1"use strict";(self.webpackChunkig_website=self.webpackChunkig_website||[]).push([[17427],{39727:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>c,contentTitle:()=>u,default:()=>p,frontMatter:()=>o,metadata:()=>a,toc:()=>d});const a=JSON.parse('{"id":"reference/disallow-pulling","title":"Disallow pulling Gadgets","description":"How to disallow pulling gadgets","source":"@site/versioned_docs/version-v0.56.0/reference/disallow-pulling.mdx","sourceDirName":"reference","slug":"/reference/disallow-pulling","permalink":"/docs/v0.56.0/reference/disallow-pulling","draft":false,"unlisted":false,"editUrl":"https://github.com/inspektor-gadget/inspektor-gadget/edit/main/versioned_docs/version-v0.56.0/reference/disallow-pulling.mdx","tags":[],"version":"v0.56.0","sidebarPosition":600,"frontMatter":{"title":"Disallow pulling Gadgets","sidebar_position":600,"description":"How to disallow pulling gadgets"},"sidebar":"mainSidebar","previous":{"title":"Handling Gadgets","permalink":"/docs/v0.56.0/reference/images"},"next":{"title":"Insecure Registries","permalink":"/docs/v0.56.0/reference/insecure-registries"}}');var r=t(74848),i=t(28453),l=t(49489),s=t(7227);const o={title:"Disallow pulling Gadgets",sidebar_position:600,description:"How to disallow pulling gadgets"},u=void 0,c={},d=[];function g(e){const n={code:"code",p:"p",pre:"pre",...(0,i.R)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsxs)(n.p,{children:["It is possible to disallow pulling gadgets by using the ",(0,r.jsx)(n.code,{children:"--disallow-pulling"})," flag.\nBy default, pulling is allowed."]}),"\n",(0,r.jsxs)(l.A,{groupId:"env",children:[(0,r.jsxs)(s.A,{value:"kubectl-gadget",label:"kubectl gadget",children:[(0,r.jsxs)(n.p,{children:["You can specify this option only at deploy time. Start by creating a daemon configuration file, for example ",(0,r.jsx)(n.code,{children:"daemon-config.yaml"}),":"]}),(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"cat <<EOF > daemon-config.yaml\noperator:\n oci:\n disallow-pulling: true\nEOF\n"})}),(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:'$ kubectl gadget deploy --daemon-config=daemon-config.yaml\n...\nInspektor Gadget successfully deployed\n$ kubectl gadget run trace_exec\nError: fetching gadget information: getting gadget info: rpc error: code = Unknown desc = getting gadget info: initializing and preparing operators: instantiating operator "oci": ensuring image: pulling image (if missing) "trace_exec": pulling image "trace_exec": pulling is disabled\n'})})]}),(0,r.jsxs)(s.A,{value:"ig",label:"ig",children:[(0,r.jsxs)(n.p,{children:["You can use the ",(0,r.jsx)(n.code,{children:"--disallow-pulling"})," flag at run time:"]}),(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:'$ sudo ig image list\nREPOSITORY TAG DIGEST CREATED\ntrace_exec latest 24c0da566661 15 hours ago\n$ sudo ig run --disallow-pulling trace_exec\nRUNTIME.CONTAINERNAME COMM PID TID PCOMM PPID ARGS ER\u2026 TIMESTAMP\nminikube-docker iptables 137722 137722 kubelet 11713 /usr/sbin/i\u2026 2024-07-25T10:30:21.902064\u2026\nminikube-docker ip6tables 137723 137723 kubelet 11713 /usr/sbin/i\u2026 2024-07-25T10:30:21.904561\u2026\n^C\n$ sudo ig run --disallow-pulling trace_open\nError: