OpenShell

mirror of https://github.com/NVIDIA/OpenShell.git synced 2026-10-17 05:31:16 +08:00

Files

T

History

Drew Newberry 4dd6ed9e6a feat(bootstrap): fall back to anonymous pull when registry credentials are rejected

When pulling container images from ghcr.io, credentials are always
sent. If the token lacks access to a specific repo (e.g., a public
repo the caller's PAT cannot read), the pull fails with a 401/403
even though an unauthenticated pull would succeed.

Add fallback logic across all three pull paths:

- ensure_image() (local Docker daemon): detect auth failure from the
  pull stream and retry with no credentials.
- pull_remote_image() (remote SSH daemon): same pattern using the new
  consume_pull_stream() helper.
- cluster-entrypoint.sh (k3s/containerd): validate credentials via
  the GHCR token endpoint before writing auth config to
  registries.yaml; skip auth block when credentials are rejected so
  containerd uses anonymous pulls.

Also adds is_auth_failure() helper that matches 401/403 status codes
and common Docker error messages (pull access denied, unauthorized,
denied: access forbidden), curl to the cluster runtime image for the
credential test, and updated error diagnosis messaging.

2026-03-15 23:32:39 -07:00

.dockerignore

chore: cleanup docker/kube/helm infra

2026-02-04 23:00:17 -08:00

cluster-entrypoint.sh

feat(bootstrap): fall back to anonymous pull when registry credentials are rejected

2026-03-15 23:32:39 -07:00

cluster-healthcheck.sh

fix(bootstrap): detect missing sandbox supervisor binary during gateway health check (#281 )

2026-03-13 15:07:50 -07:00

cross-build.sh

feat(ci): add CLI binary builds and snapshot release to publish workflow (#110 )