Repository: falcosecurity/driverkit
Pull request #282 (2023-07-05 14:21:18)

feat(imagelister): support private repositories to list builder images
<!--  Thanks for sending a pull request!  Here are some tips for you:

1. If this is your first time, please read our contributor guidelines in the [CONTRIBUTING.md](https://github.com/falcosecurity/.github/CONTRIBUTING.md) file.
2. Please label this pull request according to what type of issue you are addressing.
3. Please add a release note!
4. If the PR is unfinished while opening it specify a wip in the title before the actual title, for example, "wip: my awesome feature"
-->

**What type of PR is this?**

> Uncomment one (or more) `/kind <>` lines:

> /kind bug

> /kind cleanup

> /kind design

> /kind documentation

> /kind failing-test

/kind feature

<!--
Please remove the leading whitespace before the `/kind <>` you uncommented.
-->

**Any specific area of the project related to this PR?**

> Uncomment one (or more) `/area <>` lines:

> /area build

/area cmd

> /area pkg

> /area docs

/area tests


**What this PR does / why we need it**:

This PR supports authentication when listing tags from private repositories. 

Please note that, once the `builder image` has been found the docker daemon needs to be authenticated if pulling from a private repository. 

**Which issue(s) this PR fixes**:

<!--
Automatically closes linked issue when PR is merged.
Usage: `Fixes #<issue number>`, or `Fixes (paste link of issue)`.
If PR is `kind/failing-tests` or `kind/flaky-test`, please post the related issues/tests in a comment and do not use `Fixes`.
-->

Fixes #

**Special notes for your reviewer**:

The PR is based on #280, hence that's way there are two additional commits. Before merging a rebase is needed.
**Does this PR introduce a user-facing change?**:

<!--
If no, just write "NONE" in the release-note block below.
If yes, a release note is required:
Enter your extended release note in the block below.
If the PR requires additional action from users switching to the new release, prepend the string "action required:".
For example, `action required: change the API interface of the rule engine`.
-->

```release-note
feat(imagelister): support private repositories when listing tags for builder images
```


poiana: [APPROVALNOTIFIER] This PR is **NOT APPROVED**

This pull-request has been approved by: *<a href="https://github.com/falcosecurity/driverkit/pull/282#" title="Author self-approved">alacuku</a>*
**Once this PR has been reviewed and has the lgtm label**, please assign leodido for approval. For more information see [the Kubernetes Code Review Process](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process).

The full list of commands accepted by this bot can be found [here](https://prow.falco.org/command-help?repo=falcosecurity%2Fdriverkit).

<details open>
Needs approval from an approver in each of these files:

- **[OWNERS](https://github.com/falcosecurity/driverkit/blob/master/OWNERS)**

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":["leodido"]} -->
FedeDP: /hold until #280 gets merged :D 
poiana: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/falcosecurity/driverkit/pull/282#" title="Author self-approved">alacuku</a>*, *<a href="https://github.com/falcosecurity/driverkit/pull/282#pullrequestreview-1518873802" title="Approved">dwindsor</a>*

The full list of commands accepted by this bot can be found [here](https://prow.falco.org/command-help?repo=falcosecurity%2Fdriverkit).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/falcosecurity/driverkit/blob/master/OWNERS)~~ [dwindsor]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
poiana: LGTM label has been added.  <details>Git tree hash: 67970c541bc2b9df5e9d29003b35c7764eb77ee4</details>
poiana: [APPROVALNOTIFIER] This PR is **NOT APPROVED**

This pull-request has been approved by: *<a href="https://github.com/falcosecurity/driverkit/pull/282#" title="Author self-approved">alacuku</a>*
**Once this PR has been reviewed and has the lgtm label**, please ask for approval from dwindsor. For more information see [the Kubernetes Code Review Process](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process).

The full list of commands accepted by this bot can be found [here](https://prow.falco.org/command-help?repo=falcosecurity%2Fdriverkit).

<details open>
Needs approval from an approver in each of these files:

- **[OWNERS](https://github.com/falcosecurity/driverkit/blob/master/OWNERS)**

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":["dwindsor"]} -->
poiana: LGTM label has been added.  <details>Git tree hash: c8faea80ef0d5bbe7e7a612c35b7476eb810453e</details>
poiana: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/falcosecurity/driverkit/pull/282#" title="Author self-approved">alacuku</a>*, *<a href="https://github.com/falcosecurity/driverkit/pull/282#pullrequestreview-1521414668" title="Approved">FedeDP</a>*

The full list of commands accepted by this bot can be found [here](https://prow.falco.org/command-help?repo=falcosecurity%2Fdriverkit).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/falcosecurity/driverkit/blob/master/OWNERS)~~ [FedeDP]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
FedeDP: /unhold

Patch:
diff --git a/cmd/root.go b/cmd/root.go
index 46919b8..033a14f 100644
--- a/cmd/root.go
+++ b/cmd/root.go
@@ -152,6 +152,11 @@ func NewRootCmd() *RootCmd {
 	flags.StringVar(&rootOpts.Repo.Org, "repo-org", rootOpts.Repo.Org, "repository github organization")
 	flags.StringVar(&rootOpts.Repo.Name, "repo-name", rootOpts.Repo.Name, "repository github name")
 
