fix(cloudflare): prevent Docker pull for prebuilt Container images#1292
fix(cloudflare): prevent Docker pull for prebuilt Container images#1292adunne09 wants to merge 3 commits intoalchemy-run:mainfrom
Conversation
When passing a prebuilt image to the Cloudflare Container resource, the
image was always being pulled locally, which resulted in a 401 error
when using Cloudflare registry images (registry.cloudflare.com).
This matches wrangler's behavior where:
- Dockerfile path → build locally, push to CF registry
- Registry URI → pass directly to Cloudflare API (no pull/push)
Changes:
- Add resolveImageName() to normalize image references following
wrangler's logic (add accountId to CF registry images if missing)
- Short-circuit Container for prebuilt images - construct Image object
directly without Docker operations
- Add validation to prevent both 'build' and 'image' being specified
- For dev mode with CF registry images, throw helpful error directing
users to use dev: { remote: true }
- Add comprehensive tests for resolveImageName normalization
- Add tests for new Container behavior
Amp-Thread-ID: https://ampcode.com/threads/T-019b8a2c-f6e7-7309-bc1a-42ef33802f66
Co-authored-by: Amp <amp@ampcode.com>
| const container = await Container(containerName, { | ||
| className: "TestContainer", | ||
| name: containerName, | ||
| image: `${cfRegistry}/${api.accountId}/test-image:v1`, |
There was a problem hiding this comment.
Is this in everyone's account?
There was a problem hiding this comment.
Did we ever get an answer to this? I see it's still in the diff @adunne09
There was a problem hiding this comment.
as far as I can tell- yes. its used throughout the codebase
https://github.com/search?q=repo%3Aalchemy-run%2Falchemy%20api.accountId&type=code
There was a problem hiding this comment.
We are asking about the test-image:v1 being on everyone's account, not the account id existing on API.
There was a problem hiding this comment.
commit: |
yeah there's a lot of comments, i can clean those up if desired. to address your feedback https://github.com/alchemy-run/alchemy/pull/1292/changes/BASE..4bcba262b94b15cbab75d6fe514c51c4875c7510#r2659859673 - I extended the changes past updating the container deployment logic to also mirror wrangler dev behavior so that overall parity is achieved (or at least closer). |
Summary
Fixes 401 errors when passing a prebuilt Cloudflare registry image to the
Containerresource. Previously, the Container resource would attempt to pull the image via Docker even for images already in the CF registry, causing authentication failures.Changes
alchemy/src/cloudflare/container.tsresolveImageName()function that normalizes image references following wrangler's logic:myapp:v1→registry.cloudflare.com/{accountId}/myapp:v1buildandimageare specifieddev: { remote: true }alchemy/test/cloudflare/container.test.tsresolveImageName()covering short names, CF registry with/without accountId, external registriesBehavior Matrix (matches wrangler)
Example Usage