fix(docker-env): retire stale tecnativa wording from the proxy error and Compose comment - #97
Merged
Conversation
…and Compose comment The non-200 detail in docker_proxy.list_images() advised checking that the proxy is "read-only with IMAGES=1" — a tecnativa env var that has not existed since the wollomatic migration (#89), printed in exactly the 403 case the README teaches operators to diagnose. It now names the real causes: a non-allowlisted path (-allowGET permits only /images/json and /v1.NN/images/json), a non-GET method, or the -allowfrom source check rejecting a non-scrye client, with the note that the proxy's log distinguishes them, and a pointer to the README rather than a restatement of it. The docker-compose.yml DOCKER_GID comment called 999 "the Debian/Ubuntu default"; it now matches the README's corrected wording (a placeholder, not a safe default; 989 on the host this was verified against) and describes the wrong-GID failure as the crash loop it actually is. The stat -c '%g' derivation remains the instruction and the ${DOCKER_GID:-999} value is unchanged. Adds a regression test driving the 403 path through httpx.MockTransport. No existing test asserted on the old string. See docs/ARCHIVE.md § Deviations for the dated entry retiring both follow-ups.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Clears the two follow-ups the 2026-07-26 socket-proxy entry deferred as out of its docs-only scope.
What changed
backend/app/core/docker_proxy.py— the non-200 error detail advised checking that the proxy is "read-only withIMAGES=1". That is a tecnativa env var that has not existed in this stack since the wollomatic migration (#89), and it prints in exactly the 403 case the README now teaches operators to diagnose — so it was pointing them at a knob that isn't there. It now names the real causes: a non-allowlisted path (-allowGETpermits only/images/jsonand/v1.NN/images/json), a non-GET method (405), or the-allowfromsource check rejecting a client that isn't thescryecontainer — with the note that the proxy's own log distinguishes them (blocked request … forbidden IP), and a pointer to the README's § Optional sidecars rather than a restatement of it. It stays an error detail, not documentation.docker/docker-compose.yml— theDOCKER_GIDcomment called999"the Debian/Ubuntu default … used here as a fallback only," the wording the README corrected when the live run measured989. It now matches the README:999is a placeholder, not a safe default;989on the host this was last verified against;stat -c '%g' /var/run/docker.sockremains the instruction. The adjacent failure-mode sentence ("logs a socket permission error on start") was corrected in the same comment for the same reason the README's was — the real behavior is a crash loop underrestart: unless-stopped(STATUSRestarting, neverExited).backend/tests/test_docker_proxy.py— new regression guard: driveslist_images()through anhttpx.MockTransportreturning 403 and asserts the message carries-allowGET,-allowfrom, andforbidden IPand does not carryIMAGES=1. No existing test asserted on the old string, so nothing needed updating.Not changed
The
-allowGETpattern, the proxy's option set, and the${DOCKER_GID:-999}value itself are untouched. No schema, API-contract, security-model, job-model, or auth change. NoCHANGELOG.mdentry — the Unreleaseddocker-envaction-required note already carries the corrected999/989guidance and the crash-loop description.See
docs/ARCHIVE.md§ Deviations for the dated entry retiring both deferred items.Verification
Backend
ruff+black --checkclean; fullpytestsuite green (580 passed, 3 skipped).