+	flags.StringVar(&rootOpts.Registry.Name, "registry-name", rootOpts.Registry.Name, "registry name to which authenticate")
+	flags.StringVar(&rootOpts.Registry.Username, "registry-user", rootOpts.Registry.Username, "registry username")
+	flags.StringVar(&rootOpts.Registry.Password, "registry-password", rootOpts.Registry.Password, "registry password")
+	flags.BoolVar(&rootOpts.Registry.PlainHTTP, "registry-plain-http", rootOpts.Registry.PlainHTTP, "allows interacting with remote registry via plain http requests")
+
 	viper.BindPFlags(flags)
 
 	// Flag annotations and custom completions
diff --git a/cmd/root_options.go b/cmd/root_options.go
index e3a26b2..f203af5 100644
--- a/cmd/root_options.go
+++ b/cmd/root_options.go
@@ -22,6 +22,13 @@ type RepoOptions struct {
 	Name string `default:"libs" name:"repo name"`
 }
 
+type Registry struct {
+	Name      string `validate:"required_with=Username Password" name:"registry name"`
+	Username  string `validate:"required_with=Registry Password" name:"registry username"`
+	Password  string `validate:"required_with=Username Registry" name:"registry password"`
+	PlainHTTP bool   `default:"false" name:"registry plain http"`
+}
+
 // RootOptions ...
 type RootOptions struct {
 	Architecture     string   `validate:"required,architecture" name:"architecture"`
@@ -38,6 +45,7 @@ type RootOptions struct {
 	KernelUrls       []string `name:"kernel header urls"`
 	Repo             RepoOptions
 	Output           OutputOptions
+	Registry         Registry
 }
 
 func init() {
@@ -116,23 +124,27 @@ func (ro *RootOptions) toBuild() *builder.Build {
 	}
 
 	build := &builder.Build{
-		TargetType:       builder.Type(ro.Target),
-		DriverVersion:    ro.DriverVersion,
-		KernelVersion:    ro.KernelVersion,
-		KernelRelease:    ro.KernelRelease,
-		Architecture:     ro.Architecture,
-		KernelConfigData: kernelConfigData,
-		ModuleFilePath:   ro.Output.Module,
-		ProbeFilePath:    ro.Output.Probe,
-		ModuleDriverName: ro.ModuleDriverName,
-		ModuleDeviceName: ro.ModuleDeviceName,
-		GCCVersion:       ro.GCCVersion,
-		BuilderImage:     ro.BuilderImage,
-		BuilderRepos:     ro.BuilderRepos,
-		KernelUrls:       ro.KernelUrls,
-		RepoOrg:          ro.Repo.Org,
-		RepoName:         ro.Repo.Name,
-		Images:           make(builder.ImagesMap),
+		TargetType:        builder.Type(ro.Target),
+		DriverVersion:     ro.DriverVersion,
+		KernelVersion:     ro.KernelVersion,
+		KernelRelease:     ro.KernelRelease,
+		Architecture:      ro.Architecture,
+		KernelConfigData:  kernelConfigData,
+		ModuleFilePath:    ro.Output.Module,
+		ProbeFilePath:     ro.Output.Probe,
+		ModuleDriverName:  ro.ModuleDriverName,
+		ModuleDeviceName:  ro.ModuleDeviceName,
+		GCCVersion:        ro.GCCVersion,
+		BuilderImage:      ro.BuilderImage,
+		BuilderRepos:      ro.BuilderRepos,
+		KernelUrls:        ro.KernelUrls,
+		RepoOrg:           ro.Repo.Org,
+		RepoName:          ro.Repo.Name,
+		Images:            make(builder.ImagesMap),
+		RegistryName:      ro.Registry.Name,
+		RegistryUser:      ro.Registry.Username,
+		RegistryPassword:  ro.Registry.Password,
+		RegistryPlainHTTP: ro.Registry.PlainHTTP,
 	}
 
