Comment 7 for bug 1554288

The glance registry (like the database) should be firewalled off from regular users. A regular user should only be able to access the glance api endpoint (typically on port 9292), not the glance registry.

Any deployment which allows direct access to the glance registry for standard users has been misconfigured.

Assuming a well configured deployment, this bug covers the ability of an admin, on their private network, to DOS their own deployment by sending bogus input to the registry.

I don't think a properly deployed system (where only the Glance API, not the registry, is accessible) will allow a regular user to use this registry behaviour as an attack.

That said, I think the registry should do a better job here, eg in returning 400 for the input in question (which seems to create image records which can't be deleted).