@@ -80,7 +80,7 @@ google.golang.org/grpc                              6eaf6f47437a6b4e2153a190160e

 # the containerd project first, and update both after that is merged.

 # This commit does not need to match RUNC_COMMIT as it is used for helper

 # packages but should be newer or equal.

-github.com/opencontainers/runc                      3e425f80a8c931f88e6d94a8c831b9d5aa481657 # v1.0.0-rc8-92-g84373aaa

+github.com/opencontainers/runc                      d736ef14f0288d6993a1845745d6756cfc9ddd5a # v1.0.0-rc9

 github.com/opencontainers/runtime-spec              29686dbc5559d93fb1ef402eeda3e35c38d75af4 # v1.0.1-59-g29686db

 github.com/opencontainers/image-spec                d60099175f88c47cd379c4738d158884749ed235 # v1.0.1

 github.com/seccomp/libseccomp-golang                689e3c1541a84461afc49c1c87352a6cedf72e9c # v0.9.1

@@ -117,7 +117,7 @@ github.com/googleapis/gax-go                        317e0006254c44a0ac427cc52a0e

 google.golang.org/genproto                          694d95ba50e67b2e363f3483057db5d4910c18f9

 # containerd

-github.com/containerd/containerd                    36cf5b690dcc00ff0f34ff7799209050c3d0c59a # v1.3.0

+github.com/containerd/containerd                    acdcf13d5eaf0dfe0eaeabe7194a82535549bc2b

 github.com/containerd/fifo                          bda0ff6ed73c67bfb5e62bc9c697f146b7fd7f13

 github.com/containerd/continuity                    f2a389ac0a02ce21c09edd7344677a601970f41c

 github.com/containerd/cgroups                       5fbad35c2a7e855762d3c60f2e474ffcad0d470a

@@ -210,6 +210,34 @@ See [PLUGINS.md](PLUGINS.md) for how to create plugins

 Please see [RELEASES.md](RELEASES.md) for details on versioning and stability

 of containerd components.

+Downloadable 64-bit Intel/AMD binaries of all official releases are available on

+our [releases page](https://github.com/containerd/containerd/releases), as well as

+auto-published to the [cri-containerd-release storage bucket](https://console.cloud.google.com/storage/browser/cri-containerd-release?pli=1).

+

+For other architectures and distribution support, you will find that many

+Linux distributions package their own containerd and provide it across several

+architectures, such as [Canonical's Ubuntu packaging](https://launchpad.net/ubuntu/bionic/+package/containerd).

+

+#### Enabling command auto-completion

+

+Starting with containerd 1.4, the urfave client feature for auto-creation of bash

+autocompletion data is enabled. To use the autocomplete feature in your shell, source

+the autocomplete/bash_autocomplete file in your .bashrc file while setting the `PROG`

+variable to `ctr`:

+

+```

+$ PROG=ctr source vendor/github.com/urfave/cli/autocomplete/bash_autocomplete

+```

+

+#### Distribution of `ctr` autocomplete for bash

+

+Copy `vendor/github.com/urfave/cli/autocomplete/bash_autocomplete` into

+`/etc/bash_completion.d/` and rename it to `ctr`.

+

+Provide documentation to users to `source` this file into their shell if

+you don't place the autocomplete file in a location where it is automatically

+loaded for user's bash shell environment.

+

 ### Communication

 For async communication and long running discussions please use issues and pull requests on the github repo.

@@ -263,7 +263,7 @@ func getRecords(ctx context.Context, store content.Provider, desc ocispec.Descri

 		images.HandlerFunc(exportHandler),

 	)

-	// Walk sequentially since the number of fetchs is likely one and doing in

+	// Walk sequentially since the number of fetches is likely one and doing in

 	// parallel requires locking the export handler

 	if err := images.Walk(ctx, handlers, desc); err != nil {

 		return nil, err

@@ -20,7 +20,7 @@ import (

 	"strings"

 	"github.com/containerd/containerd/reference"

-	distref "github.com/docker/distribution/reference"

+	distref "github.com/containerd/containerd/reference/docker"

 	"github.com/opencontainers/go-digest"

 	"github.com/pkg/errors"

 )

@@ -24,7 +24,7 @@ import (

 )

