func (config *ServiceConfig) isSecureIndex(indexName string) bool {
	// Check for configured index, first.  This is needed in case isSecureIndex
	// is called from anything besides NewIndexInfo, in order to honor per-index configurations.
	if index, ok := config.IndexConfigs[indexName]; ok {
		return index.Secure
	}

	host, _, err := net.SplitHostPort(indexName)
	if err != nil {
		// assume indexName is of the form `host` without the port and go on.
		host = indexName
	}

	addrs, err := lookupIP(host)
	if err != nil {
		ip := net.ParseIP(host)
		if ip != nil {
			addrs = []net.IP{ip}
		}

		// if ip == nil, then `host` is neither an IP nor it could be looked up,
		// either because the index is unreachable, or because the index is behind an HTTP proxy.
		// So, len(addrs) == 0 and we're not aborting.
	}

	// Try CIDR notation only if addrs has any elements, i.e. if `host`'s IP could be determined.
	for _, addr := range addrs {
		for _, ipnet := range config.InsecureRegistryCIDRs {
			// check if the addr falls in the subnet
			if (*net.IPNet)(ipnet).Contains(addr) {
				return false
			}
		}
	}

	return true
}
// isSecureIndex returns false if the provided indexName is part of the list of insecure registries
// Insecure registries accept HTTP and/or accept HTTPS with certificates from unknown CAs.
//
// The list of insecure registries can contain an element with CIDR notation to specify a whole subnet.
// If the subnet contains one of the IPs of the registry specified by indexName, the latter is considered
// insecure.
//
// indexName should be a URL.Host (`host:port` or `host`) where the `host` part can be either a domain name
// or an IP address. If it is a domain name, then it will be resolved in order to check if the IP is contained
// in a subnet. If the resolving is not successful, isSecureIndex will only try to match hostname to any element
// of insecureRegistries.
isSecureIndex returns false if the provided indexName is part of the list of insecure registries
Insecure registries accept HTTP and/or accept HTTPS with certificates from unknown CAs.

The list of insecure registries can contain an element with CIDR notation to specify a whole subnet.
If the subnet contains one of the IPs of the registry specified by indexName, the latter is considered
insecure.

indexName should be a URL.Host (`host:port` or `host`) where the `host` part can be either a domain name
or an IP address. If it is a domain name, then it will be resolved in order to check if the IP is contained
in a subnet. If the resolving is not successful, isSecureIndex will only try to match hostname to any element
of insecureRegistries.
// isSecureIndex returns false if the provided indexName is part of the list of insecure registries // Insecure registries accept HTTP and / or accept HTTPS with certificates from unknown CAs . // // The list of insecure registries can contain an element with CIDR notation to specify a whole subnet . // If the subnet contains one of the IPs of the registry specified by indexName the latter is considered // insecure . // // indexName should be a URL . Host ( ` host : port ` or ` host ` ) where the ` host ` part can be either a domain name // or an IP address . If it is a domain name then it will be resolved in order to check if the IP is contained // in a subnet . If the resolving is not successful isSecureIndex will only try to match hostname to any element // of insecureRegistries .
func (config *ServiceConfig) isSecureIndex(indexName string) bool {
	if index, ok := config.IndexConfigs[indexName]; ok {
		return index.Secure
	}
	host, _, err := net.SplitHostPort(indexName)
	if err != nil {
		host = indexName
	}
	addrs, err := lookupIP(host)
	if err != nil {
		ip := net.ParseIP(host)
		if ip != nil {
			addrs = []net.IP{ip}
		}
	}
	for _, addr := range addrs {
		for _, ipnet := range config.InsecureRegistryCIDRs {
			if (*net.IPNet)(ipnet).Contains(addr) {
				return false
			}
		}
	}
	return true
}
func ( config * ServiceConfig ) isSecureIndex ( indexName string ) bool { if index , ok := config . IndexConfigs [ indexName ] ; ok { return index . Secure } host , _ , err := net . SplitHostPort ( indexName ) if err != nil { host = indexName } addrs , err := lookupIP ( host ) if err != nil { ip := net . ParseIP ( host ) if ip != nil { addrs = [ ] net . IP { ip } } } for _ , addr := range addrs { for _ , ipnet := range config . InsecureRegistryCIDRs { if ( * net . IPNet ) ( ipnet ) . Contains ( addr ) { return false } } } return true }
isSecureIndex returns false if the provided indexName is part of the list of insecure registries
Insecure registries accept HTTP and/or accept HTTPS with certificates from unknown CAs.
isSecureIndex returns false if the provided indexName is part of the list of insecure registries Insecure registries accept HTTP and / or accept HTTPS with certificates from unknown CAs .
// Check for configured index, first.  This is needed in case isSecureIndex // is called from anything besides NewIndexInfo, in order to honor per-index configurations. // assume indexName is of the form `host` without the port and go on. // if ip == nil, then `host` is neither an IP nor it could be looked up, // either because the index is unreachable, or because the index is behind an HTTP proxy. // So, len(addrs) == 0 and we're not aborting. // Try CIDR notation only if addrs has any elements, i.e. if `host`'s IP could be determined. // check if the addr falls in the subnet