Refactor image management to use transfer service

[ChengyuZhu6]

Fixes: #4573

[ChengyuZhu6]

Most image management operations now use the transfer service:

• Standard image pull/push operations
• Multi-platform image handling
• Progress reporting and streaming
• Basic registry authentication
• Image import/export (load/save)

Limitations

Due to current transfer API constraints, the following features continue to use the legacy implementation:

1. IPFS Registry and Nondistributable Artifacts

Reason: The transfer service API does not support custom registry resolver implementations.

Affected features:

• IPFS registry functionality (ipfs:// protocol)
• Nondistributable artifact handling (e.g., Windows base layers)

Status: These features remain on the legacy resolver-based approach until the transfer API supports custom resolvers.

2. Containerd 1.7.x Compatibility Issue

Issue: When using containerd 1.7.x daemons, registry options like WithDefaultScheme("http") and WithHostDir() are silently ignored.

Technical details:

• nerdctl uses containerd v2.2 client library which supports these options
• Options are properly serialized into protobuf messages
• However, containerd 1.7.x's UnmarshalAny() implementation doesn't process these fields
• Only authorizer and headers are handled in 1.7.x

Impact:

• Localhost registry operations may fail with: "http: server gave HTTP response to HTTPS client"
• Custom hosts.toml configurations are not applied on 1.7.x

[ChengyuZhu6]

For limitation 2, there are two potential solutions:

1. Implement containerd version detection in nerdctl to use different code paths;
2. Backport to containerd 1.7.x

For limitation 1, there are two potential solutions:

1. IPFS Registry and Nondistributable Artifacts remain on the legacy resolver-based approach.
2. containerd transfer API supports custom resolvers

[ChengyuZhu6]

@AkihiroSuda @ktock

[AkihiroSuda]

Thanks @ChengyuZhu6

For limitation 2, there are two potential solutions:

1. Implement containerd version detection in nerdctl to use different code paths;
2. Backport to containerd 1.7.x

For limitation 1, there are two potential solutions:

1. IPFS Registry and Nondistributable Artifacts remain on the legacy resolver-based approach.
2. containerd transfer API supports custom resolvers

2 in the long term, 1 in the short term