mirror of
https://github.com/home-assistant/supervisor.git
synced 2026-08-21 21:57:26 +01:00
a14729745c
* Parse image references using Docker's domain splitting logic The unsupported container evaluation split an image reference on its first colon to strip the tag. For a registry with a port, that colon belongs to the port, so `myregistry:5000/app:1.0` was reduced to `myregistry` and reported as an unsupported image on the host. Splitting an image reference correctly needs to know where the registry domain ends, and the pieces for that were already there but wired up in a way that could not be reused. IMAGE_REGISTRY_REGEX is a port of Docker's DomainRegexp, which Docker itself uses to validate a domain, not to find one. Placing it in front of the search meant get_registry_from_image() still had to re-derive the answer with the dot/colon/localhost checks that follow the match, and callers that needed the rest of the reference recovered it by slicing off len(registry) + 1 characters. Split the two jobs apart, mirroring Docker's reference implementation: - split_docker_domain() finds the domain the way splitDockerDomain() does, by cutting at the first slash and testing the candidate. It returns the remainder as well, so callers no longer slice by length, and it canonicalizes index.docker.io to docker.io, which lets stored Docker Hub credentials apply to references using the legacy domain. - is_registry_domain() validates a domain against DomainRegexp, which is what the regex is for. Image validation keeps rejecting malformed domains such as ".ghcr.io" through this check. - get_registry_from_image() stays as a wrapper for the callers that only need the domain. With the domain handled, splitting off the tag is a matter of taking the last colon that has no slash after it, which is what Docker's TagRegexp allows. split_image_tag() does that and drops any digest, so a digest-pinned image no longer reads as unsupported either. Move the image reference tests to tests/docker/test_utils.py next to the code under test. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Convert remaining image reference parsing to the new helpers Canonicalizing index.docker.io to docker.io made _get_credentials() qualify Docker Hub images from the raw reference, so a reference already carrying a Docker Hub domain gained a second prefix: index.docker.io/org/app was pulled as docker.io/index.docker.io/org/app. Before the canonicalization the legacy domain matched no configured registry and the image was pulled anonymously under its original name, so this only surfaced now, although the same doubling already applied to an explicit docker.io/org/app reference. Qualify from the remainder instead, which covers references without a domain and with either Docker Hub domain. Three more sites split an image reference on its first colon and hit the same problem a registry with a port causes in the unsupported container evaluation: - The image property of DockerInterface reported myreg:5000/supervisor:1.0 as myreg, and a digest reference as name@sha256. - get_latest_version() read the tag of a RepoTags entry, which for myreg:5000/homeassistant:2026.8.0 yielded 5000/homeassistant:2026.8.0. That is not a known version strategy, so every tag was skipped and the lookup failed with "No version found". This is reachable with a user-overridden Core image or a plugin image on a registry with a port. - The Supervisor start tag repair took the image name from a RepoTags entry the same way, leaving myreg as the name to tag. Also align two Docker Hub details with normalize.go: the library/ prefix for official images now applies whenever the resolved registry is Docker Hub, not only when the reference carried no domain, and credential lookup falls back to the legacy hub.docker.com key for an explicit Docker Hub domain as it already did for references without one. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Cover qualifying a Docker Hub image with either registry key The credential test only covered an image without a domain and an image with a Docker Hub domain against credentials stored under the official docker.io key. Parametrize over both Docker Hub domains and both registry keys, so the pull name is asserted for a reference carrying the legacy index.docker.io domain while credentials are stored under hub.docker.com as well. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
122 lines
4.6 KiB
Python
122 lines
4.6 KiB
Python
"""Test Docker utilities."""
|
|
|
|
import pytest
|
|
|
|
from supervisor.docker.const import DOCKER_HUB
|
|
from supervisor.docker.utils import (
|
|
get_registry_from_image,
|
|
is_registry_domain,
|
|
split_docker_domain,
|
|
split_image_tag,
|
|
)
|
|
|
|
|
|
@pytest.mark.parametrize(
|
|
("image_ref", "expected"),
|
|
[
|
|
# No registry, hosted on Docker Hub
|
|
("nginx", (None, "nginx")),
|
|
("nginx:latest", (None, "nginx:latest")),
|
|
("library/nginx", (None, "library/nginx")),
|
|
("homeassistant/amd64-supervisor", (None, "homeassistant/amd64-supervisor")),
|
|
# Registry with a dot
|
|
(
|
|
"ghcr.io/home-assistant/amd64-supervisor",
|
|
("ghcr.io", "home-assistant/amd64-supervisor"),
|
|
),
|
|
("registry.example.com/org/image:v1", ("registry.example.com", "org/image:v1")),
|
|
("127.0.0.1/myimage", ("127.0.0.1", "myimage")),
|
|
# Registry with a port
|
|
("myregistry:5000/myimage", ("myregistry:5000", "myimage")),
|
|
("registry.io:5000/org/app:v1", ("registry.io:5000", "org/app:v1")),
|
|
# localhost is a reserved namespace and always a registry
|
|
("localhost/myimage", ("localhost", "myimage")),
|
|
("localhost:5000/myimage:tag", ("localhost:5000", "myimage:tag")),
|
|
# IPv6 registry
|
|
("[::1]:5000/myimage", ("[::1]:5000", "myimage")),
|
|
("[2001:db8::1]:5000/myimage:tag", ("[2001:db8::1]:5000", "myimage:tag")),
|
|
# Legacy Docker Hub domain gets canonicalized
|
|
("index.docker.io/library/nginx", (DOCKER_HUB, "library/nginx")),
|
|
# Uppercase is not allowed in a path component, so it is a registry
|
|
("Foo/bar", ("Foo", "bar")),
|
|
],
|
|
)
|
|
def test_split_docker_domain(image_ref: str, expected: tuple[str | None, str]):
|
|
"""Test splitting an image reference into registry domain and remainder."""
