OCI Image Sync

## Image Sync - Container Image Synchronization Tool A container image synchronization tool based on Skopeo, providing a clean Web UI interface that supports fast image synchronization between different container registries. ## Key Features - 🚀 Simple and easy-to-use Web UI interface - 🔐 Private registry authentication support (username/password) - 📦 Built on Skopeo for stable and reliable performance - 🎯 Cross-registry image copying support - 🏗️ Multi-architecture image synchronization (query and select specific architectures) - 📊 Real-time log output for transparent sync process - 💾 User configuration save and management (quick switching between multiple configs) - 🔒 OIDC unified authentication support (user configuration isolation) - 🐛 Built-in debugging tools for mobile and production troubleshooting ## Usage Instructions 1. Fill in **Source Image Address** (e.g., `docker.io/library/nginx:latest`) - For private registries, provide username and password - Choose whether to verify TLS certificates (verified by default) 2. **Query Available Architectures** (optional) - Click "Query Architectures" button to view all supported architectures - Results displayed as blue tags - Select specific architecture or sync all architectures 3. Fill in **Destination Image Address** (e.g., `registry.example.com/nginx:latest`) - For private registries, provide username and password - Choose whether to verify TLS certificates 4. Click **Start Sync** button - View sync progress and logs in real-time - Success or failure status displayed upon completion ## Configuration Save Feature - Save frequently-used configurations via **Advanced Options Panel** - Multi-configuration management support, max 4KB per config - Maximum 1000 configs per user - With OIDC authentication enabled, configs are automatically isolated per user - **Password Save Control**: Passwords not saved by default (maximum security), can be enabled via configuration ## Security Features ### Protection Mechanisms - ✅ **Command Injection Protection**: No shell execution, fundamentally prevents command injection - ✅ **Input Validation**: All user inputs strictly validated with whitelist (regex matching standard image address format) - ✅ **Parameter Injection Protection**: Rejects inputs containing shell metacharacters to prevent parameter injection attacks - ✅ **DoS Protection**: Input length limits (512 chars for image addresses, 256 chars for usernames) prevent memory exhaustion attacks ### Credential Security - ✅ **Passwords Not Saved by Default**: Config save feature disables password storage by default (`--allow-password-save=false`), ensuring no sensitive credentials in config files - ✅ **Automatic Log Sanitization**: All credential information in logs automatically replaced with `***:***` to prevent sensitive data leakage - ✅ **HTTPS Transmission**: Production environment credentials transmitted via HTTPS POST request body, not URL parameters - ✅ **Temporary Memory Storage**: Credentials only used temporarily during Skopeo execution, not persisted to disk ### User Isolation - ✅ **OIDC Unified Authentication**: Integrated with Lazycat Cloud microservice authentication system, automatic user identity verification - ✅ **Configuration Isolation**: Each user's configurations stored in separate directories, completely isolated - ✅ **Session Management**: HttpOnly Cookie, 7-day validity, automatic expiration cleanup - ✅ **Access Control**: All image sync APIs require authentication, unauthenticated access automatically redirects to login ### Resource Limits - ✅ **Config Size Limit**: Maximum 4KB per config, prevents storage space abuse - ✅ **Config Count Limit**: Maximum 1000 configs per user, prevents DoS attacks - ✅ **Timeout Control**: Default 10-minute timeout, prevents infinite task execution consuming resources