Return direct image for durable (freeze/mirror) requests on the V1 endpoint#1090
Merged
pditommaso merged 1 commit intoJul 17, 2026
Merged
Conversation
makeResponseV2 already returns the direct target-registry image for freeze/mirror (durable) requests, but makeResponseV1 kept handing back the Wave proxy token url. Since durable images are no longer served via the proxy token path (see RouteHandler), V1 freeze clients pulling via targetImage would 404. Resolve targetImage to the direct image for durable requests on V1 too, matching V2. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
gavinelder
approved these changes
Jul 17, 2026
gavinelder
left a comment
gavinelder
left a comment
Contributor
There was a problem hiding this comment.
Thank you I was weighing up this approach and was unsure how best to proceed.
pditommaso
added a commit
that referenced
this pull request
Jul 17, 2026
…th (#1087) * fix: do not serve freeze/mirror images via the Wave proxy token path Freeze and mirror requests publish the image to the caller's target registry and return a direct registry reference; they are meant to be pulled directly from that registry. However the ephemeral /v2/wt/<token>/ proxy route still resolved and served them for the token TTL. Reject durable (freeze/mirror) requests on the proxy token path so the image can only be pulled directly from the target registry. Status/detail lookups by request id are unaffected. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Make freeze/mirror rejection message actionable; tighten test Point the caller to the direct image reference in the NotFoundException message, and assert the message carries that reference in the test. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Return direct image for durable requests on the V1 endpoint (#1090) makeResponseV2 already returns the direct target-registry image for freeze/mirror (durable) requests, but makeResponseV1 kept handing back the Wave proxy token url. Since durable images are no longer served via the proxy token path (see RouteHandler), V1 freeze clients pulling via targetImage would 404. Resolve targetImage to the direct image for durable requests on V1 too, matching V2. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: Paolo Di Tommaso <paolo.ditommaso@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Stacked on top of #1087.
#1087 makes the
/v2/wt/<token>proxy path reject durable (freeze/mirror) requests with a 404 — those images are meant to be pulled directly from the target registry. But the two response builders were asymmetric:makeResponseV2already returns the direct target-registry image for durable requests (target = data.durable() ? data.containerImage : waveImage), so V2 clients never receive awt/<token>freeze url.makeResponseV1returnedtargetImage = waveImageunconditionally, so a V1 (/container-token) freeze client is handed the proxy url — which Bugfix: do not serve freeze/mirror images via the Wave proxy token path #1087 now 404s.Freeze is not v2-gated (only mirror is), and
/container-tokenis still live (@Deprecated), so a pre-24.04Nextflow client (or any other V1 freeze client) would break.Impact assessment
targetImage, which V2 already returns as the direct image.targetImageand pull it directly (the correct freeze behavior).Changes
ContainerHelper.makeResponseV1: resolvetargetImageto the direct image (data.containerImage) fordurable()requests, matchingmakeResponseV2. The token is intentionally retained in the V1 response to avoid surprising legacy parsers — onlytargetImagechanges.ContainerHelperTest: add V1 freeze + mirror cases asserting the direct image is returned.🤖 Generated with Claude Code