|
|
assert split_docker_domain(image_ref) == expected
|
|
|
|
|
|
def test_get_registry_from_image():
|
|
"""Test get_registry_from_image returns only the registry domain."""
|
|
assert get_registry_from_image("ghcr.io/home-assistant/supervisor") == "ghcr.io"
|
|
assert get_registry_from_image("homeassistant/supervisor") is None
|
|
assert get_registry_from_image("index.docker.io/library/nginx") == DOCKER_HUB
|
|
|
|
|
|
@pytest.mark.parametrize(
|
|
("domain", "valid"),
|
|
[
|
|
("ghcr.io", True),
|
|
("registry.example.com", True),
|
|
("myregistry:5000", True),
|
|
("localhost", True),
|
|
("localhost:5000", True),
|
|
("127.0.0.1", True),
|
|
("[::1]:5000", True),
|
|
("[2001:db8::1]", True),
|
|
# Malformed domains
|
|
(".ghcr.io", False),
|
|
("ghcr.io.", False),
|
|
("-bad-.com", False),
|
|
("bad-.com", False),
|
|
("....", False),
|
|
("ghcr.io:", False),
|
|
("ghcr.io:port", False),
|
|
("ghcr.io/org", False),
|
|
],
|
|
)
|
|
def test_is_registry_domain(domain: str, valid: bool):
|
|
"""Test validation of registry domains."""
|
|
assert is_registry_domain(domain) is valid
|
|
|
|
|
|
@pytest.mark.parametrize(
|
|
("image_ref", "expected"),
|
|
[
|
|
# No tag
|
|
("nginx", ("nginx", None)),
|
|
("library/nginx", ("library/nginx", None)),
|
|
(
|
|
"ghcr.io/home-assistant/amd64-supervisor",
|
|
("ghcr.io/home-assistant/amd64-supervisor", None),
|
|
),
|
|
# With tag
|
|
("nginx:latest", ("nginx", "latest")),
|
|
(
|
|
"homeassistant/amd64-supervisor:1.2.3",
|
|
("homeassistant/amd64-supervisor", "1.2.3"),
|
|
),
|
|
# Registry with a port, the port must stay part of the image name
|
|
("myregistry:5000/myimage", ("myregistry:5000/myimage", None)),
|
|
("registry.io:5000/org/app:v1", ("registry.io:5000/org/app", "v1")),
|
|
(
|
|
"gitlab.example.com:5005/org/app/aarch64:0.3.3-dev1",
|
|
("gitlab.example.com:5005/org/app/aarch64", "0.3.3-dev1"),
|
|
),
|
|
# localhost with a port
|
|
("localhost:5000/myimage", ("localhost:5000/myimage", None)),
|
|
("localhost:5000/myimage:tag", ("localhost:5000/myimage", "tag")),
|
|
# IPv6 registry
|
|
("[::1]:5000/myimage", ("[::1]:5000/myimage", None)),
|
|
("[2001:db8::1]:5000/myimage:tag", ("[2001:db8::1]:5000/myimage", "tag")),
|
|
# Digests are stripped along with the tag
|
|
("nginx@sha256:1234abcd", ("nginx", None)),
|
|
("ghcr.io/org/app@sha256:1234abcd", ("ghcr.io/org/app", None)),
|
|
# A bare digest keeps its algorithm prefix as the name
|
|
("sha256:1234abcd", ("sha256", "1234abcd")),
|
|
],
|
|
)
|
|
def test_split_image_tag(image_ref: str, expected: tuple[str, str | None]):
|
|
"""Test splitting an image reference into image name and tag."""
|
|
assert split_image_tag(image_ref) == expected
|