[PR #230] [MERGED] fix: preserve anonymous OverlayBD credential mode

## 📋 Pull Request Information **Original PR:** https://github.com/kvcache-ai/AgentENV/pull/230 **Author:** [@ranxi2001](https://github.com/ranxi2001) **Created:** 8/29/2026 **Status:** ✅ Merged **Merged:** 8/31/2026 **Merged by:** [@yingdi-shan](https://github.com/yingdi-shan) **Base:** `main` ← **Head:** `fix/anonymous-overlaybd-credentials` --- ### 📝 Commits (1) - [`e07bbde`](https://github.com/kvcache-ai/AgentENV/commit/e07bbde3e55dad4d8dc5510cf0ab6a6f14285813) fix: preserve anonymous OverlayBD credential mode ### 📊 Changes **1 file changed** (+87 additions, -14 deletions) <details> <summary>View changed files</summary> 📝 `src/setup/deps.rs` (+87 -14) </details> ### 📄 Description ## What Generated OverlayBD global configs now keep the legacy `credentialFilePath` aligned with the modern `credentialConfig.path` for both anonymous and file-backed registry access. ## Why When no Docker credential file is detected, AgentENV writes an explicit empty `credentialConfig` but previously omitted `credentialFilePath`. `GlobalConfig::default()` then supplied `/opt/overlaybd/cred.json`, allowing compatibility normalization to restore `file` mode and making public OverlayBD-native images fail on a nonexistent credential file. ## Related issue Closes #128 ## Scope and non-goals The change is limited to AgentENV-generated OverlayBD configuration and its tests. It does not change `GlobalConfig` defaults, legacy compatibility fallback behavior, registry token negotiation, or credential storage. ## Design and behavior changes Both credential representations now derive from the same detected Docker credential path: - no credential file: both paths remain empty and anonymous mode survives reload; - credential file present: both paths contain the same file and modern `file` mode remains effective. Regression coverage checks both mappings and reloads the generated rootfs, memory, conversion, and resize configs to verify their effective credential mode and path. ## Compatibility and operations - Public API or generated protocol: N/A; no API or schema changes. - Configuration or defaults: generated JSON adds the legacy `credentialFilePath`, matching `credentialConfig.path`. Without a detected Docker credential file, both paths are explicitly empty. - Snapshot manifest, artifact layout, or storage format: N/A. - Upgrade and rollback: deployments that relied on the omitted field implicitly selecting `/opt/overlaybd/cred.json` will now use anonymous registry access unless that credential is exposed through a detected Docker config; rollback removes the added legacy field. - Host requirements, permissions, ports, or dependencies: unchanged. ## Validation - [x] `make fmt` - [ ] `make clippy` - [ ] `make test-unit` - [ ] Relevant Rust integration tests - [ ] `make -C services test` (required when `services/` changes) - [ ] Generated clients/server regenerated with the documented `make` target - [ ] Documentation updated - [ ] Benchmarks or performance comparison completed Commands and results: ```text cargo fmt --all -- --check PASS cargo test -p agentenv --features vendored-openssl --lib PASS: 781 passed, 4 ignored cargo clippy -p agentenv --lib --tests --features vendored-openssl -- -D warnings PASS git diff --check PASS ``` Skipped checks and reasons: - `make test-unit`: its capability and ublk tiers require host support unavailable on the local WSL kernel; the non-privileged `agentenv --lib` suite passed. - Rust integration, KVM, ublk, and runtime E2E: require the upstream privileged CI environment. - Services, generated API, docs, and benchmarks: unaffected by this one-file configuration fix. ## Risks and reviewer notes The main compatibility risk is private-registry behavior. A generated config without a detected Docker credential now explicitly disables the legacy `/opt/overlaybd/cred.json` fallback, matching its existing empty modern config. The file-backed case is covered by asserting that modern and legacy paths remain identical; global legacy fallback semantics for other configs are unchanged. The repository's current E2E suite does not contain an anonymous public OverlayBD-native image scenario, so the deterministic generate-and-reload regression is the direct counterexample coverage for this bug. ## Checklist - [x] The PR contains one coherent change and no unrelated formatting or refactoring. - [x] New behavior is covered by tests, or I explained why testing is impractical. - [x] Logs and examples contain no credentials, tokens, or private registry information. - [x] I did not manually edit generated code without updating its source and regenerating it. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi commented

