Disallow pulling Gadgets

It is possible to disallow pulling gadgets by using the --disallow-pulling flag. By default, pulling is allowed.

kubectl gadget

You can specify this option only at deploy time. Start by creating a daemon configuration file, for example daemon-config.yaml:

cat <<EOF > daemon-config.yaml
operator:
  oci:
    disallow-pulling: true
EOF

$ kubectl gadget deploy --daemon-config=daemon-config.yaml
...
Inspektor Gadget successfully deployed
$ kubectl gadget run trace_exec
Error: fetching gadget information: getting gadget info: rpc error: code = Unknown desc = getting gadget info: initializing and preparing operators: instantiating operator "oci": ensuring image: pulling image (if missing) "trace_exec": pulling image "trace_exec": pulling is disabled

ig

You can use the --disallow-pulling flag at run time:

$ sudo ig image list
REPOSITORY                                TAG                                       DIGEST       CREATED
trace_exec                                latest                                    24c0da566661 15 hours ago
$ sudo ig run --disallow-pulling trace_exec
RUNTIME.CONTAINERNAME    COMM                    PID           TID PCOMM                PPID ARGS         ER… TIMESTAMP
minikube-docker          iptables             137722        137722 kubelet             11713 /usr/sbin/i…     2024-07-25T10:30:21.902064…
minikube-docker          ip6tables            137723        137723 kubelet             11713 /usr/sbin/i…     2024-07-25T10:30:21.904561…
^C
$ sudo ig run --disallow-pulling trace_open
Error: fetching gadget information: initializing and preparing operators: instantiating operator "oci": ensuring image: pulling image (if missing) "trace_open": pulling image "trace_open": pulling is disabled

ig daemon

You can specify these options only at start time:

$ sudo ig image list
REPOSITORY                                TAG                                       DIGEST       CREATED
trace_exec                                latest                                    24c0da566661 15 hours ago
$ sudo ig daemon --disallow-pulling
...
# Switch to another terminal
$ gadgetctl run trace_exec
RUNTIME.CONTAINERNAME    COMM                    PID           TID PCOMM                PPID ARGS         ER… TIMESTAMP
minikube-docker          iptables             137722        137722 kubelet             11713 /usr/sbin/i…     2024-07-25T10:30:21.902064…
minikube-docker          ip6tables            137723        137723 kubelet             11713 /usr/sbin/i…     2024-07-25T10:30:21.904561…
$ gadgetctl run trace_open
Error: fetching gadget information: getting gadget info: rpc error: code = Unknown desc = getting gadget info: initializing and preparing operators: instantiating operator "oci": ensuring image: pulling image (if missing) "trace_open": pulling image "trace_open": pulling is disabled