Repository: moby/moby
Pull request #49762: registry: remove deprecated ServiceConfig.AllowNondistributableArtifacts
Author: login: thaJeztah
Labels: name: area/distribution
description: Image Distribution
name: kind/refactor
description: PR's that refactor, or clean-up code
Created: 2025-04-07T10:50:24Z | Merged: 2025-04-10T10:08:15Z

- relates to https://github.com/moby/moby/pull/49065

This option was deprecated in 1932091e21b64abc52b42320393b0ac5f6921668, and is no longer used. It was only kept to allow priniting a deprecation warning if the config would happen to have the field set.


**- Human readable description for the release notes**
<!--
Write a short (one line) summary that describes the changes in this
pull request for inclusion in the changelog.
It must be placed inside the below triple backticks section.

NOTE: Only fill this section if changes introduced in this PR are user-facing.
The PR must have a relevant impact/ label.
-->
```markdown changelog

```

**- A picture of a cute animal (not mandatory but encouraged)**




Diff:
diff --git a/cmd/dockerd/config.go b/cmd/dockerd/config.go
index b8f417fdd77ef..2fc4983e9c472 100644
--- a/cmd/dockerd/config.go
+++ b/cmd/dockerd/config.go
@@ -13,12 +13,9 @@ import (
 // installCommonConfigFlags adds flags to the pflag.FlagSet to configure the daemon
 func installCommonConfigFlags(conf *config.Config, flags *pflag.FlagSet) {
 	var (
-		allowNonDistributable = opts.NewNamedListOptsRef("allow-nondistributable-artifacts", &conf.AllowNondistributableArtifacts, registry.ValidateIndexName)
-		registryMirrors       = opts.NewNamedListOptsRef("registry-mirrors", &conf.Mirrors, registry.ValidateMirror)
-		insecureRegistries    = opts.NewNamedListOptsRef("insecure-registries", &conf.InsecureRegistries, registry.ValidateIndexName)
+		registryMirrors    = opts.NewNamedListOptsRef("registry-mirrors", &conf.Mirrors, registry.ValidateMirror)
+		insecureRegistries = opts.NewNamedListOptsRef("insecure-registries", &conf.InsecureRegistries, registry.ValidateIndexName)
 	)
-	flags.Var(allowNonDistributable, "allow-nondistributable-artifacts", "Allow push of nondistributable artifacts to registry")
-	_ = flags.MarkDeprecated("allow-nondistributable-artifacts", "Pushing nondistributable artifacts is now enabled by default. ")
 	flags.Var(registryMirrors, "registry-mirror", "Preferred Docker registry mirror")
 	flags.Var(insecureRegistries, "insecure-registry", "Enable insecure registry communication")
 
@@ -77,6 +74,9 @@ func installCommonConfigFlags(conf *config.Config, flags *pflag.FlagSet) {
 	flags.Var(opts.NewNamedListOptsRef("cdi-spec-dirs", &conf.CDISpecDirs, nil), "cdi-spec-dir", "CDI specification directories to use")
 
 	// Deprecated flags / options
+	allowNonDistributable := opts.NewNamedListOptsRef("allow-nondistributable-artifacts", &([]string{}), registry.ValidateIndexName)
+	flags.Var(allowNonDistributable, "allow-nondistributable-artifacts", "Allow push of nondistributable artifacts to registry")
+	_ = flags.MarkDeprecated("allow-nondistributable-artifacts", "Pushing nondistributable artifacts is now enabled by default. ")
 
 	// TODO(thaJeztah): option is used to produce error when used; remove in next release
 	flags.StringVar(&conf.CorsHeaders, "api-cors-header", "", "Set CORS headers in the Engine API; deprecated: this feature was deprecated in 27.0, and now removed")
diff --git a/cmd/dockerd/daemon.go b/cmd/dockerd/daemon.go
index c60b6e4b933ff..b48fff1f038b2 100644
--- a/cmd/dockerd/daemon.go
+++ b/cmd/dockerd/daemon.go
@@ -661,11 +661,6 @@ func loadDaemonCliConfig(opts *daemonOptions) (*config.Config, error) {
 		return nil, err
 	}
 
-	if len(conf.AllowNondistributableArtifacts) > 0 {
-		// TODO(thaJeztah): move to config.Validate and change into an error for v29.0 and remove in v30.0.
-		log.G(context.TODO()).Warn(`DEPRECATED: The "allow-nondistributable-artifacts" config parameter is deprecated and always enabled; this option will be removed in the next release`)
-	}
-
 	return conf, nil
 }
 
diff --git a/daemon/config/config.go b/daemon/config/config.go
index ca533b5618109..eafdf0eaa4ba8 100644
--- a/daemon/config/config.go
+++ b/daemon/config/config.go
@@ -91,8 +91,10 @@ var flatOptions = map[string]bool{
 var skipValidateOptions = map[string]bool{
 	"features": true,
 	"builder":  true,
-	// Corresponding flag has been removed because it was already unusable
-	"deprecated-key-path": true,
+
+	// Deprecated options that are safe to ignore if present.
+	"deprecated-key-path":              true,
+	"allow-nondistributable-artifacts": true,
 }
 