 // WithLease attaches a lease on the context

-func (c *Client) WithLease(ctx context.Context) (context.Context, func(context.Context) error, error) {

+func (c *Client) WithLease(ctx context.Context, opts ...leases.Opt) (context.Context, func(context.Context) error, error) {

 	_, ok := leases.FromContext(ctx)

 	if ok {

 		return ctx, func(context.Context) error {

@@ -34,7 +34,15 @@ func (c *Client) WithLease(ctx context.Context) (context.Context, func(context.C

 	ls := c.LeasesService()

-	l, err := ls.Create(ctx, leases.WithRandomID(), leases.WithExpiration(24*time.Hour))

+	if len(opts) == 0 {

+		// Use default lease configuration if no options provided

+		opts = []leases.Opt{

+			leases.WithRandomID(),

+			leases.WithExpiration(24 * time.Hour),

+		}

+	}

+

+	l, err := ls.Create(ctx, opts...)

 	if err != nil {

 		return nil, nil, err

 	}

@@ -1006,6 +1006,21 @@ func WithParentCgroupDevices(_ context.Context, _ Client, _ *containers.Containe

 	return nil

 }

+// WithAllDevicesAllowed permits READ WRITE MKNOD on all devices nodes for the container

+func WithAllDevicesAllowed(_ context.Context, _ Client, _ *containers.Container, s *Spec) error {

+	setLinux(s)

+	if s.Linux.Resources == nil {

+		s.Linux.Resources = &specs.LinuxResources{}

+	}

+	s.Linux.Resources.Devices = []specs.LinuxDeviceCgroup{

+		{

+			Allow:  true,

+			Access: rwm,

+		},

+	}

+	return nil

+}

+

 // WithDefaultUnixDevices adds the default devices for unix such as /dev/null, /dev/random to

 // the container's resource cgroup spec

 func WithDefaultUnixDevices(_ context.Context, _ Client, _ *containers.Container, s *Spec) error {

@@ -1100,7 +1115,6 @@ func WithDefaultUnixDevices(_ context.Context, _ Client, _ *containers.Container

 }

 // WithPrivileged sets up options for a privileged container

-// TODO(justincormack) device handling

 var WithPrivileged = Compose(

 	WithAllCapabilities,

 	WithMaskedPaths(nil),

@@ -19,12 +19,69 @@

 package oci

 import (

+	"context"

+	"io/ioutil"

 	"os"

+	"path/filepath"

+	"github.com/containerd/containerd/containers"

 	specs "github.com/opencontainers/runtime-spec/specs-go"

 	"golang.org/x/sys/unix"

 )

+// WithHostDevices adds all the hosts device nodes to the container's spec

+func WithHostDevices(_ context.Context, _ Client, _ *containers.Container, s *Spec) error {

+	setLinux(s)

+

+	devs, err := getDevices("/dev")

+	if err != nil {

+		return err

+	}

+	s.Linux.Devices = append(s.Linux.Devices, devs...)

+	return nil

+}

+

+func getDevices(path string) ([]specs.LinuxDevice, error) {

+	files, err := ioutil.ReadDir(path)

+	if err != nil {

+		return nil, err

+	}

+	var out []specs.LinuxDevice

+	for _, f := range files {

+		switch {

+		case f.IsDir():

+			switch f.Name() {

+			// ".lxc" & ".lxd-mounts" added to address https://github.com/lxc/lxd/issues/2825

+			// ".udev" added to address https://github.com/opencontainers/runc/issues/2093

+			case "pts", "shm", "fd", "mqueue", ".lxc", ".lxd-mounts", ".udev":

+				continue

+			default:

+				sub, err := getDevices(filepath.Join(path, f.Name()))

+				if err != nil {

+					return nil, err

+				}

+

+				out = append(out, sub...)