fetching gadget information: initializing and preparing operators: instantiating operator "oci": ensuring image: pulling image (if missing) "trace_open": pulling image "trace_open": pulling is disabled\n'})})]}),(0,r.jsxs)(s.A,{value:"ig-daemon",label:"ig daemon",children:[(0,r.jsx)(n.p,{children:"You can specify these options only at start time:"}),(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:'$ sudo ig image list\nREPOSITORY TAG DIGEST CREATED\ntrace_exec latest 24c0da566661 15 hours ago\n$ sudo ig daemon --tls-insecure --disallow-pulling\n...\n# Switch to another terminal\n$ gadgetctl run trace_exec\nRUNTIME.CONTAINERNAME COMM PID TID PCOMM PPID ARGS ER\u2026 TIMESTAMP\nminikube-docker iptables 137722 137722 kubelet 11713 /usr/sbin/i\u2026 2024-07-25T10:30:21.902064\u2026\nminikube-docker ip6tables 137723 137723 kubelet 11713 /usr/sbin/i\u2026 2024-07-25T10:30:21.904561\u2026\n$ gadgetctl run trace_open\nError: fetching gadget information: getting gadget info: rpc error: code = Unknown de
1sc = getting gadget info: initializing and preparing operators: instantiating operator "oci": ensuring image: pulling image (if missing) "trace_open": pulling image "trace_open": pulling is disabled\n'})})]})]})]})}function p(e={}){const{wrapper:n}={...(0,i.R)(),...e.components};return n?(0,r.jsx)(n,{...e,children:(0,r.jsx)(g,{...e})}):g(e)}},7227:(e,n,t)=>{t.d(n,{A:()=>l});t(96540);var a=t(34164);const r={tabItem:"tabItem_Ymn6"};var i=t(74848);function l(e){let{children:n,hidden:t,className:l}=e;return(0,i.jsx)("div",{role:"tabpanel",className:(0,a.A)(r.tabItem,l),hidden:t,children:n})}},49489:(e,n,t)=>{t.d(n,{A:()=>y});var a=t(96540),r=t(34164),i=t(24245),l=t(56347),s=t(36494),o=t(62814),u=t(45167),c=t(69900);function d(e){return a.Children.toArray(e).filter((e=>"\n"!==e)).map((e=>{if(!e||(0,a.isValidElement)(e)&&function(e){const{props:n}=e;return!!n&&"object"==typeof n&&"value"in n}(e))return e;throw new Error(`Docusaurus error: Bad <Tabs> child <${"string"==typeof e.type?e.type:e.type.name}>: all children of the <Tabs> component should be <TabItem>, and every <TabItem> should have a unique "value" prop.`)}))?.filter(Boolean)??[]}function g(e){const{values:n,children:t}=e;return(0,a.useMemo)((()=>{const e=n??function(e){return d(e).map((e=>{let{props:{value:n,label:t,attributes:a,default:r}}=e;return{value:n,label:t,attributes:a,default:r}}))}(t);return function(e){const n=(0,u.XI)(e,((e,n)=>e.value===n.value));if(n.length>0)throw new Error(`Docusaurus error: Duplicate values "${n.map((e=>e.value)).join(", ")}" found in <Tabs>. Every value needs to be unique.`)}(e),e}),[n,t])}function p(e){let{value:n,tabValues:t}=e;return t.some((e=>e.value===n))}function m(e){let{queryString:n=!1,groupId:t}=e;const r=(0,l.W6)(),i=function(e){let{queryString:n=!1,groupId:t}=e;if("string"==typeof n)return n;if(!1===n)return null;if(!0===n&&!t)throw new Error('Docusaurus error: The <Tabs> component groupId prop is required if queryString=true, because this value is used as the search param name. You can also provide an explicit value such as queryString="my-search-param".');return t??null}({queryString:n,groupId:t});return[(0,o.aZ)(i),(0,a.useCallback)((e=>{if(!i)return;const n=new