+			if (*net.IPNet)(ipnet).Contains(addr) {

+				return true

+			}

+		}

+	}

+

+	return false

+}

+

+// ValidateMirror validates and normalizes an HTTP(S) registry mirror. It

+// returns an error if the given mirrorURL is invalid, or the normalized

+// format for the URL otherwise.

+//

+// It is used by the daemon to validate the daemon configuration.

+func ValidateMirror(mirrorURL string) (string, error) {

+	// Fast path for missing scheme, as url.Parse splits by ":", which can

+	// cause the hostname to be considered the "scheme" when using "hostname:port".

+	if scheme, _, ok := strings.Cut(mirrorURL, "://"); !ok || scheme == "" {

+		return "", invalidParamf("invalid mirror: no scheme specified for %q: must use either 'https://' or 'http://'", mirrorURL)

+	}

+	uri, err := url.Parse(mirrorURL)

+	if err != nil {

+		return "", invalidParamWrapf(err, "invalid mirror: %q is not a valid URI", mirrorURL)

+	}

+	if uri.Scheme != "http" && uri.Scheme != "https" {

+		return "", invalidParamf("invalid mirror: unsupported scheme %q in %q: must use either 'https://' or 'http://'", uri.Scheme, uri)

+	}

+	if uri.RawQuery != "" || uri.Fragment != "" {

+		return "", invalidParamf("invalid mirror: query or fragment at end of the URI %q", uri)

+	}

+	if uri.User != nil {

+		// strip password from output

+		uri.User = url.UserPassword(uri.User.Username(), "xxxxx")

+		return "", invalidParamf("invalid mirror: username/password not allowed in URI %q", uri)

+	}

+	return strings.TrimSuffix(mirrorURL, "/") + "/", nil

+}

+

+// ValidateIndexName validates an index name. It is used by the daemon to

+// validate the daemon configuration.

+func ValidateIndexName(val string) (string, error) {

+	val = normalizeIndexName(val)

+	if strings.HasPrefix(val, "-") || strings.HasSuffix(val, "-") {

+		return "", invalidParamf("invalid index name (%s). Cannot begin or end with a hyphen", val)

+	}

+	return val, nil

+}

+

+func normalizeIndexName(val string) string {

+	// TODO(thaJeztah): consider normalizing other known options, such as "(https://)registry-1.docker.io", "https://index.docker.io/v1/".

+	// TODO: upstream this to check to reference package

+	if val == "index.docker.io" {

+		return "docker.io"

+	}

+	return val

+}

+

+func hasScheme(reposName string) bool {

+	return strings.Contains(reposName, "://")

+}

+

+func validateHostPort(s string) error {

+	// Split host and port, and in case s can not be split, assume host only

+	host, port, err := net.SplitHostPort(s)

+	if err != nil {

+		host = s