+				continue

+			}

+		case f.Name() == "console":

+			continue

+		}

+		device, err := deviceFromPath(filepath.Join(path, f.Name()), "rwm")

+		if err != nil {

+			if err == ErrNotADevice {

+				continue

+			}

+			if os.IsNotExist(err) {

+				continue

+			}

+			return nil, err

+		}

+		out = append(out, *device)

+	}

+	return out, nil

+}

+

 func deviceFromPath(path, permissions string) (*specs.LinuxDevice, error) {

 	var stat unix.Stat_t

 	if err := unix.Lstat(path, &stat); err != nil {

@@ -19,12 +19,69 @@

 package oci

 import (

+	"context"

+	"io/ioutil"

 	"os"

+	"path/filepath"

+	"github.com/containerd/containerd/containers"

 	specs "github.com/opencontainers/runtime-spec/specs-go"

 	"golang.org/x/sys/unix"

 )

+// WithHostDevices adds all the hosts device nodes to the container's spec

+func WithHostDevices(_ context.Context, _ Client, _ *containers.Container, s *Spec) error {

+	setLinux(s)

+

+	devs, err := getDevices("/dev")

+	if err != nil {

+		return err

+	}

+	s.Linux.Devices = append(s.Linux.Devices, devs...)

+	return nil

+}

+

+func getDevices(path string) ([]specs.LinuxDevice, error) {

+	files, err := ioutil.ReadDir(path)

+	if err != nil {

+		return nil, err

+	}

+	var out []specs.LinuxDevice

+	for _, f := range files {

+		switch {

+		case f.IsDir():

+			switch f.Name() {

+			// ".lxc" & ".lxd-mounts" added to address https://github.com/lxc/lxd/issues/2825

+			// ".udev" added to address https://github.com/opencontainers/runc/issues/2093

+			case "pts", "shm", "fd", "mqueue", ".lxc", ".lxd-mounts", ".udev":

+				continue

+			default:

+				sub, err := getDevices(filepath.Join(path, f.Name()))

+				if err != nil {

+					return nil, err

+				}

+

+				out = append(out, sub...)

+				continue

+			}

+		case f.Name() == "console":

+			continue

+		}

+		device, err := deviceFromPath(filepath.Join(path, f.Name()), "rwm")

+		if err != nil {

+			if err == ErrNotADevice {

+				continue

+			}

+			if os.IsNotExist(err) {

+				continue

+			}

+			return nil, err

+		}

+		out = append(out, *device)

+	}

+	return out, nil

+}

+

 func deviceFromPath(path, permissions string) (*specs.LinuxDevice, error) {

 	var stat unix.Stat_t

 	if err := unix.Lstat(path, &stat); err != nil {

@@ -67,6 +67,13 @@ func WithWindowNetworksAllowUnqualifiedDNSQuery() SpecOpts {

 	}

 }

+// WithHostDevices adds all the hosts device nodes to the container's spec

+//

+// Not supported on windows

+func WithHostDevices(_ context.Context, _ Client, _ *containers.Container, s *Spec) error {

+	return nil

+}

+

 func deviceFromPath(path, permissions string) (*specs.LinuxDevice, error) {

 	return nil, errors.New("device from path not supported on Windows")

 }

@@ -69,3 +69,7 @@ func (s *deletedState) SetExited(status int) {

 func (s *deletedState) Exec(ctx context.Context, path string, r *ExecConfig) (Process, error) {

 	return nil, errors.Errorf("cannot exec in a deleted state")

 }

+

+func (s *deletedState) Status(ctx context.Context) (string, error) {

+	return "stopped", nil

+}

@@ -261,17 +261,5 @@ func (e *execProcess) Status(ctx context.Context) (string, error) {

 	}

 	e.mu.Lock()

 	defer e.mu.Unlock()

-	// if we don't have a pid(pid=0) then the exec process has just been created

-	if e.pid.get() == 0 {

-		return "created", nil

-	}

-	if e.pid.get() == StoppedPID {

-		return "stopped", nil

-	}

-	// if we have a pid and it can be signaled, the process is running

-	if err := unix.Kill(e.pid.get(), 0); err == nil {

-		return "running", nil

-	}

-	// else if we have a pid but it can nolonger be signaled, it has stopped

-	return "stopped", nil

+	return e.execState.Status(ctx)

 }

@@ -31,6 +31,7 @@ type execState interface {

 	Delete(context.Context) error

 	Kill(context.Context, uint32, bool) error

 	SetExited(int)

+	Status(context.Context) (string, error)

