Balaji Ganesan 9152b6e4a1 fix(vm): boot a digest-pinned image from the cache without a registry call (#4582) ...

A registry-sourced sandbox boot authenticated with the registry, and for a
tag resolved the manifest, before it looked at the root disk cache. It did
so on every boot, even when the image reference carries a digest and the
root disk for that digest is already cached. Each boot then waits on the
registry, and a registry outage stops every boot of an image the host
already has.

A digest names the image's content, and since #4342 a cached root disk is
published only after its manifest was verified against that digest. On a
cache hit for a digest-pinned reference the registry cannot add anything,
so return the hit before authenticating. Authentication and the pull stay
on the miss path, and a tag still resolves through the registry. The hit
emits the same Pulling, CacheHit and Pulled events as before.

Behaviour change: a host whose registry credentials were revoked still
boots digest-pinned images it has already cached, as a kubelet does with
IfNotPresent and a digest-pinned image.

Test: bootstrap_registry_cache_hit_for_a_digest_pin_makes_no_registry_request
covers a miss (authenticates and fetches), a cached digest pin (no request
at all) and a tag for the same content (still resolved). It fails without
this change with ["GET /v2/"].

Closes #4581

Signed-off-by: Balaji Ganesan <bganesan@nvidia.com>

2026-10-22 17:36:05 +00:00

..

bin

refactor(runtime): confine and reduce unsafe code (#4130)

2026-10-10 01:12:03 +00:00

extensions

feat(vm): add vm life cycle extensions (#1583)

2026-06-08 11:45:35 -07:00

isolation

feat(sandbox): initiate supervisor connections across compute drivers (#4656)

2026-10-20 18:25:45 +00:00

allocation_tracking.rs

refactor(runtime): confine and reduce unsafe code (#4130)

2026-10-10 01:12:03 +00:00

driver.rs

fix(vm): boot a digest-pinned image from the cache without a registry call (#4582)

2026-10-22 17:36:05 +00:00

embedded_runtime.rs

feat(isolation): implement the RFC 0012 sandbox architecture (#2942)

2026-09-16 00:49:14 +00:00

ffi.rs

feat(vm): add host bind mount support via virtiofs (libkrun) (#3463)

2026-10-16 07:56:32 +00:00

gpu.rs

feat(isolation): implement the RFC 0012 sandbox architecture (#2942)

2026-09-16 00:49:14 +00:00

layer_applier.rs

fix(vm): confine OCI layer application to the rootfs (#3550)

2026-09-24 17:22:46 +00:00

lib.rs

feat(vm): add host bind mount support via virtiofs (libkrun) (#3463)

2026-10-16 07:56:32 +00:00

lifecycle.rs

fix(drivers): normalize label namespace (#3609)

2026-09-23 14:30:27 +00:00

main.rs

feat(sandbox): initiate supervisor connections across compute drivers (#4656)

2026-10-20 18:25:45 +00:00

otel_tracing.rs

refactor(otel): unify compute driver tracing (#2995)

2026-09-03 15:26:14 +00:00

preparation.rs

refactor(crypto): introduce a generic interface for crypto libraries and refactor AWS-LC (#3351)

2026-10-19 19:09:49 +00:00

procguard.rs

feat(isolation): implement the RFC 0012 sandbox architecture (#2942)

2026-09-16 00:49:14 +00:00

registry_cache_tests.rs

fix(vm): boot a digest-pinned image from the cache without a registry call (#4582)

2026-10-22 17:36:05 +00:00

rootfs.rs

fix(vm): populate an empty guest /etc/hosts with loopback names (#4182)

2026-10-20 22:46:00 +00:00

runtime.rs

feat(sandbox): initiate supervisor connections across compute drivers (#4656)

2026-10-20 18:25:45 +00:00