Module registry_probe 

“Could the daemon pull this image without credentials?”, asked of the registry directly, for the create flow.

The image name is user data: an imported or custom template can name any registry, and the registry names the token endpoint (realm) in its own challenge. So this module treats both as hostile input. It only ever talks to public https hosts: every host it contacts is checked by name and by the addresses it resolves to, the connection is pinned to those addresses, and redirects are never followed. Anything it refuses to contact is Unknown, which never blocks the sandbox.

Spec: docs/specs/SPEC_CONTAINER_AGENTS_WORK_FOR_EVERYONE_2026_10_07.md section 3.4.

Structs

Policy 🔒

How strictly each leg is checked. Production checks both; tests relax a leg so a local fake server can stand in for it.

Constants

DNS_TIMEOUT 🔒

MANIFEST_ACCEPT 🔒

MAX_TOKEN_BYTES 🔒

A token response is a few hundred bytes; anything near this is not one.

PROBE_TIMEOUT 🔒

PRODUCTION 🔒

REQUEST_TIMEOUT 🔒

Functions

all_public 🔒

True when there is at least one address and none is private or local.

embedded_v4 🔒

guarded_client 🔒

A client for requests to url’s host. Strict: the host is checked by name and by every address it resolves to, and the connection is pinned to those addresses, so the name cannot resolve differently between the check and the connection. Never follows redirects. None when the host is refused.

hostname_is_blocked 🔒

Names that mean “this machine or this network”, not a public registry.

ip_is_blocked 🔒

Addresses that are not a public host: loopback, private, link-local (cloud metadata), carrier-grade NAT, unspecified, multicast, reserved and documentation ranges, and IPv6 forms that carry an IPv4 address. Also the widget fetch’s test (widget_net.rs).

ipv4_is_blocked 🔒

ipv6_is_blocked 🔒

probe_anonymous

Ask the image’s registry, without credentials, whether its manifest can be read: the same question the daemon’s pull answers. Unknown for anything that isn’t a definite answer (offline, a proxy, a host this refuses to contact).

probe_inner 🔒

probe_with 🔒

read_capped 🔒

The body of resp, or None if it is larger than max bytes.

validate_realm 🔒

A token endpoint is only used if it is an https URL, with no credentials in it and no unusual port, to a host that is not a local or private name or address. strict = false is for tests only.