 }

 type execCreatedState struct {

@@ -82,6 +83,10 @@ func (s *execCreatedState) SetExited(status int) {

 	}

 }

+func (s *execCreatedState) Status(ctx context.Context) (string, error) {

+	return "created", nil

+}

+

 type execRunningState struct {

 	p *execProcess

 }

@@ -120,6 +125,10 @@ func (s *execRunningState) SetExited(status int) {

 	}

 }

+func (s *execRunningState) Status(ctx context.Context) (string, error) {

+	return "running", nil

+}

+

 type execStoppedState struct {

 	p *execProcess

 }

@@ -157,3 +166,7 @@ func (s *execStoppedState) Kill(ctx context.Context, sig uint32, all bool) error

 func (s *execStoppedState) SetExited(status int) {

 	// no op

 }

+

+func (s *execStoppedState) Status(ctx context.Context) (string, error) {

+	return "stopped", nil

+}

@@ -56,12 +56,14 @@ type Init struct {

 	WorkDir string

-	id           string

-	Bundle       string

-	console      console.Console

-	Platform     stdio.Platform

-	io           *processIO

-	runtime      *runc.Runc

+	id       string

+	Bundle   string

+	console  console.Console

+	Platform stdio.Platform

+	io       *processIO

+	runtime  *runc.Runc

+	// pausing preserves the pausing state.

+	pausing      *atomicBool

 	status       int

 	exited       time.Time

 	pid          safePid

@@ -97,6 +99,7 @@ func New(id string, runtime *runc.Runc, stdio stdio.Stdio) *Init {

 	p := &Init{

 		id:        id,

 		runtime:   runtime,

+		pausing:   new(atomicBool),

 		stdio:     stdio,

 		status:    0,

 		waitBlock: make(chan struct{}),

@@ -237,17 +240,14 @@ func (p *Init) ExitedAt() time.Time {

 // Status of the process

 func (p *Init) Status(ctx context.Context) (string, error) {

+	if p.pausing.get() {

+		return "pausing", nil

+	}

+

 	p.mu.Lock()

 	defer p.mu.Unlock()

-	c, err := p.runtime.State(ctx, p.id)

-	if err != nil {

-		if strings.Contains(err.Error(), "does not exist") {

-			return "stopped", nil

-		}

-		return "", p.runtimeError(err, "OCI runtime state failed")

-	}

-	return c.Status, nil

+	return p.initState.Status(ctx)

 }

 // Start the init process

@@ -37,6 +37,7 @@ type initState interface {

 	Exec(context.Context, string, *ExecConfig) (Process, error)

 	Kill(context.Context, uint32, bool) error

 	SetExited(int)

+	Status(context.Context) (string, error)

 }

 type createdState struct {

@@ -103,6 +104,10 @@ func (s *createdState) Exec(ctx context.Context, path string, r *ExecConfig) (Pr

 	return s.p.exec(ctx, path, r)

 }

+func (s *createdState) Status(ctx context.Context) (string, error) {

+	return "created", nil

+}

+

 type createdCheckpointState struct {

 	p    *Init

 	opts *runc.RestoreOpts

@@ -211,6 +216,10 @@ func (s *createdCheckpointState) Exec(ctx context.Context, path string, r *ExecC

 	return nil, errors.Errorf("cannot exec in a created state")

 }

+func (s *createdCheckpointState) Status(ctx context.Context) (string, error) {

+	return "created", nil

+}

+

 type runningState struct {

 	p *Init

 }

@@ -228,6 +237,13 @@ func (s *runningState) transition(name string) error {

 }

 func (s *runningState) Pause(ctx context.Context) error {

+	s.p.pausing.set(true)

+	// NOTE "pausing" will be returned in the short window

+	// after `transition("paused")`, before `pausing` is reset

+	// to false. That doesn't break the state machine, just

+	// delays the "paused" state a little bit.

+	defer s.p.pausing.set(false)

+

 	if err := s.p.runtime.Pause(ctx, s.p.id); err != nil {

 		return s.p.runtimeError(err, "OCI runtime pause failed")

 	}

@@ -271,6 +287,10 @@ func (s *runningState) Exec(ctx context.Context, path string, r *ExecConfig) (Pr

 	return s.p.exec(ctx, path, r)

 }

+func (s *runningState) Status(ctx context.Context) (string, error) {

+	return "running", nil

+}

+

 type pausedState struct {

 	p *Init

 }

@@ -335,6 +355,10 @@ func (s *pausedState) Exec(ctx context.Context, path string, r *ExecConfig) (Pro

 	return nil, errors.Errorf("cannot exec in a paused state")

