stacklok / toolhive / 30115007657

69%

Build Type

push

github

Committed by web-flow

Commit Message

Fix digest-pinned image pulls failing at container create (#5978)

* Fix digest-pinned image pulls failing at container create

PullImage for tag@digest refs (e.g. the pinned Envoy image) used
go-containerregistry's daemon.Write to store the image under its tag
only. Docker's tag@digest cross-check at container-create time requires
the OCI manifest digest to be registered against the tag; daemon.Write
does not do this, so the create fails with "No such image" whenever a
local image already exists under that tag with a different digest.

Switch digest-pinned refs (name.Digest) to use the Docker daemon's
native ImagePull instead. The daemon correctly stores the manifest
digest, so subsequent container creates with tag@digest refs resolve
without error.

Auth is threaded through from the existing keychain, so private registry
digest pulls continue to work.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* Update Envoy arch doc to match current implementation

Remove two stale Known Limitations that are already resolved:
- Tag-pinned image: image is pinned by tag+digest (#5903 done)
- Admin interface port: admin is intentionally omitted from the
  bootstrap entirely, not loopback-bound and always running

Update the Architecture section admin interface paragraph and the
comparison table to match the actual code.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

Coverage Stats

0 of 28 new or added lines in 1 file covered. (0.0%)

17 existing lines in 6 files now uncovered.

79248 of 114243 relevant lines covered (69.37%)

80.51 hits per line