 	// loop over BuilderRepos to build the list ImagesListers based on the value of the builderRepo:
@@ -145,7 +157,7 @@ func (ro *RootOptions) toBuild() *builder.Build {
 		if _, err = os.Stat(builderRepo); err == nil {
 			imageLister, err = builder.NewFileImagesLister(builderRepo, build)
 		} else {
-			imageLister, err = builder.NewRepoImagesLister(builderRepo, false, build)
+			imageLister, err = builder.NewRepoImagesLister(builderRepo, build)
 		}
 		if err != nil {
 			logger.WithError(err).Warnf("Skipping %s repo\n", builderRepo)
diff --git a/docs/driverkit.md b/docs/driverkit.md
index 25c82b2..4de7cbe 100644
--- a/docs/driverkit.md
+++ b/docs/driverkit.md
@@ -9,28 +9,32 @@ driverkit
 ### Options
 
 ```
-      --architecture string       target architecture for the built driver, one of [amd64,arm64] (default "amd64")
-      --builderimage string       docker image to be used to build the kernel module and eBPF probe. If not provided, an automatically selected image will be used.
-      --builderrepo strings       list of docker repositories or yaml file (absolute path) containing builder images index with the format 'images: [ { target:<target>, name:<image-name>, gcc_versions: [ <gcc-tag> ] },...]', in descending priority order. Used to search for builder images. eg: --builderrepo myorg/driverkit --builderrepo falcosecurity/driverkit --builderrepo '/path/to/my/index.yaml'. (default [docker.io/falcosecurity/driverkit-builder])
-  -c, --config string             config file path (default $HOME/.driverkit.yaml if exists)
-      --driverversion string      driver version as a git commit hash or as a git tag (default "master")
-      --dryrun                    do not actually perform the action
-      --gccversion string         enforce a specific gcc version for the build
-  -h, --help                      help for driverkit
-      --kernelconfigdata string   base64 encoded kernel config data: in some systems it can be found under the /boot directory, in other it is gzip compressed under /proc
-      --kernelrelease string      kernel release to build the module for, it can be found by executing 'uname -v'
-      --kernelurls strings        list of kernel header urls (e.g. --kernelurls <URL1> --kernelurls <URL2> --kernelurls "<URL3>,<URL4>")
-      --kernelversion string      kernel version to build the module for, it's the numeric value after the hash when you execute 'uname -v' (default "1")
-  -l, --loglevel string           log level (default "info")
-      --moduledevicename string   kernel module device name (the default is falco, so the device will be under /dev/falco*) (default "falco")
-      --moduledrivername string   kernel module driver name, i.e. the name you see when you check installed modules via lsmod (default "falco")
-      --output-module string      filepath where to save the resulting kernel module
-      --output-probe string       filepath where to save the resulting eBPF probe
-      --proxy string              the proxy to use to download data
-      --repo-name string          repository github name (default "libs")
-      --repo-org string           repository github organization (default "falcosecurity")
-  -t, --target string             the system to target the build for, one of [alinux,almalinux,amazonlinux,amazonlinux2,amazonlinux2022,amazonlinux2023,arch,bottlerocket,centos,debian,fedora,flatcar,minikube,ol,opensuse,photon,redhat,rocky,talos,ubuntu,vanilla]
-      --timeout int               timeout in seconds (default 120)
+      --architecture string        target architecture for the built driver, one of [amd64,arm64] (default "amd64")
+      --builderimage string        docker image to be used to build the kernel module and eBPF probe. If not provided, an automatically selected image will be used.
+      --builderrepo strings        list of docker repositories or yaml file (absolute path) containing builder images index with the format 'images: [ { target:<target>, name:<image-name>, arch: <arch>, tag: <imagetag>, gcc_versions: [ <gcc-tag> ] },...]', in descending priority order. Used to search for builder images. eg: --builderrepo myorg/driverkit-builder --builderrepo falcosecurity/driverkit-builder --builderrepo '/path/to/my/index.yaml'. (default [docker.io/falcosecurity/driverkit-builder])
+  -c, --config string              config file path (default $HOME/.driverkit.yaml if exists)
+      --driverversion string       driver version as a git commit hash or as a git tag (default "master")
+      --dryrun                     do not actually perform the action
+      --gccversion string          enforce a specific gcc version for the build
+  -h, --help                       help for driverkit
+      --kernelconfigdata string    base64 encoded kernel config data: in some systems it can be found under the /boot directory, in other it is gzip compressed under /proc
+      --kernelrelease string       kernel release to build the module for, it can be found by executing 'uname -v'
+      --kernelurls strings         list of kernel header urls (e.g. --kernelurls <URL1> --kernelurls <URL2> --kernelurls "<URL3>,<URL4>")
+      --kernelversion string       kernel version to build the module for, it's the numeric value after the hash when you execute 'uname -v' (default "1")
+  -l, --loglevel string            log level (default "info")
+      --moduledevicename string    kernel module device name (the default is falco, so the device will be under /dev/falco*) (default "falco")
+      --moduledrivername string    kernel module driver name, i.e. the name you see when you check installed modules via lsmod (default "falco")
+      --output-module string       filepath where to save the resulting kernel module
+      --output-probe string        filepath where to save the resulting eBPF probe
+      --proxy string               the proxy to use to download data
+      --registry-name string       registry name to which authenticate
+      --registry-password string   registry password
+      --registry-plain-http        allows interacting with remote registry via plain http requests
+      --registry-user string       registry username
+      --repo-name string           repository github name (default "libs")
+      --repo-org string            repository github organization (default "falcosecurity")
+  -t, --target string              the system to target the build for, one of [alinux,almalinux,amazonlinux,amazonlinux2,amazonlinux2022,amazonlinux2023,arch,bottlerocket,centos,debian,fedora,flatcar,minikube,ol,opensuse,photon,redhat,rocky,talos,ubuntu,vanilla]
+      --timeout int                timeout in seconds (default 120)
 ```
 
