Is there a way to disable specific APIs?

[JeyJeyGao]

Is your feature request related to a problem? Please describe.

I'm a developer of notaryproject/notation. We build our end to end testing based on Zot registry. We are going to test the scenario that the registry doesn't support referrers api, so is there a way to disable referrers api feature for Zot registry?

Describe the solution you'd like

No response

Describe alternatives you've considered

No response

Additional context

No response

[rchincha]

@JeyJeyGao would you consider the option of building your own patched zot? We can provide the patch.
Note that this is still pending opencontainers/image-spec#1068 which I would imagine has implications for the notation project.

[rchincha]

Perhaps, another more CI-friendly option would be to front a reverse-proxy such as nginx or haproxy and block APIs?

[JeyJeyGao]

Perhaps, another more CI-friendly option would be to front a reverse-proxy such as nginx or haproxy and block APIs?

That's an interesting idea. Let me try it.

[JeyJeyGao]

Hi @rchincha, thanks for your suggestions! I've successfully set up an Nginx reverse proxy configuration that emulates a registry which doesn't support the referrers API. This might be helpful for others encountering similar scenarios.

The Nginx reverse proxy listens on port 5001, and all requests are forwarded to Zot, which is running on localhost:5000. A specific rule is added to return a 404 status code for any request matching the schema <scheme>://<registry>/v2/<repository>/referrers.

Here's the configuration:

events {
    worker_connections 1024;
}

http {
    # for emulating a registry that doesn't support referrers api
    server {
        listen 5001;

        location ~ ^/v2/.+/referrers {
            return 404;
        }

        location / {
            proxy_pass http://localhost:5000;
        }
    }
}

[rchincha]

@JeyJeyGao Thanks for confirming. Converted this to a discussion item if others are interested.