Module container_image 

Which container image an agent runs, and what happens when it can’t be had.

• The default and the legacy image names, and the fallback between them.
• Classifying a failed pull into something a person can act on, instead of passing bollard’s text through.
• An anonymous registry check (“could the daemon pull this?”) for the create flow, which has to decide before anything is pulled.

Spec: docs/specs/SPEC_CONTAINER_AGENTS_WORK_FOR_EVERYONE_2026_10_07.md.

Structs

BearerChallenge

The pieces of a WWW-Authenticate: Bearer ... challenge.

ImageRef

A parsed image reference: where to ask, which repository, which tag or digest.

Enums

PullFailure

Why a pull failed, as far as the daemon’s text lets us tell.

Constants

CONTAINER_CLI_DIR

Where the provider CLI is installed inside the container.

DEFAULT_AGENT_IMAGE

The public base image: everything a container agent needs except the provider CLI, which is installed on first start.

LEGACY_AGENT_IMAGE_REPO 🔒

Repository of the earlier image that bundled Claude Code. It is private, so only machines that already hold it can use it.

Functions

better_access

The better of two answers for “can this be had”: something usable beats something unknown, which beats a refusal.

check_image_access

Whether image can be had here. A stored legacy image is also checked against the base image it falls back to, so the answer matches what a start would actually do.

classify_pull_error

Classify a pull error from the daemon’s HTTP status (when it had one) and text.

cli_install_failure_message

The sentence for a provider CLI that couldn’t be installed in the container.

docker_error_message

The sentence for any other Docker failure while starting the container.

docker_unreachable_message

The sentence for a Docker daemon that isn’t answering.

is_legacy_agent_image

Whether image is the private legacy image, at any tag.

looks_like_daemon_unreachable

Whether a Docker error is the daemon being unreachable, not a request it refused.

parse_bearer_challenge

Parse a Bearer challenge; None for any other scheme or a missing realm.

parse_image_ref

Split image the way Docker does. None for a reference we won’t probe (a local or port-qualified registry, which may well speak plain HTTP).

pull_failure_message

The sentence for a failed pull. Names the image, says what happened, and says what to do next. Never carries the daemon’s raw text except for Other, where there is nothing better to say.

resolve_container_image

The image a stored agent:container_image value means: empty is the default.

split_challenge_params 🔒

Split on commas that are outside double quotes (a scope can hold ,).

truncate 🔒