[PR #385] [MERGED] feat: add fromImageRegistry field to TemplateBuildStartV2

## 📋 Pull Request Information **Original PR:** https://github.com/kvcache-ai/AgentENV/pull/385 **Author:** [@zlzGithub-0801](https://github.com/zlzGithub-0801) **Created:** 10/15/2026 **Status:** ✅ Merged **Merged:** 10/20/2026 **Merged by:** [@yingdi-shan](https://github.com/yingdi-shan) **Base:** `main` ← **Head:** `feat/from-image-registry` --- ### 📝 Commits (1) - [`469a9c0`](https://github.com/kvcache-ai/AgentENV/commit/469a9c0683364ab24121e273436689a79c48aba7) feat: add fromImageRegistry field to TemplateBuildStartV2 ### 📊 Changes **10 files changed** (+1257 additions, -48 deletions) <details> <summary>View changed files</summary> 📝 `Cargo.lock` (+1 -0) 📝 `Cargo.toml` (+1 -0) 📝 `adev/src/codegen.rs` (+28 -0) 📝 `src/api/generated/src/models.rs` (+647 -0) 📝 `src/api/impls/template.rs` (+17 -8) 📝 `src/api/impls/template_helpers.rs` (+90 -1) 📝 `src/api/openapi.yml` (+69 -0) 📝 `src/image/oci_image.rs` (+248 -6) 📝 `src/image/resolver.rs` (+135 -16) 📝 `src/snapshot/image_export/regctl.rs` (+21 -17) </details> ### 📄 Description ## What Add `fromImageRegistry` support to template builds for pulling private OCI images, including username/password, AWS ECR, and GCP credentials. ## Why Allow users to build templates from private images without configuring registry credentials on the AgentENV server. ## Related issue NA ## Scope and non-goals Support registry authentication for standard OCI images. Reject authenticated builds using native OverlayBD images or OverlayBD referrers. ## Design and behavior changes 1. Add the `fromImageRegistry` field to `TemplateBuildStartV2`. 2. Parse credentials at the template build API entry point and fetch the manifest during the asynchronous build. If the selected image is OverlayBD, fail the build. 3. For standard OCI images, continue fetching metadata and layers. Write registry credentials to a temporary regctl configuration file and pass its path through the child process’s `REGCTL_CONFIG` environment variable. Remove the file when resolution finishes. ## Compatibility and operations - Public API or generated protocol: Adds an optional field; regenerated server models. - Configuration or defaults: NA - Snapshot manifest, artifact layout, or storage format: NA - Upgrade and rollback: NA - Host requirements, permissions, ports, or dependencies: Adds `reqsign` for AWS request signing. ## Validation  - [x] `make fmt` - [x] `make clippy` - [x] `make test-unit` - [x] Relevant Rust integration tests - [ ] `make -C services test` (required when `services/` changes) - [x] Generated clients/server regenerated with the documented `make` target - [ ] Documentation updated - [ ] Benchmarks or performance comparison completed Commands and results: ```text ``` Skipped checks and reasons: ## Risks and reviewer notes - Credentials temporarily reside in a permission-restricted file. Normal cleanup removes it; abrupt process termination may leave it behind. - Default regctl TLS, mirror, and other custom settings are not inherited when explicit credentials are supplied. - OverlayBD rejection is reported through asynchronous build status, including when the image is cached. ## Checklist - [x] The PR contains one coherent change and no unrelated formatting or refactoring. - [x] New behavior is covered by tests, or I explained why testing is impractical. - [x] Logs and examples contain no credentials, tokens, or private registry information. - [x] I did not manually edit generated code without updating its source and regenerating it. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi commented

2026-10-29 14:22:56 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/kvcache-ai/AgentENV/pull/385
Author: @zlzGithub-0801
Created: 10/15/2026
Status: ✅ Merged
Merged: 10/20/2026
Merged by: @yingdi-shan

Base: main ← Head: feat/from-image-registry

📝 Commits (1)

469a9c0 feat: add fromImageRegistry field to TemplateBuildStartV2

📊 Changes

10 files changed (+1257 additions, -48 deletions)

View changed files

📝 Cargo.lock (+1 -0)
📝 Cargo.toml (+1 -0)
📝 adev/src/codegen.rs (+28 -0)
📝 src/api/generated/src/models.rs (+647 -0)
📝 src/api/impls/template.rs (+17 -8)
📝 src/api/impls/template_helpers.rs (+90 -1)
📝 src/api/openapi.yml (+69 -0)
📝 src/image/oci_image.rs (+248 -6)
📝 src/image/resolver.rs (+135 -16)
📝 src/snapshot/image_export/regctl.rs (+21 -17)

📄 Description

What

Add fromImageRegistry support to template builds for pulling private OCI images, including username/password, AWS ECR, and GCP credentials.

Why

Allow users to build templates from private images without configuring registry credentials on the AgentENV server.

Scope and non-goals

Support registry authentication for standard OCI images. Reject authenticated builds using native OverlayBD images or OverlayBD referrers.

Design and behavior changes

Add the fromImageRegistry field to TemplateBuildStartV2.
Parse credentials at the template build API entry point and fetch the manifest during the asynchronous build. If the selected image is OverlayBD, fail the build.
For standard OCI images, continue fetching metadata and layers. Write registry credentials to a temporary regctl configuration file and pass its path through the child process’s REGCTL_CONFIG environment variable. Remove the file when resolution finishes.

Compatibility and operations

Public API or generated protocol: Adds an optional field; regenerated server models.
Configuration or defaults: NA
Snapshot manifest, artifact layout, or storage format: NA
Upgrade and rollback: NA
Host requirements, permissions, ports, or dependencies: Adds reqsign for AWS request signing.

Validation

make fmt
make clippy
make test-unit
Relevant Rust integration tests
make -C services test (required when services/ changes)
Generated clients/server regenerated with the documented make target
Documentation updated
Benchmarks or performance comparison completed

Commands and results:

Skipped checks and reasons:

Risks and reviewer notes

Credentials temporarily reside in a permission-restricted file. Normal cleanup removes it; abrupt process termination may leave it behind.
Default regctl TLS, mirror, and other custom settings are not inherited when explicit credentials are supplied.
OverlayBD rejection is reported through asynchronous build status, including when the image is cached.

Checklist

The PR contains one coherent change and no unrelated formatting or refactoring.
New behavior is covered by tests, or I explained why testing is impractical.
Logs and examples contain no credentials, tokens, or private registry information.
I did not manually edit generated code without updating its source and regenerating it.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

bsakaguchi

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-10-29 14:23:00 +00:00

[PR #393] [MERGED] fix(gateway): size reverse proxy idle connection pools for node fan-out #400

Rows
Columns

[PR #385] [MERGED] feat: add fromImageRegistry field to TemplateBuildStartV2 #393