feat: expose runtime image digest overrides for private registries - #2347
Open
acherifi wants to merge 1 commit into
Open
feat: expose runtime image digest overrides for private registries#2347acherifi wants to merge 1 commit into
acherifi wants to merge 1 commit into
Conversation
Complete the private-registry story started in kagent-dev#2242: regular declarative agents already reference runtime images by tag, but sandbox agents and the Substrate acp-sandbox workload images remain digest-pinned (Substrate admission rejects tag refs), using digests baked into the controller binary at link time. Mirrors that re-assign manifest digests (e.g. registries that re-push rather than proxy) therefore cannot serve those images (kagent-dev#2055). - Add --acp-sandbox-openclaw-image-digest / --acp-sandbox-hermes-image-digest controller flags (env ACP_SANDBOX_OPENCLAW_IMAGE_DIGEST / ACP_SANDBOX_HERMES_IMAGE_DIGEST) to override the link-time acp-sandbox workload image digests, mirroring the runtime digest flags from kagent-dev#2242. - Point the missing-digest error at the new flags. - Plumb all six digest overrides through the Helm chart: controller.agentImage.digest/fullDigest, controller.goAgentImage.digest/ fullDigest, and controller.acpSandboxImages.openclawDigest/hermesDigest, emitted into the controller ConfigMap only when set. Defaults are unchanged: with no overrides set, the ConfigMap emits no digest keys and the link-time digests are used as before. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: acherifi <ali.cherifi@homagames.com>
acherifi
marked this pull request as draft
July 28, 2026 10:00
acherifi
marked this pull request as ready for review
July 28, 2026 13:03
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Follow-up to #2242 (refs #2055): adds digest overrides for the Substrate ACP sandbox workload images, and Helm values plumbing for all six runtime-image digest overrides.
#2242 made regular declarative agents resolve runtime images by tag and added
--app-image-digest/--app-full-image-digest/--golang-adk-image-digest/--golang-adk-full-image-digestcontroller flags — but the ACP sandbox workload images (acp-sandbox-hermes,acp-sandbox-openclaw) are still composed with digests baked into the controller binary at link time, with no override. Operators mirroring images into a private/air-gapped registry cannot serve them: any mirror produced by a rebuild (or any registry that rewrites manifests) has a different digest, so the digest-pinned pull can never hit the mirror.Changes
--acp-sandbox-hermes-image-digestand--acp-sandbox-openclaw-image-digest(envACP_SANDBOX_HERMES_IMAGE_DIGEST/ACP_SANDBOX_OPENCLAW_IMAGE_DIGEST), consumed insubstrate/constants.gowhere the sandbox image refs are composed.controller.agentImage.digest/.fullDigest,controller.goAgentImage.digest/.fullDigest,controller.acpSandboxImages.hermesDigest/.openclawDigest— rendered into the controller ConfigMap only when set; defaults are unchanged (link-time digests still apply when no override is given).image-digest-overrides_test.yaml: no digest keys emitted by default, all six emitted when set.Testing
go build ./core/...clean;go testgreen on the touched packages (substrate/app/translator).helm unittest: 272 tests / 21 suites pass, including the new suite.helm templateverified with and without the new values.Backwards compatible; no behavior change unless an override is explicitly set.
🤖 Generated with Claude Code