 ### SEE ALSO
diff --git a/docs/driverkit_docker.md b/docs/driverkit_docker.md
index 70cb087..91a2aeb 100644
--- a/docs/driverkit_docker.md
+++ b/docs/driverkit_docker.md
@@ -9,28 +9,32 @@ driverkit docker [flags]
 ### Options
 
 ```
-      --architecture string       target architecture for the built driver, one of [amd64,arm64] (default "amd64")
-      --builderimage string       docker image to be used to build the kernel module and eBPF probe. If not provided, an automatically selected image will be used.
-      --builderrepo strings       list of docker repositories or yaml file (absolute path) containing builder images index with the format 'images: [ { target:<target>, name:<image-name>, gcc_versions: [ <gcc-tag> ] },...]', in descending priority order. Used to search for builder images. eg: --builderrepo myorg/driverkit --builderrepo falcosecurity/driverkit --builderrepo '/path/to/my/index.yaml'. (default [docker.io/falcosecurity/driverkit-builder])
-  -c, --config string             config file path (default $HOME/.driverkit.yaml if exists)
-      --driverversion string      driver version as a git commit hash or as a git tag (default "master")
-      --dryrun                    do not actually perform the action
-      --gccversion string         enforce a specific gcc version for the build
-  -h, --help                      help for docker
-      --kernelconfigdata string   base64 encoded kernel config data: in some systems it can be found under the /boot directory, in other it is gzip compressed under /proc
-      --kernelrelease string      kernel release to build the module for, it can be found by executing 'uname -v'
-      --kernelurls strings        list of kernel header urls (e.g. --kernelurls <URL1> --kernelurls <URL2> --kernelurls "<URL3>,<URL4>")
-      --kernelversion string      kernel version to build the module for, it's the numeric value after the hash when you execute 'uname -v' (default "1")
-  -l, --loglevel string           log level (default "info")
-      --moduledevicename string   kernel module device name (the default is falco, so the device will be under /dev/falco*) (default "falco")
-      --moduledrivername string   kernel module driver name, i.e. the name you see when you check installed modules via lsmod (default "falco")
-      --output-module string      filepath where to save the resulting kernel module
-      --output-probe string       filepath where to save the resulting eBPF probe
-      --proxy string              the proxy to use to download data
-      --repo-name string          repository github name (default "libs")
-      --repo-org string           repository github organization (default "falcosecurity")
-  -t, --target string             the system to target the build for, one of [alinux,almalinux,amazonlinux,amazonlinux2,amazonlinux2022,amazonlinux2023,arch,bottlerocket,centos,debian,fedora,flatcar,minikube,ol,opensuse,photon,redhat,rocky,talos,ubuntu,vanilla]
-      --timeout int               timeout in seconds (default 120)
+      --architecture string        target architecture for the built driver, one of [amd64,arm64] (default "amd64")
+      --builderimage string        docker image to be used to build the kernel module and eBPF probe. If not provided, an automatically selected image will be used.
+      --builderrepo strings        list of docker repositories or yaml file (absolute path) containing builder images index with the format 'images: [ { target:<target>, name:<image-name>, arch: <arch>, tag: <imagetag>, gcc_versions: [ <gcc-tag> ] },...]', in descending priority order. Used to search for builder images. eg: --builderrepo myorg/driverkit-builder --builderrepo falcosecurity/driverkit-builder --builderrepo '/path/to/my/index.yaml'. (default [docker.io/falcosecurity/driverkit-builder])
+  -c, --config string              config file path (default $HOME/.driverkit.yaml if exists)
+      --driverversion string       driver version as a git commit hash or as a git tag (default "master")
+      --dryrun                     do not actually perform the action
+      --gccversion string          enforce a specific gcc version for the build
+  -h, --help                       help for docker
+      --kernelconfigdata string    base64 encoded kernel config data: in some systems it can be found under the /boot directory, in other it is gzip compressed under /proc
+      --kernelrelease string       kernel release to build the module for, it can be found by executing 'uname -v'
+      --kernelurls strings         list of kernel header urls (e.g. --kernelurls <URL1> --kernelurls <URL2> --kernelurls "<URL3>,<URL4>")
+      --kernelversion string       kernel version to build the module for, it's the numeric value after the hash when you execute 'uname -v' (default "1")
+  -l, --loglevel string            log level (default "info")
+      --moduledevicename string    kernel module device name (the default is falco, so the device will be under /dev/falco*) (default "falco")
+      --moduledrivername string    kernel module driver name, i.e. the name you see when you check installed modules via lsmod (default "falco")
+      --output-module string       filepath where to save the resulting kernel module
+      --output-probe string        filepath where to save the resulting eBPF probe
+      --proxy string               the proxy to use to download data
+      --registry-name string       registry name to which authenticate
+      --registry-password string   registry password
+      --registry-plain-http        allows interacting with remote registry via plain http requests
+      --registry-user string       registry username
+      --repo-name string           repository github name (default "libs")
+      --repo-org string            repository github organization (default "falcosecurity")
+  -t, --target string              the system to target the build for, one of [alinux,almalinux,amazonlinux,amazonlinux2,amazonlinux2022,amazonlinux2023,arch,bottlerocket,centos,debian,fedora,flatcar,minikube,ol,opensuse,photon,redhat,rocky,talos,ubuntu,vanilla]
+      --timeout int                timeout in seconds (default 120)
 ```
 