2026-10-29 14:21:40 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/kvcache-ai/AgentENV/pull/230
Author: @ranxi2001
Created: 8/29/2026
Status: ✅ Merged
Merged: 8/31/2026
Merged by: @yingdi-shan

Base: main ← Head: fix/anonymous-overlaybd-credentials

📝 Commits (1)

e07bbde fix: preserve anonymous OverlayBD credential mode

📊 Changes

1 file changed (+87 additions, -14 deletions)

View changed files

📝 src/setup/deps.rs (+87 -14)

📄 Description

What

Generated OverlayBD global configs now keep the legacy credentialFilePath aligned with the modern credentialConfig.path for both anonymous and file-backed registry access.

Why

When no Docker credential file is detected, AgentENV writes an explicit empty credentialConfig but previously omitted credentialFilePath. GlobalConfig::default() then supplied /opt/overlaybd/cred.json, allowing compatibility normalization to restore file mode and making public OverlayBD-native images fail on a nonexistent credential file.

Closes #128

Scope and non-goals

The change is limited to AgentENV-generated OverlayBD configuration and its tests. It does not change GlobalConfig defaults, legacy compatibility fallback behavior, registry token negotiation, or credential storage.

Design and behavior changes

Both credential representations now derive from the same detected Docker credential path:

no credential file: both paths remain empty and anonymous mode survives reload;
credential file present: both paths contain the same file and modern file mode remains effective.

Regression coverage checks both mappings and reloads the generated rootfs, memory, conversion, and resize configs to verify their effective credential mode and path.

Compatibility and operations

Public API or generated protocol: N/A; no API or schema changes.
Configuration or defaults: generated JSON adds the legacy credentialFilePath, matching credentialConfig.path. Without a detected Docker credential file, both paths are explicitly empty.
Snapshot manifest, artifact layout, or storage format: N/A.
Upgrade and rollback: deployments that relied on the omitted field implicitly selecting /opt/overlaybd/cred.json will now use anonymous registry access unless that credential is exposed through a detected Docker config; rollback removes the added legacy field.
Host requirements, permissions, ports, or dependencies: unchanged.

Validation

make fmt
make clippy
make test-unit
Relevant Rust integration tests
make -C services test (required when services/ changes)
Generated clients/server regenerated with the documented make target
Documentation updated
Benchmarks or performance comparison completed

Commands and results:

cargo fmt --all -- --check
PASS

cargo test -p agentenv --features vendored-openssl --lib
PASS: 781 passed, 4 ignored

cargo clippy -p agentenv --lib --tests --features vendored-openssl -- -D warnings
PASS

git diff --check
PASS

Skipped checks and reasons:

make test-unit: its capability and ublk tiers require host support unavailable on the local WSL kernel; the non-privileged agentenv --lib suite passed.
Rust integration, KVM, ublk, and runtime E2E: require the upstream privileged CI environment.
Services, generated API, docs, and benchmarks: unaffected by this one-file configuration fix.

Risks and reviewer notes

The main compatibility risk is private-registry behavior. A generated config without a detected Docker credential now explicitly disables the legacy /opt/overlaybd/cred.json fallback, matching its existing empty modern config. The file-backed case is covered by asserting that modern and legacy paths remain identical; global legacy fallback semantics for other configs are unchanged.

The repository's current E2E suite does not contain an anonymous public OverlayBD-native image scenario, so the deterministic generate-and-reload regression is the direct counterexample coverage for this bug.

Checklist

The PR contains one coherent change and no unrelated formatting or refactoring.
New behavior is covered by tests, or I explained why testing is impractical.
Logs and examples contain no credentials, tokens, or private registry information.
I did not manually edit generated code without updating its source and regenerating it.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

bsakaguchi

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-10-29 14:22:01 +00:00

[PR #271] [MERGED] perf: enable sha2 asm feature for hardware SHA-256 acceleration #307

Rows
Columns

[PR #230] [MERGED] fix: preserve anonymous OverlayBD credential mode #271