github/distribution
1
0
Fork 0
mirror of https://github.com/distribution/distribution.git synced 2026-07-25 15:10:53 +00:00
Code Issues Projects Releases Wiki Activity

docs: document catalog.maxentries configuration

Browse Source 
The catalog.maxentries configuration option was introduced as part of
the fix for CVE-2023-2253 (GHSA-hqxw-f8mx-cpmw) but was never added to
the configuration documentation.

Document the catalog subsection: the default limit (1000), the default
page size when n is not specified (100), and the 400
PAGINATION_NUMBER_INVALID error returned when n exceeds maxentries.
Also include the recommendation from the security advisory to avoid
exposing the catalog endpoint to the internet.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Tokuhiro Matsuno <tokuhirom@gmail.com>
This commit is contained in:
Tokuhiro Matsuno
2026-07-15 07:26:16 +09:00
parent 472c9d38c9
commit 6cc7a87891
1 changed files with 25 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
docs/content/about/configuration.md
View File

@@ -223,6 +223,8 @@ middleware:
- name: redirect
options:
baseurl: https://example.com/
catalog:
maxentries: 1000
tags:
maxtags: 1000
http:
@@ -802,6 +804,29 @@ location of a proxy for the layer stored by the S3 storage driver.
|-----------|----------|-------------------------------------------------------------------------------------------------------------|
| `baseurl` | yes | `SCHEME://HOST` at which layers are served. Can also contain port. For example, `https://example.com:5443`. |
## `catalog`
The `catalog` subsection provides configuration to limit the maximum number of
entries returned in a single response from the catalog API endpoint
(`/v2/_catalog`). When a client does not specify the `n` query parameter, at
most 100 entries are returned. When a client requests more than `maxentries`
via the `n` query parameter, the server rejects the request with a
`400 Bad Request` response and a `PAGINATION_NUMBER_INVALID` error.
The catalog endpoint is designed for registry synchronization with search or
other API systems, and serving a request may put significant load on the
backend storage. It is strongly recommended to keep this endpoint behind
heightened privilege and avoid exposing it to the internet.
```yaml
catalog:
maxentries: 1000
```
| Parameter | Required | Description |
|--------------|----------|-------------------------------------------------------------------------------------------|
| `maxentries` | no | Overrides the maximum number of entries returned by the catalog endpoint, default: `1000` |
## `tags`
The `tags` subsection provides configuration to limit the maximum number of tags