 ### SEE ALSO
diff --git a/docs/driverkit_images.md b/docs/driverkit_images.md
index a599863..b55a796 100644
--- a/docs/driverkit_images.md
+++ b/docs/driverkit_images.md
@@ -9,28 +9,32 @@ driverkit images [flags]
 ### Options
 
 ```
-      --architecture string       target architecture for the built driver, one of [amd64,arm64] (default "amd64")
-      --builderimage string       docker image to be used to build the kernel module and eBPF probe. If not provided, an automatically selected image will be used.
-      --builderrepo strings       list of docker repositories or yaml file (absolute path) containing builder images index with the format 'images: [ { target:<target>, name:<image-name>, gcc_versions: [ <gcc-tag> ] },...]', in descending priority order. Used to search for builder images. eg: --builderrepo myorg/driverkit --builderrepo falcosecurity/driverkit --builderrepo '/path/to/my/index.yaml'. (default [docker.io/falcosecurity/driverkit-builder])
-  -c, --config string             config file path (default $HOME/.driverkit.yaml if exists)
-      --driverversion string      driver version as a git commit hash or as a git tag (default "master")
-      --dryrun                    do not actually perform the action
-      --gccversion string         enforce a specific gcc version for the build
-  -h, --help                      help for images
-      --kernelconfigdata string   base64 encoded kernel config data: in some systems it can be found under the /boot directory, in other it is gzip compressed under /proc
-      --kernelrelease string      kernel release to build the module for, it can be found by executing 'uname -v'
-      --kernelurls strings        list of kernel header urls (e.g. --kernelurls <URL1> --kernelurls <URL2> --kernelurls "<URL3>,<URL4>")
-      --kernelversion string      kernel version to build the module for, it's the numeric value after the hash when you execute 'uname -v' (default "1")
-  -l, --loglevel string           log level (default "info")
-      --moduledevicename string   kernel module device name (the default is falco, so the device will be under /dev/falco*) (default "falco")
-      --moduledrivername string   kernel module driver name, i.e. the name you see when you check installed modules via lsmod (default "falco")
-      --output-module string      filepath where to save the resulting kernel module
-      --output-probe string       filepath where to save the resulting eBPF probe
-      --proxy string              the proxy to use to download data
-      --repo-name string          repository github name (default "libs")
-      --repo-org string           repository github organization (default "falcosecurity")
-  -t, --target string             the system to target the build for, one of [alinux,almalinux,amazonlinux,amazonlinux2,amazonlinux2022,amazonlinux2023,arch,bottlerocket,centos,debian,fedora,flatcar,minikube,ol,opensuse,photon,redhat,rocky,talos,ubuntu,vanilla]
-      --timeout int               timeout in seconds (default 120)
+      --architecture string        target architecture for the built driver, one of [amd64,arm64] (default "amd64")
+      --builderimage string        docker image to be used to build the kernel module and eBPF probe. If not provided, an automatically selected image will be used.
+      --builderrepo strings        list of docker repositories or yaml file (absolute path) containing builder images index with the format 'images: [ { target:<target>, name:<image-name>, arch: <arch>, tag: <imagetag>, gcc_versions: [ <gcc-tag> ] },...]', in descending priority order. Used to search for builder images. eg: --builderrepo myorg/driverkit-builder --builderrepo falcosecurity/driverkit-builder --builderrepo '/path/to/my/index.yaml'. (default [docker.io/falcosecurity/driverkit-builder])
+  -c, --config string              config file path (default $HOME/.driverkit.yaml if exists)
+      --driverversion string       driver version as a git commit hash or as a git tag (default "master")
+      --dryrun                     do not actually perform the action
+      --gccversion string          enforce a specific gcc version for the build
+  -h, --help                       help for images
+      --kernelconfigdata string    base64 encoded kernel config data: in some systems it can be found under the /boot directory, in other it is gzip compressed under /proc
+      --kernelrelease string       kernel release to build the module for, it can be found by executing 'uname -v'
+      --kernelurls strings         list of kernel header urls (e.g. --kernelurls <URL1> --kernelurls <URL2> --kernelurls "<URL3>,<URL4>")
+      --kernelversion string       kernel version to build the module for, it's the numeric value after the hash when you execute 'uname -v' (default "1")
+  -l, --loglevel string            log level (default "info")
+      --moduledevicename string    kernel module device name (the default is falco, so the device will be under /dev/falco*) (default "falco")
+      --moduledrivername string    kernel module driver name, i.e. the name you see when you check installed modules via lsmod (default "falco")
+      --output-module string       filepath where to save the resulting kernel module
+      --output-probe string        filepath where to save the resulting eBPF probe
+      --proxy string               the proxy to use to download data
+      --registry-name string       registry name to which authenticate
+      --registry-password string   registry password
+      --registry-plain-http        allows interacting with remote registry via plain http requests
+      --registry-user string       registry username
+      --repo-name string           repository github name (default "libs")
+      --repo-org string            repository github organization (default "falcosecurity")
+  -t, --target string              the system to target the build for, one of [alinux,almalinux,amazonlinux,amazonlinux2,amazonlinux2022,amazonlinux2023,arch,bottlerocket,centos,debian,fedora,flatcar,minikube,ol,opensuse,photon,redhat,rocky,talos,ubuntu,vanilla]
+      --timeout int                timeout in seconds (default 120)
 ```
 
