SS-1076 improve image pull error #368

churnikov · 2025-07-10T15:00:17Z

Link to related charts pull request ScilifelabDataCentre/serve-charts#101
TODO:

Improve documentation of the introduced functions
Add documentation on confluence, that describes how this validation work
https://scilifelab.atlassian.net/wiki/spaces/AIportal/pages/3697836225/On+pulling+users+images+on+serve#Validating-incoming-images

This pull request introduces a feature to validate Docker image architectures for both Docker Hub and GitHub Container Registry (GHCR). The changes include adding new utility functions, validators, and settings to ensure Docker images are built for the correct CPU architecture (amd64). It also integrates a feature flag to toggle this validation.

Docker image architecture validation:

Added a new feature to validate Docker image architectures (amd64) in validate_ghcr_image and validate_docker_image functions. This validation is controlled by the docker_image_architecture_validator feature flag using the waffle library. [1] [2]

New utilities for Docker and GHCR integration:

Introduced DockerHubAuthenticator and GHCRAuthenticator classes for handling authentication with Docker Hub and GHCR, respectively. These classes retrieve Bearer tokens for API requests.
Added utility functions like get_manifest_list, get_config_blob, and get_image_architecture to fetch and parse image manifests and configurations to determine supported architectures.

Configuration updates:

Added new environment variables (DOCKER_HUB_TOKEN, DOCKER_HUB_USERNAME, GITHUB_API_USERNAME) to studio/settings.py for authentication with Docker Hub and GHCR.

Checklist

If you're unsure about any of the items below, don't hesitate to ask. We're here to help!
This is simply a reminder of what we are going to look for before merging your code.

This pull request is against develop branch (not applicable for hotfixes)
I have included a link to the issue on GitHub or JIRA (if any)
I have included migration files (if there are changes to the model classes)
I have included, reviewed and executed tests (unit and end2end) to complement my changes
I have updated the related documentation (if necessary)
I have added a reviewer for this pull request
I have added myself as an author for this pull request
In the case I have modified settings.py, then I have also updated the studio-settings-configmap.yaml file in serve-charts

Further comments

Anything else you think we should know before merging your code!

Wrapp image validation with django waffle Signed-off-by: Nikita Churikov <[email protected]>

Copilot

Pull Request Overview

Adds validation of Docker image CPU architectures and supporting utilities.

Introduces DockerHubAuthenticator and GHCRAuthenticator for registry token retrieval.
Implements get_manifest_list, get_config_blob, and get_image_architecture to fetch and parse image architectures.
Integrates a docker_image_architecture_validator waffle switch into validate_ghcr_image and validate_docker_image to enforce amd64 images.

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
studio/settings.py	Added new env vars for Docker Hub and GHCR authentication
apps/validators/container_images.py	New registry auth classes and manifest/config-fetching utilities
apps/helpers.py	Wired image-architecture checks behind feature flag in validators

Comments suppressed due to low confidence (1)

apps/validators/container_images.py:135

[nitpick] The parameter name refence is misspelled; consider renaming it to reference for clarity and consistency.

def get_image_architecture(

studio/settings.py

apps/validators/container_images.py

Copilot · 2025-07-10T15:01:52Z

apps/validators/container_images.py

+    else:
+        logger.error("Unknown or unsupported manifest format!")
+
+    return architectures


get_image_architecture can return None on unsupported manifests, but callers assume a list. Ensure it always returns a list (possibly empty) or raise an exception to prevent runtime errors.

Suggested change

return architectures

return architectures or []

- Improved documentation for authentication classes and methods. - Added support for anonymous access in DockerHubAuthenticator (Mostly for GHCR). - Renamed `get_image_architecture` to `get_image_architectures` for clarity. - Introduced tests for GHCR and Docker Hub architecture validation. Signed-off-by: Nikita Churikov <[email protected]>

Co-authored-by: Copilot <[email protected]>

… into SS-1076-improve-image-pull-error

j-awada · 2025-07-11T11:35:24Z

@churnikov did you choose to create the flag manually? Here's where the Depictio one gets created.
But in general image arch verification sounds more like a switch than a feature flag.

churnikov · 2025-07-11T13:28:11Z

@j-awada

But in general image arch verification sounds more like a switch than a feature flag.

My bad, I named it in commit messages feature flag, while it's already a switch. Good point thought, thank you:)

churnikov · 2025-07-11T13:28:58Z

Here's where the Depictio one gets created.

