From dd5f4b016c579c9f64e1d221984206beeff6c7ea Mon Sep 17 00:00:00 2001 From: Rajath Agasthya Date: Wed, 7 Oct 2026 12:35:42 -0500 Subject: [PATCH] Allowlist nvcr.io for docker update jobs Hosted Dependabot docker version updates for images on nvcr.io (the NVIDIA NGC container registry) fail under proxy-egress-enforce: the allowlist 403s nvcr.io before the request reaches the registry, and the updater reports it as `private_source_authentication_failure`. Public NGC images need no sign-in, so there is no `registries:` credential a user could configure for them. Add nvcr.io and layers.nvcr.io as exact hosts on the `docker` anchor, so docker_compose and devcontainers inherit them: * /v2/ advertises `Bearer realm="https://nvcr.io/proxy_auth"`. The token service is on the same host and issues a guest token with pull access to public repositories only. * Blob requests 307-redirect to layers.nvcr.io, NVIDIA's CloudFront distribution. It serves only URLs signed by nvcr.io and returns 403 for unsigned requests. Exact only: tenancy is path-based (nvcr.io///), and private org images still need an NGC API key under `registries:`. Signed-off-by: Rajath Agasthya --- internal/handlers/egress_allowlist_defaults.yaml | 9 +++++++++ internal/handlers/egress_allowlist_test.go | 8 ++++++++ 2 files changed, 17 insertions(+) diff --git a/internal/handlers/egress_allowlist_defaults.yaml b/internal/handlers/egress_allowlist_defaults.yaml index a4bc650..287f2de 100644 --- a/internal/handlers/egress_allowlist_defaults.yaml +++ b/internal/handlers/egress_allowlist_defaults.yaml @@ -472,6 +472,15 @@ ecosystem_default_domains: # the Kubernetes release infrastructure, so no subdomain is user-creatable. # The `k8s.io` entry in go_modules is exact and does not cover this host. - registry.k8s.io + # NVIDIA NGC container registry. Public NGC images need no sign-in: /v2/ + # advertises a Bearer realm on the same host (nvcr.io/proxy_auth), which + # issues a guest token with pull access to public repositories only. Blobs + # 307-redirect to layers.nvcr.io, NVIDIA's CloudFront distribution, which + # serves only URLs signed by nvcr.io and 403s unsigned requests. Exact only: + # tenancy is path-based (nvcr.io///), and private org + # images still need an NGC API key under `registries:`. + - nvcr.io + - layers.nvcr.io docker_compose: *docker_registries nuget: - api.nuget.org diff --git a/internal/handlers/egress_allowlist_test.go b/internal/handlers/egress_allowlist_test.go index fb87892..9ca376c 100644 --- a/internal/handlers/egress_allowlist_test.go +++ b/internal/handlers/egress_allowlist_test.go @@ -270,6 +270,12 @@ func TestEgressAllowlist_PublicVendorOCIRegistriesAllowed(t *testing.T) { "https://registry.k8s.io/v2/coredns/coredns/manifests/v1.14.7", "https://registry.k8s.io/token?scope=repository:coredns/coredns:pull&service=registry.k8s.io", "https://europe-west8-docker.pkg.dev/v2/k8s-artifacts-prod/images/coredns/coredns/tags/list", + // NVIDIA NGC: same-host guest token service, and blobs 307-redirect to + // NVIDIA's signed-URL CloudFront host. + "https://nvcr.io/v2/nvidia/cuda/tags/list", + "https://nvcr.io/v2/nvidia/distroless/go/manifests/v4.1.4", + "https://nvcr.io/proxy_auth?account&scope=repository:nvidia/cuda:pull&service=registry", + "https://layers.nvcr.io/registry/docker/registry/v2/blobs/sha256/ab/abc/data", } { assert.Nil(t, egressResult(t, h, allowed), "public vendor OCI host allowed: "+allowed) } @@ -282,6 +288,8 @@ func TestEgressAllowlist_PublicVendorOCIRegistriesAllowed(t *testing.T) { "https://evil.cgr.dev/v2/", "https://evil.registry.access.redhat.com/v2/", "https://evil.registry.k8s.io/v2/", + "https://evil.nvcr.io/v2/", + "https://evil.layers.nvcr.io/registry/", // The Go vanity-import entry for k8s.io is exact, so the apex and its // other subdomains stay closed even with registry.k8s.io allowed. "https://attacker.k8s.io/v2/",