Support CROSSPLANE_DIFF_DOCKER_NETWORK env var for container networking by jtucci · Pull Request #255 · crossplane-contrib/crossplane-diff

jtucci · 2026-03-18T17:10:50Z

Description of your changes

When crossplane-diff runs inside a Docker container (e.g. a GitHub Actions container job), function containers created via the Docker socket land on the default bridge network, which is isolated from the job container's network. This makes function containers unreachable, causing all compositions to fail with connection errors.

This adds support for the CROSSPLANE_DIFF_DOCKER_NETWORK environment variable. When set, the value is applied as the render.crossplane.io/runtime-docker-network annotation on all Function resources before they are passed to render.Render(). This tells the Crossplane render runtime to connect function containers to the specified Docker network.

The annotation is applied in both DefaultFunctionProvider (used by the xr command) and CachedFunctionProvider (used by the comp command) via a shared helper function.

Depends on crossplane/crossplane#7216 — that upstream PR must be merged first, and then the go.mod dependency in this repo needs to be bumped to pick up the new annotation support.

========================== 🌍 Earthly Build  ✅ SUCCESS ==========================

Fixes #254

I have:

Read and followed Crossplane's contribution process.
Run earthly -P +reviewable to ensure this PR is ready for review.
Added or updated unit tests.
~~Added or updated e2e tests.~~
~~Documented this change as needed.~~
~~Followed the API promotion workflow if this PR introduces, removes, or promotes an API.~~

jtucci · 2026-03-19T14:42:32Z

@jcogilvie could you please review this?

jcogilvie · 2026-03-25T18:52:49Z

Thanks for the submission.

Once upstream cuts a new version that includes the linked PR, I'll be able to bump our version and then review your change.

Copilot

Pull request overview

Adds support for running crossplane-diff inside Docker container environments (e.g., GitHub Actions container jobs) by propagating a Docker network selection into the Crossplane render runtime via Function annotations.

Changes:

Introduces CROSSPLANE_DIFF_DOCKER_NETWORK env var support and applies render.crossplane.io/runtime-docker-network to Functions prior to rendering.
Applies the annotation for both DefaultFunctionProvider (xr) and CachedFunctionProvider (comp) via a shared helper.
Adds unit tests for the annotation-application helper.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
cmd/diff/diffprocessor/function_provider.go	Adds env var + helper to annotate Functions and wires it into both function providers.
cmd/diff/diffprocessor/function_provider_test.go	Adds unit tests covering env-set/unset and existing annotations behavior.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

 	// Cache for future calls
 	p.cache[compName] = fns

+	applyDockerNetworkAnnotation(fns, p.logger)
+
 	return fns, nil


+			if tt.envValue != "" {
+				t.Setenv(EnvDockerNetwork, tt.envValue)
+			} else {
+				os.Unsetenv(EnvDockerNetwork)
+			}


jcogilvie · 2026-04-29T17:23:30Z

It looks like this upstream fix hasn't been released on the 2.2 branch, and it isn't in 2.3.0-rc.0. So I'm still waiting on upstream for this.

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

+			if tt.envValue != "" {
+				t.Setenv(EnvDockerNetwork, tt.envValue)
+			} else {
+				os.Unsetenv(EnvDockerNetwork)
+			}


+			// Verify existing annotations are preserved when env is set
+			if tt.wantNetwork != "" {
+				for _, fn := range tt.fns {
+					if v, ok := fn.Annotations["existing-key"]; ok && v != "existing-value" {
+						t.Errorf("existing annotation was modified: got %q, want %q", v, "existing-value")
+					}
+				}
+			}


jcogilvie · 2026-06-09T22:55:46Z

It looks like in order for this to work, we have to fix crossplane/cli#75 upstream.

When crossplane-diff runs inside a Docker container (e.g. a GitHub Actions container job), function containers created via the Docker socket land on a different Docker network and are unreachable. This adds support for the CROSSPLANE_DIFF_DOCKER_NETWORK environment variable. When set, the value is applied as the render.crossplane.io/runtime-docker-network annotation on all function resources before they are passed to render.Render(). This tells the Crossplane render runtime to connect function containers to the specified Docker network, making them reachable from the caller. Usage in a GitHub Actions workflow: env: CROSSPLANE_DIFF_DOCKER_NETWORK: ${{ job.container.network }} Depends on: crossplane/crossplane#7216 Signed-off-by: Jon Tucci <jonytucci01@gmail.com>

