Repository navigation
Hide infrastructure images by repository, not exact reference - #2092
Open
devops-thiago wants to merge 1 commit into
Open
devops-thiago wants to merge 1 commit into
devops-thiago wants to merge 1 commit into
Conversation
devops-thiago
force-pushed
the
infra-images-by-repository
branch
2 times, most recently
from
September 6, 2026 15:40
7c1a70d to
5fba4c0
Compare
devops-thiago
force-pushed
the
infra-images-by-repository
branch
from
September 14, 2026 10:46
5fba4c0 to
d06bd91
Compare
3 of 7 tasks
devops-thiago
force-pushed
the
infra-images-by-repository
branch
from
September 21, 2026 15:20
d06bd91 to
e4bd359
Compare
devops-thiago
force-pushed
the
infra-images-by-repository
branch
2 times, most recently
from
October 1, 2026 16:26
9cdc15a to
d396219
Compare
This was referenced Oct 1, 2026
Code Coverage
|
Author
|
@dkovba thank you for approving the workflows. CI passes on this PR and it still merges cleanly into main. Is it good to merge as it is, or is there anything else you need from me? |
The infra filter compared full references, so it only recognized the vminit and builder images at the version this build would pull. The vminit left behind by the previous engine version — same repository, older tag — surfaced in every image list after an upgrade, looking like something the user pulled and forgot. Nobody pulls an init or builder image on purpose. Any tag of a configured infrastructure repository is infrastructure, so the filter now also matches on the reference with its tag or digest removed. The tag colon is found after the last path separator rather than the first colon, because a registry with a port (registry.local:5000/repo) would otherwise be truncated at the port. Found by an integration test asserting vminit is never visible, against a store that still held vminit:0.35.0 beside a 0.40.1 engine — which is exactly the state every user's store will be in after their first app update.
devops-thiago
force-pushed
the
infra-images-by-repository
branch
from
October 14, 2026 21:01
d396219 to
ca58988
Compare
Author
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Type of Change
Motivation and Context
Fixes #2088.
Utility.isInfraImagecompares full references, so it only recognizes the vminit and builder images at the exact version the running build would pull. After an upgrade that bumps the containerization dependency, the previous version's vminit, with the same repository and an older tag, shows up incontainer image lsas if the user had pulled it.Nobody pulls an init or builder image on purpose, so any tag of a configured infrastructure repository is infrastructure. The filter keeps the exact-reference match and also compares the reference with its tag or digest removed. The tag colon is found after the last path separator, so a registry with a port (
registry.local:5000/repo) is not cut at the port, and@digestsuffixes are stripped first.Testing
UtilityTestshas new cases for another tag of the same repository, a digest reference, the registry-port case and user images that only share a name suffix. On the current code the other-tag, digest and registry-port cases fail, for exampleisInfraImage(name: "ghcr.io/apple/containerization/vminit:0.9.0", ...)returns false. With this change they pass, and the full suite passes.I also ran a debug build of this branch against a 1.5.0 daemon after pulling
ghcr.io/apple/containerization/vminit:0.45.0.container image liston the 1.5.0 release and on main shows that image next toalpine. With this branch onlyalpineis listed.