[release/0.26] Use v2 physical resources for tunnel proxies - #265
Merged
David Negstad (danegsta) merged 1 commit intoSep 17, 2026
Merged
Conversation
* Use physical resources for tunnel proxies Build and run the tunnel client proxy through v2 PhysicalContainerImage and PhysicalContainer resources in the shared v1 compatibility namespace. Add digest-addressed file and inline archive build contexts that Docker and Podman stream through stdin. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: dc6d6a11-725e-4f6b-bed6-d6337b5e5ea5 * Address tunnel physical resource review feedback Add physical container lifecycle monitoring, consolidate image build command handling, tighten archive validation and cleanup behavior, and restore lifecycle regression coverage. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: dc6d6a11-725e-4f6b-bed6-d6337b5e5ea5 * Reject archive root Dockerfile paths Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: dc6d6a11-725e-4f6b-bed6-d6337b5e5ea5 * Validate image build contexts Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: dc6d6a11-725e-4f6b-bed6-d6337b5e5ea5 * Keep tunnel image cleanup best effort Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: dc6d6a11-725e-4f6b-bed6-d6337b5e5ea5 * Refine tunnel physical resource orchestration Move tunnel image preparation fully behind v2 physical resources, reuse existing images, and simplify tunnel state coordination. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: dc6d6a11-725e-4f6b-bed6-d6337b5e5ea5 * Clean up unused tunnel image archives Remove build-context archives created by losing shared-image creation attempts while preserving any archive referenced by the persisted resource. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: dc6d6a11-725e-4f6b-bed6-d6337b5e5ea5 * Track physical image build inputs Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: dc6d6a11-725e-4f6b-bed6-d6337b5e5ea5 * Separate image pull and build policies Apply pull policies consistently to source images and declared build bases while making build output reuse independently configurable. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: dc6d6a11-725e-4f6b-bed6-d6337b5e5ea5 * Move tunnel cleanup coverage to integration tests Exercise build-context race cleanup and preservation through the tunnel controller integration environment instead of a white-box controller test. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: dc6d6a11-725e-4f6b-bed6-d6337b5e5ea5 * Use logical tunnel build context digest Derive the archive digest from stable Dockerfile and tunnel binary inputs while retaining the raw archive SHA256 solely for integrity verification. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: dc6d6a11-725e-4f6b-bed6-d6337b5e5ea5 * Generalize physical image context digests Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: dc6d6a11-725e-4f6b-bed6-d6337b5e5ea5 * Regenerate OpenAPI after dependency update Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: dc6d6a11-725e-4f6b-bed6-d6337b5e5ea5 * Return image inspection snapshots Clone mutable image metadata returned by the test container orchestrator so callers cannot race with or mutate orchestrator-owned state. Add regression coverage for labels and tags. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: dc6d6a11-725e-4f6b-bed6-d6337b5e5ea5 * Track effective physical image build inputs Keep the build provenance fingerprint internal while including inherited build arguments, environment secrets, and file secret contents. Verify reuse and rebuild behavior through the physical image integration suite. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: dc6d6a11-725e-4f6b-bed6-d6337b5e5ea5 * Harden tunnel physical resource startup Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: dc6d6a11-725e-4f6b-bed6-d6337b5e5ea5 * Use context-aware lock for image preparation Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: dc6d6a11-725e-4f6b-bed6-d6337b5e5ea5 * Scope physical controllers to tunnel tests Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: dc6d6a11-725e-4f6b-bed6-d6337b5e5ea5 * Avoid aliasing test image tags Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: dc6d6a11-725e-4f6b-bed6-d6337b5e5ea5 * Clarify archive path semantics Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: dc6d6a11-725e-4f6b-bed6-d6337b5e5ea5 * Reconcile tunnel physical cleanup Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: dc6d6a11-725e-4f6b-bed6-d6337b5e5ea5 * Add physical container network connections Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: dc6d6a11-725e-4f6b-bed6-d6337b5e5ea5 * Keep physical controller tests in integration Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: dc6d6a11-725e-4f6b-bed6-d6337b5e5ea5 * Compare physical network connection specs Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: dc6d6a11-725e-4f6b-bed6-d6337b5e5ea5 * Guard missing failed tunnel proxy data Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: dc6d6a11-725e-4f6b-bed6-d6337b5e5ea5 * Document failed tunnel proxy invariant Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: dc6d6a11-725e-4f6b-bed6-d6337b5e5ea5 * Release image lock on shutdown Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: dc6d6a11-725e-4f6b-bed6-d6337b5e5ea5 * Require exact physical container network IDs Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: dc6d6a11-725e-4f6b-bed6-d6337b5e5ea5 * Improve tunnel proxy startup diagnostics Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: dc6d6a11-725e-4f6b-bed6-d6337b5e5ea5 --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: dc6d6a11-725e-4f6b-bed6-d6337b5e5ea5
David Negstad (danegsta)
requested a review
from Karol Zadora-Przylecki (karolz-ms)
September 17, 2026 20:42
David Negstad (danegsta)
enabled auto-merge (squash)
September 17, 2026 20:42
David Negstad (danegsta)
disabled auto-merge
September 17, 2026 21:03
David Negstad (danegsta)
enabled auto-merge (squash)
September 17, 2026 21:03
Karol Zadora-Przylecki (karolz-ms)
approved these changes
Sep 17, 2026
David Negstad (danegsta)
deleted the
danegsta-backport-pr-250-release-0-26
branch
September 17, 2026 22:39
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backports #250 to
release/0.26.The automated backport failed while applying the multi-commit PR patch. The squash commit cherry-picked cleanly onto the current release branch and is patch-equivalent to the commit on
main.Validation:
make generate(no diff)make lintmake test