Address review feedback on PR crossplane-contrib#255: - CachedFunctionProvider.GetFunctionsForComposition now applies the Docker network annotation on every call, including cache hits, so the annotation always reflects the current value of CROSSPLANE_DIFF_DOCKER_NETWORK (rather than whatever was in effect when the entry was first cached). Reorder the cache-miss path to annotate before storing, so cache state is correct independent of slice aliasing. - Tighten TestApplyDockerNetworkAnnotation: use t.Setenv even for the empty case so prior env state is restored on cleanup, and assert the pre-existing annotation key is both present and unchanged (the prior check only failed on a wrong value, not on accidental removal). - Add TestCachedFunctionProvider_DockerNetworkAnnotation_CacheHit as a regression test for the cache-hit path: prime the cache with the env var unset, then set it and request the same composition; the returned cached functions must carry the annotation. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Signed-off-by: Jonathan Ogilvie <jonathan.ogilvie@sumologic.com>

jcogilvie · 2026-06-17T21:32:54Z

Pushed an updated branch from a maintainer to get this merge-ready:

4d6bb7b (jtucci, original DCO signoff preserved) — rebased on main and amended to include the go.mod bump of github.com/crossplane/cli/v2 to a pseudoversion containing crossplane/cli#65 (merged today), which is the runtime side of the render.crossplane.io/runtime-docker-network annotation this PR sets.

128b592 (new follow-up commit) — addresses the three Copilot review threads:

CachedFunctionProvider.GetFunctionsForComposition now applies applyDockerNetworkAnnotation on every call (cache hit and miss). The cache-miss path is also reordered to annotate before storing, so cache state is correct regardless of slice aliasing. (thread)
TestApplyDockerNetworkAnnotation always uses t.Setenv (even with an empty value), so prior env state is restored on cleanup and the test no longer leaks into the developer's shell. (thread)
The "existing annotation preserved" assertion now requires the key to be both present and unchanged (the prior check would silently pass if the annotation was dropped). The check is gated to the ExistingAnnotations subtest. (thread)
Adds TestCachedFunctionProvider_DockerNetworkAnnotation_CacheHit as a regression test: prime the cache with the env var unset, then set it and request the same composition — the cached functions must carry the annotation.

Verified locally with earthly -P +reviewable (lint 0 issues, all tests pass).

jtucci force-pushed the feat/docker-network-env-var branch 3 times, most recently from b733a4a to 8407101 Compare March 18, 2026 17:41

Copilot AI review requested due to automatic review settings April 28, 2026 19:01

jcogilvie force-pushed the feat/docker-network-env-var branch from 8407101 to ea91a74 Compare April 28, 2026 19:01

Copilot started reviewing on behalf of jcogilvie April 28, 2026 19:02 View session

Copilot AI reviewed Apr 28, 2026

View reviewed changes

jtucci force-pushed the feat/docker-network-env-var branch from ea91a74 to 9e6248d Compare May 28, 2026 21:56

Copilot AI review requested due to automatic review settings June 5, 2026 18:01

jtucci force-pushed the feat/docker-network-env-var branch from 9e6248d to 92196c9 Compare June 5, 2026 18:01

Copilot AI reviewed Jun 5, 2026

View reviewed changes

jcogilvie mentioned this pull request Jun 9, 2026

render: unwind multi-composition workaround in EngineRenderFn once upstream Engine API supports it #338

Open

4 tasks

jtucci and others added 2 commits June 17, 2026 14:18

jcogilvie force-pushed the feat/docker-network-env-var branch from 92196c9 to 128b592 Compare June 17, 2026 21:31

jcogilvie requested review from jcogilvie and tampakrap as code owners June 17, 2026 21:31

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Support CROSSPLANE_DIFF_DOCKER_NETWORK env var for container networking#255

Support CROSSPLANE_DIFF_DOCKER_NETWORK env var for container networking#255
jtucci wants to merge 2 commits into
crossplane-contrib:mainfrom
jtucci:feat/docker-network-env-var

jtucci commented Mar 18, 2026 •

edited

Loading

Uh oh!

jtucci commented Mar 19, 2026

Uh oh!

jcogilvie commented Mar 25, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

jcogilvie commented Apr 29, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

jcogilvie commented Jun 9, 2026

Uh oh!

jcogilvie commented Jun 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

jtucci commented Mar 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description of your changes

Uh oh!

jtucci commented Mar 19, 2026

Uh oh!

jcogilvie commented Mar 25, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

jcogilvie commented Apr 29, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

jcogilvie commented Jun 9, 2026

Uh oh!

jcogilvie commented Jun 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

jtucci commented Mar 18, 2026 •

edited

Loading