I think Skopeo should work out of the box without having to specify any specific arguments, excepting for security reasons.
We should instead work on Skopeo to improve its current configuration file management: they are working hard on rootless stuffs but a root account is required to use Skopeo out-of-the-box :/

I think Skopeo should work out of the box without having to specify any specific arguments, excepting for security reasons.

I think skopeo disregarding the NixOS managed /etc/containers/policy.json without communicating that to the user could perhaps be called a security issue.

We should instead work on Skopeo to improve its current configuration file management: they are working hard on rootless stuffs but a root account is required to use Skopeo out-of-the-box

I agree with this, if they change this upstream in a consistent way for all of the tools that would be good.

However I see this as a inconsistency that we should resolve as we are the ones that are setting the policy at build time causing /etc/containers/policy.json to be ignored by skopeo while the other tools respect it and actually require it to function.

I think we should just accept that it doesn't work out of the box.

Not necessarily a good alternative but we could use the same method to set the default policy for all of the tools and remove the etc/containers/policy.json managed by the module?

@NixOS/podman Any thoughts on this?

We should instead work on Skopeo to improve its current configuration file management: they are working hard on rootless stuffs but a root account is required to use Skopeo out-of-the-box

This is a very good longer term goal, but in the mean time setting the policy to a built-in causing Skopeo to ignore /etc/containers/policy.json is the wrong call and completely inconsistent with the rest of the libpod/libcontainer ecosystem.

This issue is about more than just Skopeo, and more than just this one file. See containers/podman#6053.

I think we should just accept that it doesn't work out of the box.

It seems you are right :(

This issue is about more than just Skopeo, and more than just this one file. See containers/podman#6053.

I don't think the Graham proposal would fix our current issue.

@zowoq Could you rebase, nixosTests.docker-tools is fixed on master.

Bumped to 1.0.0.

This broke nix-prefetch-docker, I've opened #88856 to fix it.