 ### SEE ALSO
diff --git a/docs/driverkit_kubernetes-in-cluster.md b/docs/driverkit_kubernetes-in-cluster.md
index 78244bf..bf5d6b5 100644
--- a/docs/driverkit_kubernetes-in-cluster.md
+++ b/docs/driverkit_kubernetes-in-cluster.md
@@ -11,7 +11,7 @@ driverkit kubernetes-in-cluster [flags]
 ```
       --architecture string        target architecture for the built driver, one of [amd64,arm64] (default "amd64")
       --builderimage string        docker image to be used to build the kernel module and eBPF probe. If not provided, an automatically selected image will be used.
-      --builderrepo strings        list of docker repositories or yaml file (absolute path) containing builder images index with the format 'images: [ { target:<target>, name:<image-name>, gcc_versions: [ <gcc-tag> ] },...]', in descending priority order. Used to search for builder images. eg: --builderrepo myorg/driverkit --builderrepo falcosecurity/driverkit --builderrepo '/path/to/my/index.yaml'. (default [docker.io/falcosecurity/driverkit-builder])
+      --builderrepo strings        list of docker repositories or yaml file (absolute path) containing builder images index with the format 'images: [ { target:<target>, name:<image-name>, arch: <arch>, tag: <imagetag>, gcc_versions: [ <gcc-tag> ] },...]', in descending priority order. Used to search for builder images. eg: --builderrepo myorg/driverkit-builder --builderrepo falcosecurity/driverkit-builder --builderrepo '/path/to/my/index.yaml'. (default [docker.io/falcosecurity/driverkit-builder])
   -c, --config string              config file path (default $HOME/.driverkit.yaml if exists)
       --driverversion string       driver version as a git commit hash or as a git tag (default "master")
       --dryrun                     do not actually perform the action
@@ -29,6 +29,10 @@ driverkit kubernetes-in-cluster [flags]
       --output-module string       filepath where to save the resulting kernel module
       --output-probe string        filepath where to save the resulting eBPF probe
       --proxy string               the proxy to use to download data
+      --registry-name string       registry name to which authenticate
+      --registry-password string   registry password
+      --registry-plain-http        allows interacting with remote registry via plain http requests
+      --registry-user string       registry username
       --repo-name string           repository github name (default "libs")
       --repo-org string            repository github organization (default "falcosecurity")
       --run-as-user int            Pods runner user
diff --git a/docs/driverkit_kubernetes.md b/docs/driverkit_kubernetes.md
index 8320876..b322c19 100644
--- a/docs/driverkit_kubernetes.md
+++ b/docs/driverkit_kubernetes.md
@@ -14,7 +14,7 @@ driverkit kubernetes [flags]
       --as-group stringArray           group to impersonate for the operation, this flag can be repeated to specify multiple groups
       --as-uid string                  uID to impersonate for the operation
       --builderimage string            docker image to be used to build the kernel module and eBPF probe. If not provided, an automatically selected image will be used.
-      --builderrepo strings            list of docker repositories or yaml file (absolute path) containing builder images index with the format 'images: [ { target:<target>, name:<image-name>, gcc_versions: [ <gcc-tag> ] },...]', in descending priority order. Used to search for builder images. eg: --builderrepo myorg/driverkit --builderrepo falcosecurity/driverkit --builderrepo '/path/to/my/index.yaml'. (default [docker.io/falcosecurity/driverkit-builder])
+      --builderrepo strings            list of docker repositories or yaml file (absolute path) containing builder images index with the format 'images: [ { target:<target>, name:<image-name>, arch: <arch>, tag: <imagetag>, gcc_versions: [ <gcc-tag> ] },...]', in descending priority order. Used to search for builder images. eg: --builderrepo myorg/driverkit-builder --builderrepo falcosecurity/driverkit-builder --builderrepo '/path/to/my/index.yaml'. (default [docker.io/falcosecurity/driverkit-builder])
       --cache-dir string               default cache directory (default "$HOME/.kube/cache")
       --certificate-authority string   path to a cert file for the certificate authority
       --client-certificate string      path to a client certificate file for TLS
@@ -40,6 +40,10 @@ driverkit kubernetes [flags]
       --output-module string           filepath where to save the resulting kernel module
       --output-probe string            filepath where to save the resulting eBPF probe
       --proxy string                   the proxy to use to download data
+      --registry-name string           registry name to which authenticate
+      --registry-password string       registry password
+      --registry-plain-http            allows interacting with remote registry via plain http requests
+      --registry-user string           registry username
       --repo-name string               repository github name (default "libs")
       --repo-org string                repository github organization (default "falcosecurity")
       --request-timeout string         the length of time to wait before giving up on a single server request, non-zero values should contain a corresponding time unit (e.g, 1s, 2m, 3h), a value of zero means don't timeout requests (default "0")
diff --git a/pkg/driverbuilder/builder/build.go b/pkg/driverbuilder/builder/build.go
index c50d24a..bca3342 100644
--- a/pkg/driverbuilder/builder/build.go
+++ b/pkg/driverbuilder/builder/build.go
@@ -1,8 +1,10 @@
 package builder
 
 import (
+	"context"
 	"fmt"
 	"github.com/falcosecurity/driverkit/pkg/kernelrelease"
+	"oras.land/oras-go/v2/registry/remote/auth"
 	"strings"
 )
 
@@ -10,24 +12,28 @@ var defaultImageTag = "latest" // This is overwritten when using the Makefile to
 
