Struct DockerRuntime 

pub struct DockerRuntime;

Implementations

impl DockerRuntime

pub fn pull_verified( &self, image: &OciRef, expected_digest: &str, progress: &dyn ProgressReporter, ) -> Result<ImageDigest>

Pull image and bail if the registry-reported digest does not match expected_digest.

pull itself does not enforce this: it returns whatever digest the registry hands back. Most callers (bv sync) already cross-check against the lockfile, but the bv run and bv conform paths short circuit through is_locally_available, which only proves that a matching RepoDigests entry exists in the local cache, not that the upstream image still resolves to the pinned sha. New code that requires a digest pin should call this method instead of pull.

pub fn pull_verified_v2( &self, image: &OciRef, expected_image_digest: &str, layers: &[LayerDescriptor], progress: &dyn ProgressReporter, ) -> Result<ImageDigest>

Pull image, verify the image digest, then verify each per-layer digest from layers against what Docker reports for the pulled image.

Callers that hold a LockfileEntry with spec_kind = FactoredOci should call this instead of pull_verified so that individual conda-package layer tampering is caught immediately after pull.

Error messages include the expected and actual digest plus the layer position so that upstream tampering is easy to diagnose.

pub fn verify_layer_digests( &self, image: &OciRef, expected_layers: &[LayerDescriptor], ) -> Result<()>

Verify per-layer digests for an already-pulled image.

Uses docker manifest inspect (or docker image inspect) to obtain the layer list and cross-checks each digest against the lockfile entry. On mismatch, the error message names the layer index, the expected digest, and the actual digest to make upstream tampering easy to diagnose.

Trait Implementations

impl Clone for DockerRuntime

fn clone(&self) -> DockerRuntime

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl ContainerRuntime for DockerRuntime

fn name(&self) -> &str

fn health_check(&self) -> Result<RuntimeInfo>

fn pull( &self, image: &OciRef, progress: &dyn ProgressReporter, ) -> Result<ImageDigest>

fn run(&self, spec: &RunSpec) -> Result<RunOutcome>

fn inspect(&self, digest: &ImageDigest) -> Result<ImageMetadata>

fn is_locally_available(&self, image_ref: &str, digest: &str) -> bool

Check whether image_ref@digest is already in the local Docker cache.

fn gpu_args(&self, profile: &GpuProfile) -> Vec<String>

fn mount_args(&self, mounts: &[Mount]) -> Vec<String>

fn ensure_layers( &self, _layers: &[LayerSpec], _progress: &dyn ProgressReporter, ) -> Result<()>

Pull only the specified layers, deduplicating against the local cache.

fn assemble_image( &self, image: &OciRef, _layers: &[LayerSpec], progress: &dyn ProgressReporter, ) -> Result<ImageRef>

Assemble a runnable image from a manifest whose layers are all locally available (guaranteed by a preceding ensure_layers call).