add example to test registry

[larhauga]

add example of how to test image registries.
fixes #93

[anderseknert]

Nice! One issue to address, but besides that, awesome!

[anderseknert]

This too should have a trailing /, or else there's always the risk that someone registers busyboxevilhacker and we'll consider it a an allowed registry.

[larhauga]

Since docker allows "busybox" as image I tested some more and changed the policy to allow if the image matches explicitly or has registry prefix.
@anderseknert do you think this is a ok solution, or do you have any tips on a better one? :) Thanks

[anderseknert]

That's just Docker benefiting themselves by having "no registry in the image string" mean their registry, i.e. docker.io. I would probably do something like this:

image := input.Body.Image if {
	contains(input.Body.Image, "/")
} else := concat("/", ["docker.io", input.Body.Image])

And then using image everywhere in place of input.Body.Image you can work with the same logic for docker.io as any other registry in your policy (meaning it would have to be included in allowed_registries).

Let me know if I missed any details :)