 // Build contains the info about the on-going build.
 type Build struct {
-	TargetType       Type
-	KernelConfigData string
-	KernelRelease    string
-	KernelVersion    string
-	DriverVersion    string
-	Architecture     string
-	ModuleFilePath   string
-	ProbeFilePath    string
-	ModuleDriverName string
-	ModuleDeviceName string
-	BuilderImage     string
-	BuilderRepos     []string
-	ImagesListers    []ImagesLister
-	KernelUrls       []string
-	GCCVersion       string
-	RepoOrg          string
-	RepoName         string
-	Images           ImagesMap
+	TargetType        Type
+	KernelConfigData  string
+	KernelRelease     string
+	KernelVersion     string
+	DriverVersion     string
+	Architecture      string
+	ModuleFilePath    string
+	ProbeFilePath     string
+	ModuleDriverName  string
+	ModuleDeviceName  string
+	BuilderImage      string
+	BuilderRepos      []string
+	ImagesListers     []ImagesLister
+	KernelUrls        []string
+	GCCVersion        string
+	RepoOrg           string
+	RepoName          string
+	Images            ImagesMap
+	RegistryName      string
+	RegistryUser      string
+	RegistryPassword  string
+	RegistryPlainHTTP bool
 }
 
 func (b *Build) KernelReleaseFromBuildConfig() kernelrelease.KernelRelease {
@@ -69,3 +75,20 @@ func (b *Build) builderImageTag() string {
 	}
 	return defaultImageTag
 }
+
+func (b *Build) ClientForRegistry(registry string) *auth.Client {
+	client := auth.DefaultClient
+	client.SetUserAgent("driverkit")
+	client.Credential = func(ctx context.Context, reg string) (auth.Credential, error) {
+		if b.RegistryName == registry {
+			return auth.Credential{
+				Username: b.RegistryUser,
+				Password: b.RegistryPassword,
+			}, nil
+		}
+
+		return auth.EmptyCredential, nil
+	}
+
+	return client
+}
diff --git a/pkg/driverbuilder/builder/image.go b/pkg/driverbuilder/builder/image.go
index 083f77e..0193752 100644
--- a/pkg/driverbuilder/builder/image.go
+++ b/pkg/driverbuilder/builder/image.go
@@ -137,7 +137,7 @@ func (f *FileImagesLister) LoadImages() []Image {
 	return res
 }
 
-func NewRepoImagesLister(repo string, httpOnly bool, build *Build) (*RepoImagesLister, error) {
+func NewRepoImagesLister(repo string, build *Build) (*RepoImagesLister, error) {
 	// Lazy inizialization
 	if tagReg == nil {
 		imageTag := build.builderImageTag()
@@ -147,14 +147,15 @@ func NewRepoImagesLister(repo string, httpOnly bool, build *Build) (*RepoImagesL
 		tagReg = regexp.MustCompile(targetFmt)
 	}
 
-	noCredentials := func(r *repository.Repository) {
-		// The default client will be used by oras.
-		// TODO: we don't support private repositories for now.
-		r.Client = nil
-		r.PlainHTTP = httpOnly
+	// Get the registry URL from repository.
+	registry, err := getRegistryFromRef(repo)
+	if err != nil {
+		return nil, err
 	}
 
-	repoOCI, err := repository.NewRepository(repo, noCredentials)
+	repoOCI, err := repository.NewRepository(repo,
+		repository.WithPlainHTTP(build.RegistryPlainHTTP),
+		repository.WithClient(build.ClientForRegistry(registry)))
 	if err != nil {
 		return nil, err
 	}
@@ -227,3 +228,13 @@ func (b *Build) LoadImages() {
 		logger.Fatal("Could not load any builder image. Leaving.")
 	}
 }
+
+// getRegistryFromRef extracts the registry from a ref string.
+func getRegistryFromRef(ref string) (string, error) {
+	index := strings.Index(ref, "/")
+	if index <= 0 {
+		return "", fmt.Errorf("cannot extract registry name from ref %q", ref)
+	}
+
+	return ref[0:index], nil
+}


Test patch:
diff --git a/cmd/testdata/autohelp.txt b/cmd/testdata/autohelp.txt
index 23c34b7..f859c6a 100644
--- a/cmd/testdata/autohelp.txt
+++ b/cmd/testdata/autohelp.txt
@@ -6,6 +6,6 @@ INFO specify a valid processor                     processors="[docker kubernete
 {{ .Commands }}
 
 {{ .Flags }}
-  -v, --version                   version for driverkit
+  -v, --version                    version for driverkit
 
 {{ .Info }}
diff --git a/cmd/testdata/help-flag.txt b/cmd/testdata/help-flag.txt
index 2f3243c..3697f23 100644
--- a/cmd/testdata/help-flag.txt
+++ b/cmd/testdata/help-flag.txt
@@ -5,6 +5,6 @@
 {{ .Commands }}
 
 {{ .Flags }}
-  -v, --version                   version for driverkit
+  -v, --version                    version for driverkit
 
 {{ .Info }}
diff --git a/cmd/testdata/invalid-proxyconfig.txt b/cmd/testdata/invalid-proxyconfig.txt
index ce0356a..e03ee3d 100644
--- a/cmd/testdata/invalid-proxyconfig.txt
+++ b/cmd/testdata/invalid-proxyconfig.txt
@@ -5,7 +5,7 @@ Error: exiting for validation errors
 {{ .Commands }}
 
 {{ .Flags }}
-  -v, --version                   version for driverkit
+  -v, --version                    version for driverkit
 
 {{ .Info }}
 
diff --git a/cmd/testdata/non-existent-processor.txt b/cmd/testdata/non-existent-processor.txt
index bcf7bae..2a98332 100644
--- a/cmd/testdata/non-existent-processor.txt
+++ b/cmd/testdata/non-existent-processor.txt
@@ -4,7 +4,7 @@ Error: invalid argument "abc" for "driverkit"
 {{ .Commands }}
 
 {{ .Flags }}
-  -v, --version                   version for driverkit
+  -v, --version                    version for driverkit
 
 {{ .Info }}
 
diff --git a/cmd/testdata/templates/flags.txt b/cmd/testdata/templates/flags.txt
index 35c49c9..ed1089b 100644
--- a/cmd/testdata/templates/flags.txt
+++ b/cmd/testdata/templates/flags.txt
@@ -1,23 +1,27 @@
 Flags:
-      --architecture string       target architecture for the built driver, one of {{ .Architectures }} (default "{{ .CurrentArch }}")
-      --builderimage string       docker image to be used to build the kernel module and eBPF probe. If not provided, an automatically selected image will be used.
-      --builderrepo strings       list of docker repositories or yaml file (absolute path) containing builder images index with the format 'images: [ { target:<target>, name:<image-name>, arch: <arch>, tag: <imagetag>, gcc_versions: [ <gcc-tag> ] },...]', in descending priority order. Used to search for builder images. eg: --builderrepo myorg/driverkit-builder --builderrepo falcosecurity/driverkit-builder --builderrepo '/path/to/my/index.yaml'. (default [docker.io/falcosecurity/driverkit-builder])