Thanks, good idea, will do that!

Signed-off-by: Nikita Churikov <[email protected]>

j-awada

Did not run this locally but LGTM.

apps/validators/container_images.py

j-awada · 2025-07-17T13:33:33Z

apps/validators/container_images.py

+
+
+def get_image_architectures(
+    *, auth: BaseRegistryAuth, repo: str, refence: str, registry: str = "registry-1.docker.io"


is refence missing the r on purpose? haha

j-awada · 2025-07-17T13:45:36Z

studio/settings.py

Do we also need to update .env.template to include those variables there?

True, will do that:)

Co-authored-by: Jana Awada <[email protected]>

…env.template for Docker Hub credentials Signed-off-by: Nikita Churikov <[email protected]>

churnikov and others added 4 commits July 3, 2025 15:01

WIP architecture image pull code

e128893

Validate remote images

55740f1

Enhance image pull error handling and update architecture validation

e3e3fa8

Wrapp image validation with django waffle Signed-off-by: Nikita Churikov <[email protected]>

Merge branch 'refs/heads/develop' into SS-1076-improve-image-pull-error

1bec413

churnikov self-assigned this Jul 10, 2025

churnikov requested a review from a team as a code owner July 10, 2025 15:00

churnikov added the enhancement Improvement of existing feature or request label Jul 10, 2025

churnikov requested review from Copilot and a team and removed request for a team July 10, 2025 15:00

Copilot AI reviewed Jul 10, 2025

View reviewed changes

churnikov marked this pull request as draft July 10, 2025 15:03

churnikov and others added 3 commits July 11, 2025 12:52

Apply suggestions from code review

95886da

Co-authored-by: Copilot <[email protected]>

Merge remote-tracking branch 'origin/SS-1076-improve-image-pull-error'…

589cda4

… into SS-1076-improve-image-pull-error

churnikov marked this pull request as ready for review July 11, 2025 11:03

Disable docker image architecture validator in waffle switches

603ad54

Signed-off-by: Nikita Churikov <[email protected]>

j-awada approved these changes Jul 17, 2025

View reviewed changes

churnikov and others added 3 commits July 17, 2025 18:47

Apply suggestions from code review

3ae56ba

Co-authored-by: Jana Awada <[email protected]>

Fix parameter name typos in image architecture functions and update .…

c81cbb8

…env.template for Docker Hub credentials Signed-off-by: Nikita Churikov <[email protected]>

Merge branch 'develop' into SS-1076-improve-image-pull-error

d5d5135

churnikov merged commit 8b8f141 into develop Jul 17, 2025
2 checks passed

churnikov deleted the SS-1076-improve-image-pull-error branch July 17, 2025 18:50

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

SS-1076 improve image pull error #368

SS-1076 improve image pull error #368

Uh oh!

churnikov commented Jul 10, 2025 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI Jul 10, 2025

Uh oh!

j-awada commented Jul 11, 2025 •

edited

Loading

Uh oh!

churnikov commented Jul 11, 2025

Uh oh!

churnikov commented Jul 11, 2025

Uh oh!

j-awada left a comment

Uh oh!

Uh oh!

Uh oh!

j-awada Jul 17, 2025

Uh oh!

churnikov Jul 17, 2025

Uh oh!

j-awada Jul 17, 2025

Uh oh!

churnikov Jul 17, 2025

Uh oh!

Uh oh!

Uh oh!



		def get_image_architectures(
		*, auth: BaseRegistryAuth, repo: str, refence: str, registry: str = "registry-1.docker.io"

SS-1076 improve image pull error #368

SS-1076 improve image pull error #368

Uh oh!

Conversation

churnikov commented Jul 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Docker image architecture validation:

New utilities for Docker and GHCR integration:

Configuration updates:

Checklist

Further comments

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Copilot AI Jul 10, 2025

Choose a reason for hiding this comment

Uh oh!

j-awada commented Jul 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

churnikov commented Jul 11, 2025

Uh oh!

churnikov commented Jul 11, 2025

Uh oh!

j-awada left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

j-awada Jul 17, 2025

Choose a reason for hiding this comment

Uh oh!

churnikov Jul 17, 2025

Choose a reason for hiding this comment

Uh oh!

j-awada Jul 17, 2025

Choose a reason for hiding this comment

Uh oh!

churnikov Jul 17, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

churnikov commented Jul 10, 2025 •

edited

Loading

j-awada commented Jul 11, 2025 •

edited

Loading