 }

+func (s *pausedState) Status(ctx context.Context) (string, error) {

+	return "paused", nil

+}

+

 type stoppedState struct {

 	p *Init

 }

@@ -387,3 +411,7 @@ func (s *stoppedState) SetExited(status int) {

 func (s *stoppedState) Exec(ctx context.Context, path string, r *ExecConfig) (Process, error) {

 	return nil, errors.Errorf("cannot exec in a stopped state")

 }

+

+func (s *stoppedState) Status(ctx context.Context) (string, error) {

+	return "stopped", nil

+}

@@ -40,7 +40,9 @@ import (

 var bufPool = sync.Pool{

 	New: func() interface{} {

-		buffer := make([]byte, 32<<10)

+		// setting to 4096 to align with PIPE_BUF

+		// http://man7.org/linux/man-pages/man7/pipe.7.html

+		buffer := make([]byte, 4096)

 		return &buffer

 	},

 }

@@ -27,6 +27,7 @@ import (

 	"path/filepath"

 	"strings"

 	"sync"

+	"sync/atomic"

 	"time"

 	"github.com/containerd/containerd/errdefs"

@@ -62,6 +63,20 @@ func (s *safePid) set(pid int) {

 	s.Unlock()

 }

+type atomicBool int32

+

+func (ab *atomicBool) set(b bool) {

+	if b {

+		atomic.StoreInt32((*int32)(ab), 1)

+	} else {

+		atomic.StoreInt32((*int32)(ab), 0)

+	}

+}

+

+func (ab *atomicBool) get() bool {

+	return atomic.LoadInt32((*int32)(ab)) == 1

+}

+

 // TODO(mlaventure): move to runc package?

 func getLastRuntimeError(r *runc.Runc) (string, error) {

 	if r.Log == "" {

new file mode 100644

@@ -0,0 +1,797 @@

+/*

+   Copyright The containerd Authors.

+

+   Licensed under the Apache License, Version 2.0 (the "License");

+   you may not use this file except in compliance with the License.

+   You may obtain a copy of the License at

+

+       http://www.apache.org/licenses/LICENSE-2.0

+

+   Unless required by applicable law or agreed to in writing, software

+   distributed under the License is distributed on an "AS IS" BASIS,

+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

+   See the License for the specific language governing permissions and

+   limitations under the License.

+*/

+

+// Package docker provides a general type to represent any way of referencing images within the registry.

+// Its main purpose is to abstract tags and digests (content-addressable hash).

+//

+// Grammar

+//

+// 	reference                       := name [ ":" tag ] [ "@" digest ]

+//	name                            := [domain '/'] path-component ['/' path-component]*

+//	domain                          := domain-component ['.' domain-component]* [':' port-number]

+//	domain-component                := /([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])/

+//	port-number                     := /[0-9]+/

+//	path-component                  := alpha-numeric [separator alpha-numeric]*

+// 	alpha-numeric                   := /[a-z0-9]+/

+//	separator                       := /[_.]|__|[-]*/

+//

+//	tag                             := /[\w][\w.-]{0,127}/

+//

+//	digest                          := digest-algorithm ":" digest-hex

+//	digest-algorithm                := digest-algorithm-component [ digest-algorithm-separator digest-algorithm-component ]*

+//	digest-algorithm-separator      := /[+.-_]/

+//	digest-algorithm-component      := /[A-Za-z][A-Za-z0-9]*/

+//	digest-hex                      := /[0-9a-fA-F]{32,}/ ; At least 128 bit digest value

+//

+//	identifier                      := /[a-f0-9]{64}/

+//	short-identifier                := /[a-f0-9]{6,64}/

+package docker

+

+import (

+	"errors"

+	"fmt"

+	"path"

+	"regexp"

+	"strings"

+

+	"github.com/opencontainers/go-digest"

+)

+

+const (

+	// NameTotalLengthMax is the maximum total number of characters in a repository name.

+	NameTotalLengthMax = 255

+)

+

+var (

+	// ErrReferenceInvalidFormat represents an error while trying to parse a string as a reference.

+	ErrReferenceInvalidFormat = errors.New("invalid reference format")

+

+	// ErrTagInvalidFormat represents an error while trying to parse a string as a tag.