 // skipDuplicates contains configuration keys that
diff --git a/daemon/config/config_linux_test.go b/daemon/config/config_linux_test.go
index bccacc8c309f0..47d7a196094f8 100644
--- a/daemon/config/config_linux_test.go
+++ b/daemon/config/config_linux_test.go
@@ -365,3 +365,34 @@ func TestDaemonConfigurationHostGatewayIP(t *testing.T) {
 		})
 	}
 }
+
+// TestDaemonLegacyOptions verifies that loading config files containing
+// deprecated / legacy options does not prevent the daemon from loading
+// the config (some options may have an explicit error, and can be tested
+// separately).
+func TestDaemonLegacyOptions(t *testing.T) {
+	tests := []struct {
+		name       string
+		configJSON string
+	}{
+		{
+			name:       "deprecated-key-path",
+			configJSON: `{"deprecated-key-path": "/etc/docker/key.json"}`,
+		},
+		{
+			name:       "allow-nondistributable-artifacts",
+			configJSON: `{"allow-nondistributable-artifacts": ["127.0.0.0/8", "10.10.1.11:5000", "10.10.1.22:5000", "registry.example.com", "registry.example.com"]}`,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			configFile := makeConfigFile(t, tc.configJSON)
+			flags := pflag.NewFlagSet("test", pflag.ContinueOnError)
+			c, err := New()
+			assert.NilError(t, err)
+			_, err = MergeDaemonConfigurations(c, flags, configFile)
+			assert.NilError(t, err)
+		})
+	}
+}
diff --git a/registry/config.go b/registry/config.go
index 78936b3621c26..ce504bd7fa85a 100644
--- a/registry/config.go
+++ b/registry/config.go
@@ -19,8 +19,6 @@ import (
 
 // ServiceOptions holds command line options.
 type ServiceOptions struct {
-	AllowNondistributableArtifacts []string `json:"allow-nondistributable-artifacts,omitempty"` // Deprecated: non-distributable artifacts are deprecated and enabled by default. This field will be removed in the next release.
-
 	Mirrors            []string `json:"registry-mirrors,omitempty"`
 	InsecureRegistries []string `json:"insecure-registries,omitempty"`
 }


Reviews:
user: login: thaJeztah
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-04-07T10:51:27Z
user: login: thaJeztah
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-04-09T13:27:46Z
user: login: dmcgowan
state: APPROVED
author_association: MEMBER
submitted_at: 2025-04-09T23:34:10Z

Review comments:
diff_hunk: @@ -661,11 +661,6 @@ func loadDaemonCliConfig(opts *daemonOptions) (*config.Config, error) {
 		return nil, err
 	}
 
-	if len(conf.AllowNondistributableArtifacts) > 0 {
-		// TODO(thaJeztah): move to config.Validate and change into an error for v29.0 and remove in v30.0.
path: cmd/dockerd/daemon.go
user: login: thaJeztah
body: This option is likely a very-very corner-case, and skipping an error for this should be fine.
created_at: 2025-04-07T10:51:26Z
author_association: MEMBER
diff_hunk: @@ -365,3 +365,34 @@ func TestDaemonConfigurationHostGatewayIP(t *testing.T) {
 		})
 	}
 }
+
+// TestDaemonLegacyOptions verifies that loading config files containing
+// deprecated / legacy options does not prevent the daemon from loading
+// the config (some options may have an explicit error, and can be tested
+// separately).
+func TestDaemonLegacyOptions(t *testing.T) {
path: daemon/config/config_linux_test.go
user: login: thaJeztah
body: Added a test for deprecated options, as I don't think we had one for this.
created_at: 2025-04-09T13:27:45Z
author_association: MEMBER

PR comments:
user: login: thaJeztah
created_at: 2025-04-07T10:57:19Z
body: Ah derp; missing a commit here;

```
42.95 # github.com/docker/docker/cmd/dockerd
42.95 cmd/dockerd/config.go:16:94: conf.AllowNondistributableArtifacts undefined (type *"github.com/docker/docker/daemon/config".Config has no field or method AllowNondistributableArtifacts)
```
author_association: MEMBER
user: login: thaJeztah
created_at: 2025-04-07T11:24:25Z
body: @akerouanton @robmry could this be related to the new "in-memory" cache?


```
=== Failed
=== FAIL: libnetwork TestEndpointStore (0.00s)
    endpoint_store_test.go:31: assertion failed: &{ testEndpoint2 0xc0002be820 <nil> <nil>  [] [] false false map[] [] [] map[] map[]   [] [] [] 1 true false false {0 0}} (found[0] *libnetwork.Endpoint) != &{ testEndpoint1 0xc0002be820 <nil> <nil>  [] [] false false map[] [] [] map[] map[]   [] [] [] 1 true false false {0 0}} (ep1 *libnetwork.Endpoint)
```


More failures;

```
=== Failed
=== FAIL: github.com/docker/docker/libnetwork TestNetworkStore/no_filter (0.00s)
    network_store_test.go:59: assertion failed: found[i] is not nw: got: ; expected: 
    network_store_test.go:59: assertion failed: found[i] is not nw: got: ; expected: 

=== FAIL: github.com/docker/docker/libnetwork TestNetworkStore (0.02s)
time="2025-04-07T11:30:56Z" level=info msg="Restoring existing overlay networks from HNS into docker"
```


author_association: MEMBER