From 47c4dba40935f8c887a7d43f6fbfca5fafadeb7f Mon Sep 17 00:00:00 2001
From: Jin Dong <djdongjin95@gmail.com>
Date: Mon, 16 Dec 2024 02:18:24 +0000
Subject: [PATCH] Unify default transport in docker resolver

The default transport are used in 3 places:

1. `ConfigureDefaultRegistries` (no `hosts_dir` is set)
2. `ConfigureHosts` (when `hosts_dir` is set)
3. in cri service

2 and 3 use/duplicate the same default transport, whereas 1
uses go's default Client/Transport

This PR moves the default transport to a common funcion (can pass in tls config).

Signed-off-by: Jin Dong <djdongjin95@gmail.com>
---
 core/remotes/docker/config/hosts.go      | 15 +--------------
 core/remotes/docker/registry.go          | 22 +++++++++++++++++++++-
 internal/cri/server/images/image_pull.go | 20 +-------------------
 3 files changed, 23 insertions(+), 34 deletions(-)

diff --git a/core/remotes/docker/config/hosts.go b/core/remotes/docker/config/hosts.go
index 86ea23238c..6c7d91edd2 100644
--- a/core/remotes/docker/config/hosts.go
+++ b/core/remotes/docker/config/hosts.go
@@ -28,7 +28,6 @@ import (
 	"path"
 	"path/filepath"
 	"strings"
-	"time"
 
 	"github.com/containerd/errdefs"
 	"github.com/containerd/log"
@@ -144,19 +143,7 @@ func ConfigureHosts(ctx context.Context, options HostOptions) docker.RegistryHos
 			defaultTLSConfig = &tls.Config{}
 		}
 
-		defaultTransport := &http.Transport{
-			Proxy: http.ProxyFromEnvironment,
-			DialContext: (&net.Dialer{
-				Timeout:       30 * time.Second,
-				KeepAlive:     30 * time.Second,
-				FallbackDelay: 300 * time.Millisecond,
-			}).DialContext,
-			MaxIdleConns:          10,
-			IdleConnTimeout:       30 * time.Second,
-			TLSHandshakeTimeout:   10 * time.Second,
-			TLSClientConfig:       defaultTLSConfig,
-			ExpectContinueTimeout: 5 * time.Second,
-		}
+		defaultTransport := docker.DefaultHTTPTransport(defaultTLSConfig)
 
 		client := &http.Client{
 			Transport: defaultTransport,
diff --git a/core/remotes/docker/registry.go b/core/remotes/docker/registry.go
index 98cafcd069..bbae768b15 100644
--- a/core/remotes/docker/registry.go
+++ b/core/remotes/docker/registry.go
@@ -17,9 +17,11 @@
 package docker
 
 import (
+	"crypto/tls"
 	"errors"
 	"net"
 	"net/http"
+	"time"
 )
 
 // HostCapabilities represent the capabilities of the registry
@@ -170,7 +172,9 @@ func ConfigureDefaultRegistries(ropts ...RegistryOpt) RegistryHosts {
 		}
 
 		if config.Client == nil {
-			config.Client = http.DefaultClient
+			config.Client = &http.Client{
+				Transport: DefaultHTTPTransport(nil),
+			}
 		}
 
 		if opts.plainHTTP != nil {
@@ -242,3 +246,19 @@ func MatchLocalhost(host string) (bool, error) {
 
 	return ip.IsLoopback(), nil
 }
+
+func DefaultHTTPTransport(defaultTLSConfig *tls.Config) *http.Transport {
+	return &http.Transport{
+		Proxy: http.ProxyFromEnvironment,
+		DialContext: (&net.Dialer{
+			Timeout:       30 * time.Second,
+			KeepAlive:     30 * time.Second,
+			FallbackDelay: 300 * time.Millisecond,
+		}).DialContext,
+		MaxIdleConns:          10,
+		IdleConnTimeout:       30 * time.Second,
+		TLSHandshakeTimeout:   10 * time.Second,
+		TLSClientConfig:       defaultTLSConfig,
+		ExpectContinueTimeout: 5 * time.Second,
+	}
+}
diff --git a/internal/cri/server/images/image_pull.go b/internal/cri/server/images/image_pull.go
index de8445932a..408d4fa1d4 100644
--- a/internal/cri/server/images/image_pull.go
+++ b/internal/cri/server/images/image_pull.go
@@ -22,7 +22,6 @@ import (
 	"encoding/base64"
 	"fmt"
 	"io"
-	"net"
 	"net/http"
 	"net/url"
 	"path/filepath"
@@ -448,7 +447,7 @@ func (c *CRIImageService) registryHosts(ctx context.Context, credentials func(ho
 			}
 
 			var (
-				transport = newTransport()
+				transport = docker.DefaultHTTPTransport(nil) // no tls config
 				client    = &http.Client{Transport: transport}
 				config    = c.config.Registry.Configs[u.Host]
 			)
@@ -564,23 +563,6 @@ func (c *CRIImageService) registryEndpoints(host string) ([]string, error) {
 	return append(endpoints, defaultScheme(defaultHost)+"://"+defaultHost), nil
 }
 
-// newTransport returns a new HTTP transport used to pull image.
-// TODO(random-liu): Create a library and share this code with `ctr`.
-func newTransport() *http.Transport {
-	return &http.Transport{
-		Proxy: http.ProxyFromEnvironment,
-		DialContext: (&net.Dialer{
-			Timeout:       30 * time.Second,
-			KeepAlive:     30 * time.Second,
-			FallbackDelay: 300 * time.Millisecond,
-		}).DialContext,
-		MaxIdleConns:          10,
-		IdleConnTimeout:       30 * time.Second,
-		TLSHandshakeTimeout:   10 * time.Second,
-		ExpectContinueTimeout: 5 * time.Second,
-	}
-}
-
 // encryptedImagesPullOpts returns the necessary list of pull options required
 // for decryption of encrypted images based on the cri decryption configuration.
 // Temporarily removed for v2 upgrade