-  -c, --config string             config file path (default $HOME/.driverkit.yaml if exists)
-      --driverversion string      driver version as a git commit hash or as a git tag (default "master")
-      --dryrun                    do not actually perform the action
-      --gccversion string         enforce a specific gcc version for the build
-  -h, --help                      help for {{ .Cmd }}
-      --kernelconfigdata string   base64 encoded kernel config data: in some systems it can be found under the /boot directory, in other it is gzip compressed under /proc
-      --kernelrelease string      kernel release to build the module for, it can be found by executing 'uname -v'
-      --kernelurls strings        list of kernel header urls (e.g. --kernelurls <URL1> --kernelurls <URL2> --kernelurls "<URL3>,<URL4>")
-      --kernelversion string      kernel version to build the module for, it's the numeric value after the hash when you execute 'uname -v' (default "1")
-  -l, --loglevel string           log level (default "info")
-      --moduledevicename string   kernel module device name (the default is falco, so the device will be under /dev/falco*) (default "falco")
-      --moduledrivername string   kernel module driver name, i.e. the name you see when you check installed modules via lsmod (default "falco")
-      --output-module string      filepath where to save the resulting kernel module
-      --output-probe string       filepath where to save the resulting eBPF probe
-      --proxy string              the proxy to use to download data
-      --repo-name string          repository github name (default "libs")
-      --repo-org string           repository github organization (default "falcosecurity")
-  -t, --target string             the system to target the build for, one of {{ .Targets }}
-      --timeout int               timeout in seconds (default 120)
\ No newline at end of file
+      --architecture string        target architecture for the built driver, one of {{ .Architectures }} (default "{{ .CurrentArch }}")
+      --builderimage string        docker image to be used to build the kernel module and eBPF probe. If not provided, an automatically selected image will be used.
+      --builderrepo strings        list of docker repositories or yaml file (absolute path) containing builder images index with the format 'images: [ { target:<target>, name:<image-name>, arch: <arch>, tag: <imagetag>, gcc_versions: [ <gcc-tag> ] },...]', in descending priority order. Used to search for builder images. eg: --builderrepo myorg/driverkit-builder --builderrepo falcosecurity/driverkit-builder --builderrepo '/path/to/my/index.yaml'. (default [docker.io/falcosecurity/driverkit-builder])
+  -c, --config string              config file path (default $HOME/.driverkit.yaml if exists)
+      --driverversion string       driver version as a git commit hash or as a git tag (default "master")
+      --dryrun                     do not actually perform the action
+      --gccversion string          enforce a specific gcc version for the build
+  -h, --help                       help for {{ .Cmd }}
+      --kernelconfigdata string    base64 encoded kernel config data: in some systems it can be found under the /boot directory, in other it is gzip compressed under /proc
+      --kernelrelease string       kernel release to build the module for, it can be found by executing 'uname -v'
+      --kernelurls strings         list of kernel header urls (e.g. --kernelurls <URL1> --kernelurls <URL2> --kernelurls "<URL3>,<URL4>")
+      --kernelversion string       kernel version to build the module for, it's the numeric value after the hash when you execute 'uname -v' (default "1")
+  -l, --loglevel string            log level (default "info")
+      --moduledevicename string    kernel module device name (the default is falco, so the device will be under /dev/falco*) (default "falco")
+      --moduledrivername string    kernel module driver name, i.e. the name you see when you check installed modules via lsmod (default "falco")
+      --output-module string       filepath where to save the resulting kernel module
+      --output-probe string        filepath where to save the resulting eBPF probe
+      --proxy string               the proxy to use to download data
+      --registry-name string       registry name to which authenticate
+      --registry-password string   registry password
+      --registry-plain-http        allows interacting with remote registry via plain http requests
+      --registry-user string       registry username
+      --repo-name string           repository github name (default "libs")
+      --repo-org string            repository github organization (default "falcosecurity")
+  -t, --target string              the system to target the build for, one of {{ .Targets }}
+      --timeout int                timeout in seconds (default 120)
\ No newline at end of file
diff --git a/pkg/driverbuilder/builder/image_test.go b/pkg/driverbuilder/builder/image_test.go
index 61da9ee..91c1f36 100644
--- a/pkg/driverbuilder/builder/image_test.go
+++ b/pkg/driverbuilder/builder/image_test.go
@@ -263,10 +263,11 @@ func TestRepoImagesLister(t *testing.T) {
 	assert.NilError(t, err)
 	defer mock.Close()
 
-	lister, err := NewRepoImagesLister(mock.URL()+"/foo/test", true, &Build{
-		TargetType:   Type("centos"),
-		Architecture: "amd64",
-		BuilderImage: "auto:latest",
+	lister, err := NewRepoImagesLister(mock.URL()+"/foo/test", &Build{
+		TargetType:        Type("centos"),
+		Architecture:      "amd64",
+		BuilderImage:      "auto:latest",
+		RegistryPlainHTTP: true,
 	})
 	assert.NilError(t, err)