URLSearchParams(r.location.search);n.set(i,e),r.replace({...r.location,search:n.toString()})}),[i,r])]}function f(e){const{defaultValue:n,queryString:t=!1,groupId:r}=e,i=g(e),[l,o]=(0,a.useState)((()=>function(e){let{defaultValue:n,tabValues:t}=e;if(0===t.length)throw new Error("Docusaurus error: the <Tabs> component requires at least one <TabItem> children component");if(n){if(!p({value:n,tabValues:t}))throw new Error(`Docusaurus error: The <Tabs> has a defaultValue "${n}" but none of its children has the corresponding value. Available values are: ${t.map((e=>e.value)).join(", ")}. If you intend to show no default tab, use defaultValue={null} instead.`);return n}const a=t.find((e=>e.default))??t[0];if(!a)throw new Error("Unexpected error: 0 tabValues");return a.value}({defaultValue:n,tabValues:i}))),[u,d]=m({queryString:t,groupId:r}),[f,b]=function(e){let{groupId:n}=e;const t=function(e){return e?`docusaurus.tab.${e}`:null}(n),[r,i]=(0,c.Dv)(t);return[r,(0,a.useCallback)((e=>{t&&i.set(e)}),[t,i])]}({groupId:r}),h=(()=>{const e=u??f;return p({value:e,tabValues:i})?e:null})();(0,s.A)((()=>{h&&o(h)}),[h]);return{selectedValue:l,selectValue:(0,a.useCallback)((e=>{if(!p({value:e,tabValues:i}))throw new Error(`Can't select invalid tab value=${e}`);o(e),d(e),b(e)}),[d,b,i]),tabValues:i}}var b=t(11062);const h={tabList:"tabList__CuJ",tabItem:"tabItem_LNqP"};var v=t(74848);function x(e){let{className:n,block:t,selectedValue:a,selectValue:l,tabValues:s}=e;const o=[],{blockElementScrollPositionUntilNextRender:u}=(0,i.a_)(),c=e=>{const n=e.currentTarget,t=o.indexOf(n),r=s[t].value;r!==a&&(u(n),l(r))},d=e=>{let n=null;switch(e.key){case"Enter":c(e);break;case"ArrowRight":{const t=o.indexOf(e.currentTarget)+1;n=o[t]??o[0];break}case"ArrowLeft":{const t=o.indexOf(e.currentTarget)-1;n=o[t]??o[o.length-1];break}}n?.focus()};return(0,v.jsx)("ul",{role:"tablist","aria-orientation":"horizontal",className:(0,r.A)("tabs",{"tabs--block":t},n),children:s.map((e=>{let{value:n,label:t,attributes:i}=e;return(0,v.jsx)("li",{role:"tab",tabIndex:a===n?0:-1,"aria-selected":a===n,ref:e=>o.push(e),onKeyDown:d,onClick:c,...i,className:(0,r.A)("tabs__item",h.tabItem,i?.className,{"tabs__item--active":a===n}),children:t??n},n)}))})}function w(e){let{lazy:n,children:t,selectedValue:i}=e;
1const l=(Array.isArray(t)?t:[t]).filter(Boolean);if(n){const e=l.find((e=>e.props.value===i));return e?(0,a.cloneElement)(e,{className:(0,r.A)("margin-top--md",e.props.className)}):null}return(0,v.jsx)("div",{className:"margin-top--md",children:l.map(((e,n)=>(0,a.cloneElement)(e,{key:n,hidden:e.props.value!==i})))})}function k(e){const n=f(e);return(0,v.jsxs)("div",{className:(0,r.A)("tabs-container",h.tabList),children:[(0,v.jsx)(x,{...n,...e}),(0,v.jsx)(w,{...n,...e})]})}function y(e){const n=(0,b.A)();return(0,v.jsx)(k,{...e,children:d(e.children)},String(n))}},28453:(e,n,t)=>{t.d(n,{R:()=>l,x:()=>s});var a=t(96540);const r={},i=a.createContext(r);function l(e){const n=a.useContext(i);return a.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function s(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:l(e.components),a.createElement(i.Provider,{value:n},e.children)}}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.