Repository navigation
feat(preflight): diagnose an unreachable registry before installing - #113
Merged
Merged
Conversation
When preflight-image cannot resolve an image, or cannot verify its signature, the failure said nothing about whether the registry could be reached. Probe the registry's /v2/ endpoint (through the environment's proxy settings) after such a failure and report network_unreachable when there is no route to a server, keeping the original error attached. The probe is evidence, not a gate: TLS trust and plain-HTTP failures count as a server answering so they keep their original code, caller cancellation is never reported as a network failure, and the message does not claim the machine is offline, since one endpoint failing cannot show that. A nil probe disables it.
Codecov Report❌ Patch coverage is 📢 Thoughts on this report? Let us know! |
bketelsen
reviewed
Oct 7, 2026
bketelsen
left a comment
bketelsen
left a comment
Contributor
There was a problem hiding this comment.
Reviewed with Claude Code. The overall shape is solid: the probe is supplemental, cancellation doesn't count as a network failure, and cached installs still work offline. Most comments are about the probe overriding evidence the original error already carries, and about classification gaps that produce a false network_unreachable. The PR's own tests pass locally, including under -race.
Review found the registry probe could turn unrelated failures into a reachability verdict. Classify positively instead: only DNS/dial failures, timeouts, and proxy 502/503/504 count, so a proxy 407, TLS alerts, registry responses, cosign verdicts and unmarked errors keep their original code. Split the code: registry_unreachable names the endpoint and says the network or registry may be responsible; network_unreachable is used only when the attempt failed on a machine with no routable address. The interface check now runs after the attempt, so it can word a failure but never block a route that works. Also fix the probed host for transport-prefixed, host:port and Docker Hub refs, and wire-check the probe in install and the TUI.
bketelsen
approved these changes
Oct 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #105.
Summary
preflight-imagefails to resolve an image or verify its signature with a failure that positively looks like connectivity (DNS, dial, timeout), probe the registry's HTTPS/v2/endpoint (honoring proxy env). If there is no route to a server, fail with the new stable coderegistry_unreachable, naming the registry and keeping the original skopeo/cosign error. If the attempt failed on a machine with no routable address, the code isnetwork_unreachableinstead.manifest unknown,unauthorized, ...), cosign verdicts, and errors with no connectivity marker. Cached images still install offline; cancellation is never a network verdict. Both new codes take precedence overimage_verification_failed.pipeline.Env.RegistryProbe; nil disables probing, so existing fake-runner tests never touch the network.installand the TUI wire the real probe (tested).progress-protocol.md(two new codes),recipe-schema.md(cosign_pub_keyrow),architecture.md(Preflight). No ADR: narrowly scoped diagnostics, no policy change.Known limits
registries.confmirrors and plain-HTTP registries aren't probed; those cases keep the original code.Test plan
make check