Discover the exact image pull references a remote deploy needs, probe which
registries gate them behind credentials, and attach short-lived registry
credentials to the proxied request so remote nodes can pull private images.
- Canonical pull-reference module: parse and normalize exact refs (library/
prefixes, :latest defaults, Docker Hub alias folding), dedupe and sort, with
a 200-ref and 64 KiB list limit surfaced as 413
- Anonymous manifest probe module over the safe transport: classify a registry
as public, challenged, or inconclusive without ever contacting unsafe hosts
- Refusal matrix on the proxy hop: 409 credential-unavailable and
transport-not-confidential, 413 envelope and body limits, 499 aborts, all
with machine-readable codes
- Validate the target's discover response before trusting it: shape check plus
a canonical round-trip of the pull-ref list, and a response size cap
- Contract version on discovery: the request always names it, the target
tolerates requests without one and rejects unsupported versions with 400
- Narrowed proxy delivery result type: every refusal carries status, message,
and code, with no silent fallbacks at the proxy layer
- Hub-side consumers updated to the shared prepare path (fleet, scheduler,
mesh, blueprints, webhooks), and docs plus the frontend capability list
refreshed
Anso
ce8b454600