+	ErrTagInvalidFormat = errors.New("invalid tag format")

+

+	// ErrDigestInvalidFormat represents an error while trying to parse a string as a tag.

+	ErrDigestInvalidFormat = errors.New("invalid digest format")

+

+	// ErrNameContainsUppercase is returned for invalid repository names that contain uppercase characters.

+	ErrNameContainsUppercase = errors.New("repository name must be lowercase")

+

+	// ErrNameEmpty is returned for empty, invalid repository names.

+	ErrNameEmpty = errors.New("repository name must have at least one component")

+

+	// ErrNameTooLong is returned when a repository name is longer than NameTotalLengthMax.

+	ErrNameTooLong = fmt.Errorf("repository name must not be more than %v characters", NameTotalLengthMax)

+

+	// ErrNameNotCanonical is returned when a name is not canonical.

+	ErrNameNotCanonical = errors.New("repository name must be canonical")

+)

+

+// Reference is an opaque object reference identifier that may include

+// modifiers such as a hostname, name, tag, and digest.

+type Reference interface {

+	// String returns the full reference

+	String() string

+}

+

+// Field provides a wrapper type for resolving correct reference types when

+// working with encoding.

+type Field struct {

+	reference Reference

+}

+

+// AsField wraps a reference in a Field for encoding.

+func AsField(reference Reference) Field {

+	return Field{reference}

+}

+

+// Reference unwraps the reference type from the field to

+// return the Reference object. This object should be

+// of the appropriate type to further check for different

+// reference types.

+func (f Field) Reference() Reference {

+	return f.reference

+}

+

+// MarshalText serializes the field to byte text which

+// is the string of the reference.

+func (f Field) MarshalText() (p []byte, err error) {

+	return []byte(f.reference.String()), nil

+}

+

+// UnmarshalText parses text bytes by invoking the

+// reference parser to ensure the appropriately

+// typed reference object is wrapped by field.

+func (f *Field) UnmarshalText(p []byte) error {

+	r, err := Parse(string(p))

+	if err != nil {

+		return err

+	}

+

+	f.reference = r

+	return nil

+}

+

+// Named is an object with a full name

+type Named interface {

+	Reference

+	Name() string

+}

+

+// Tagged is an object which has a tag

+type Tagged interface {

+	Reference

+	Tag() string

+}

+

+// NamedTagged is an object including a name and tag.

+type NamedTagged interface {

+	Named

+	Tag() string

+}

+

+// Digested is an object which has a digest

+// in which it can be referenced by

+type Digested interface {

+	Reference

+	Digest() digest.Digest

+}

+

+// Canonical reference is an object with a fully unique

+// name including a name with domain and digest

+type Canonical interface {

+	Named

+	Digest() digest.Digest

+}

+

+// namedRepository is a reference to a repository with a name.

+// A namedRepository has both domain and path components.

+type namedRepository interface {

+	Named

+	Domain() string

+	Path() string

+}

+

+// Domain returns the domain part of the Named reference

+func Domain(named Named) string {

+	if r, ok := named.(namedRepository); ok {

+		return r.Domain()

+	}

+	domain, _ := splitDomain(named.Name())

+	return domain

+}

+

+// Path returns the name without the domain part of the Named reference

+func Path(named Named) (name string) {

+	if r, ok := named.(namedRepository); ok {

+		return r.Path()

+	}

+	_, path := splitDomain(named.Name())

+	return path

+}

+

+func splitDomain(name string) (string, string) {

+	match := anchoredNameRegexp.FindStringSubmatch(name)

+	if len(match) != 3 {

+		return "", name

+	}

+	return match[1], match[2]

+}

+

+// SplitHostname splits a named reference into a

+// hostname and name string. If no valid hostname is

+// found, the hostname is empty and the full value

+// is returned as name

+// DEPRECATED: Use Domain or Path

+func SplitHostname(named Named) (string, string) {

+	if r, ok := named.(namedRepository); ok {

+		return r.Domain(), r.Path()

+	}

+	return splitDomain(named.Name())

+}

+

+// Parse parses s and returns a syntactically valid Reference.

+// If an error was encountered it is returned, along with a nil Reference.

+// NOTE: Parse will not handle short digests.

