Detect and forward a private image sc can't build, but can reach locally #33

Merged

geusebio merged 2 commits from feature/forward-private-images into main

2026-08-20 18:50:12 +00:00

geusebio commented

2026-08-18 20:16:13 +00:00

Owner

Summary

Detects a private, unbuildable image: reference the client can already reach
locally (no dot/colon-before-slash or localhost heuristic false-positives
on Docker Hub), prompts before uploading it as-is, and uploads it alongside the
usual build contexts.
New internal/dockerhost: answers whether sc can drive a local Docker daemon
at all, talking straight to the socket.
New internal/dockercli: shells out to the docker CLI itself (inspect/pull/save)
since replicating its credential-helper resolution over the raw Engine API would
mean reinventing ~/.docker/config.json — a deliberate, documented exception to
this repo's usual "talk to the socket" rule.
New internal/forward: the forwardability heuristic and candidate filtering.
internal/upload: the multipart manifest gains an Images array alongside the
existing Contexts, streamed from a temp file rather than held in memory.

Test plan

go build ./..., go vet ./... — clean
go test ./... — all packages pass
hack/lint.sh (golangci-lint v2.6.1, pinned) — 0 issues
hack/coverage.sh — no floor regressions (dockercli/dockerhost/forward
floors recorded fresh; existing packages' figures held or rose slightly)

Consumed by the platform repo's feature/sc-forward-private-images branch, which
pins this commit and builds the server-side accept/store/load/scan half on top of it.

## Summary - Detects a private, unbuildable `image:` reference the client can already reach locally (no `dot`/`colon`-before-slash or `localhost` heuristic false-positives on Docker Hub), prompts before uploading it as-is, and uploads it alongside the usual build contexts. - New `internal/dockerhost`: answers whether `sc` can drive a local Docker daemon at all, talking straight to the socket. - New `internal/dockercli`: shells out to the `docker` CLI itself (inspect/pull/save) since replicating its credential-helper resolution over the raw Engine API would mean reinventing `~/.docker/config.json` — a deliberate, documented exception to this repo's usual "talk to the socket" rule. - New `internal/forward`: the forwardability heuristic and candidate filtering. - `internal/upload`: the multipart manifest gains an `Images` array alongside the existing `Contexts`, streamed from a temp file rather than held in memory. ## Test plan - [x] `go build ./...`, `go vet ./...` — clean - [x] `go test ./...` — all packages pass - [x] `hack/lint.sh` (golangci-lint v2.6.1, pinned) — 0 issues - [x] `hack/coverage.sh` — no floor regressions (`dockercli`/`dockerhost`/`forward` floors recorded fresh; existing packages' figures held or rose slightly) Consumed by the platform repo's `feature/sc-forward-private-images` branch, which pins this commit and builds the server-side accept/store/load/scan half on top of it.

geusebio added 1 commit

2026-08-18 20:16:13 +00:00

Detect and forward a private image sc can't build, but can reach locally

CI / build (pull_request) Failing after 36s

Details

ee0ddaf77d

sc only ever packaged a build: context; a plain image: reference passed
straight through and only actually got pulled server-side, where a private
image with no stored platform credential simply failed the deploy — even
when the developer's own machine could reach it fine.

Adds the whole client-side half of that: internal/dockerhost answers
whether a local Docker daemon socket is reachable at all (talking straight
to the socket, not the heavyweight docker/docker/client SDK or a shell-out);
internal/dockercli drives the real docker CLI for the one part that
genuinely needs it (inspect/pull/save, riding whatever credentials the
user's own docker login already resolved); internal/forward heuristically
tells a private-registry reference apart from an ordinary Docker Hub one, so
sc only asks about images actually worth asking about. deploy.go wires
these into a prompt-then-save step ahead of the upload, and internal/upload
carries the resulting tarball alongside the ordinary bundle.

See docs/registry.md's "Client-side forwarding" callout in the platform
repo for the full design.

geusebio changed title from ~~Detect and forward a private image sc can't build, but can reach locally~~ to WIP: Detect and forward a private image sc can't build, but can reach locally

2026-08-18 20:16:19 +00:00

geusebio referenced this pull request from a commit

2026-08-18 20:25:22 +00:00

Rebase the agent submodule pin onto its own main before this ships

geusebio added 1 commit

2026-08-19 07:57:28 +00:00

Lower dockerhost's coverage floor to CI's Linux figure

CI / build (pull_request) Successful in 47s

Details

0abd89ee3b

CI's runner runs as root, and TestPreflightIsPermissionDeniedOnAnUnreadableSocket
skips under root (a chmod 0 socket denies nobody when euid is 0), so the
PermissionDenied branch goes untested there. 100.0% was measured on macOS as a
non-root user, where that branch runs; CI's own run reported 97.0%, which is
the real floor for the runner this gates.

geusebio changed title from ~~WIP: Detect and forward a private image sc can't build, but can reach locally~~ to Detect and forward a private image sc can't build, but can reach locally

2026-08-19 08:57:00 +00:00

geusebio commented

2026-08-20 18:36:50 +00:00

Author

Owner

Heads up for whoever merges this: Someones.Computer's main pins the agent submodule at this branch's tip (0abd89ee), which is diverged from agent/main and only reachable from this branch. When this squash-merges and the branch is deleted, that pin orphans and a fresh clone of Someones.Computer fails git submodule update on the agent gitlink (the #902 failure mode). After merging, bump the Someones.Computer agent pin to the resulting main commit. Tracked in Grey.ooo/Someones.Computer#935 → Grey.ooo/Someones.Computer#935

Heads up for whoever merges this: Someones.Computer's main pins the `agent` submodule at this branch's tip (0abd89ee), which is diverged from agent/main and only reachable from this branch. When this squash-merges and the branch is deleted, that pin orphans and a fresh clone of Someones.Computer fails `git submodule update` on the `agent` gitlink (the #902 failure mode). After merging, bump the Someones.Computer `agent` pin to the resulting main commit. Tracked in Grey.ooo/Someones.Computer#935 → https://git.grey.ooo/Grey.ooo/Someones.Computer/issues/935

geusebio merged commit c9c5c93e53 into main

2026-08-20 18:50:12 +00:00

geusebio referenced this pull request from a commit

2026-08-20 18:50:12 +00:00

Detect and forward a private image sc can't build, but can reach locally (#33)

geusebio deleted branch feature/forward-private-images

2026-08-20 18:50:13 +00:00