Function NewResolver

internal/oci/resolver.go:44–74

NewResolver sets up an OCI Resolver based on docker/cli config to provide registry credentials. When transport is non-nil it is used as the HTTP transport for both registry calls and the authorizer's token fetches (e.g. to route both through Docker Desktop's PAC-aware proxy); nil falls back to conta

(config *configfile.ConfigFile, transport http.RoundTripper, insecureRegistries ...string)

// (e.g. to route both through Docker Desktop's PAC-aware proxy); nil falls
// back to containerd's default transport.
func NewResolver(config *configfile.ConfigFile, transport http.RoundTripper, insecureRegistries ...string) remotes.Resolver {
	authOpts := []docker.AuthorizerOpt{
		docker.WithAuthCreds(func(host string) (string, string, error) {
			host = registry.GetAuthConfigKey(host)
			auth, err := config.GetAuthConfig(host)
			if err != nil {
				return "", "", err
			}
			if auth.IdentityToken != "" {
				return "", auth.IdentityToken, nil
			}
			return auth.Username, auth.Password, nil
		}),
	}
	if transport != nil {
		authOpts = append(authOpts, docker.WithAuthClient(&http.Client{Transport: transport}))
	}
	opts := []docker.RegistryOpt{
		docker.WithAuthorizer(docker.NewDockerAuthorizer(authOpts...)),
		docker.WithPlainHTTP(func(domain string) (bool, error) {
			// Should be used for testing **only**
			return slices.Contains(insecureRegistries, domain), nil
		}),
	}
	if transport != nil {
		opts = append(opts, docker.WithClient(&http.Client{Transport: transport}))
	}
	return docker.NewResolver(docker.ResolverOptions{
		Hosts: docker.ConfigureDefaultRegistries(opts...),
	})
}

// Get retrieves a Named OCI resource and returns OCI Descriptor and Manifest
func Get(ctx context.Context, resolver remotes.Resolver, ref reference.Named) (spec.Descriptor, []byte, error) {