+func Parse(s string) (Reference, error) {

+	matches := ReferenceRegexp.FindStringSubmatch(s)

+	if matches == nil {

+		if s == "" {

+			return nil, ErrNameEmpty

+		}

+		if ReferenceRegexp.FindStringSubmatch(strings.ToLower(s)) != nil {

+			return nil, ErrNameContainsUppercase

+		}

+		return nil, ErrReferenceInvalidFormat

+	}

+

+	if len(matches[1]) > NameTotalLengthMax {

+		return nil, ErrNameTooLong

+	}

+

+	var repo repository

+

+	nameMatch := anchoredNameRegexp.FindStringSubmatch(matches[1])

+	if len(nameMatch) == 3 {

+		repo.domain = nameMatch[1]

+		repo.path = nameMatch[2]

+	} else {

+		repo.domain = ""

+		repo.path = matches[1]

+	}

+

+	ref := reference{

+		namedRepository: repo,

+		tag:             matches[2],

+	}

+	if matches[3] != "" {

+		var err error

+		ref.digest, err = digest.Parse(matches[3])

+		if err != nil {

+			return nil, err

+		}

+	}

+

+	r := getBestReferenceType(ref)

+	if r == nil {

+		return nil, ErrNameEmpty

+	}

+

+	return r, nil

+}

+

+// ParseNamed parses s and returns a syntactically valid reference implementing

+// the Named interface. The reference must have a name and be in the canonical

+// form, otherwise an error is returned.

+// If an error was encountered it is returned, along with a nil Reference.

+// NOTE: ParseNamed will not handle short digests.

+func ParseNamed(s string) (Named, error) {

+	named, err := ParseNormalizedNamed(s)

+	if err != nil {

+		return nil, err

+	}

+	if named.String() != s {

+		return nil, ErrNameNotCanonical

+	}

+	return named, nil

+}

+

+// WithName returns a named object representing the given string. If the input

+// is invalid ErrReferenceInvalidFormat will be returned.

+func WithName(name string) (Named, error) {

+	if len(name) > NameTotalLengthMax {

+		return nil, ErrNameTooLong

+	}

+

+	match := anchoredNameRegexp.FindStringSubmatch(name)

+	if match == nil || len(match) != 3 {

+		return nil, ErrReferenceInvalidFormat

+	}

+	return repository{

+		domain: match[1],

+		path:   match[2],

+	}, nil

+}

+

+// WithTag combines the name from "name" and the tag from "tag" to form a

+// reference incorporating both the name and the tag.

+func WithTag(name Named, tag string) (NamedTagged, error) {

+	if !anchoredTagRegexp.MatchString(tag) {

+		return nil, ErrTagInvalidFormat

+	}

+	var repo repository

+	if r, ok := name.(namedRepository); ok {

+		repo.domain = r.Domain()

+		repo.path = r.Path()

+	} else {

+		repo.path = name.Name()

+	}

+	if canonical, ok := name.(Canonical); ok {

+		return reference{

+			namedRepository: repo,

+			tag:             tag,

+			digest:          canonical.Digest(),

+		}, nil

+	}

+	return taggedReference{

+		namedRepository: repo,

+		tag:             tag,

+	}, nil

+}

+

+// WithDigest combines the name from "name" and the digest from "digest" to form

+// a reference incorporating both the name and the digest.

+func WithDigest(name Named, digest digest.Digest) (Canonical, error) {

+	if !anchoredDigestRegexp.MatchString(digest.String()) {

+		return nil, ErrDigestInvalidFormat

+	}

+	var repo repository

+	if r, ok := name.(namedRepository); ok {

+		repo.domain = r.Domain()

+		repo.path = r.Path()

+	} else {

+		repo.path = name.Name()

+	}

+	if tagged, ok := name.(Tagged); ok {

+		return reference{

+			namedRepository: repo,

+			tag:             tagged.Tag(),

+			digest:          digest,

+		}, nil

+	}

+	return canonicalReference{

+		namedRepository: repo,

+		digest:          digest,

+	}, nil

+}

+

+// TrimNamed removes any tag or digest from the named reference.

+func TrimNamed(ref Named) Named {

+	domain, path := SplitHostname(ref)

+	return repository{

+		domain: domain,

+		path:   path,

+	}