fix(images): Accept http(s)+oci image references

cmd/unikraft/integration/instance_http_oci_test.go

@@ -0,0 +1,61 @@
+// SPDX-License-Identifier: BSD-3-Clause
+// Copyright (c) 2026, Unikraft GmbH and The Unikraft CLI Authors.
+// Licensed under the BSD-3-Clause License (the "License").
+// You may not use this file except in compliance with the License.
+
+package integration
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	integ "unikraft.com/cli/internal/integration"
+)
+
+// testDigest is an arbitrary but well-formed digest, for the cases that need a
+// digest nothing is ever fetched for.
+const testDigest = "sha256:43d3d758e6fba7d4734ac142cfdbf8aa786fcbbfd828017eecaadc5140a4b190"
+
+func TestInstancesHTTPOCI(t *testing.T) {
+	// An http+oci image must reach the API with its scheme intact, since the
+	// node is what fetches it. --dry-run stops before any request is made,
+	// so this needs no metro.
+	t.Run("dry-run", func(t *testing.T) {
+		r := runner(t, false, []string{staging, stable, prod})
+
+		for _, image := range []string{
+			"http+oci://cdn.example.com/me/app/latest",
+			"https+oci://cdn.example.com/me/app/@" + testDigest,
+		} {
+			// The --image shortcut and the generic field are separate paths into
+			// the same value, so both have to carry the URI.
+			for _, args := range [][]string{
+				{"--set", "metro=fra", "--set", "name=test-" + uniq(), "--set", "image=" + image},
+				{"--metro", "fra", "--name", "test-" + uniq(), "--image", image},
+			} {
+				out := r.Run(t, append([]string{
+					"unikraft", "instance", "create", "--dry-run",
+				}, args...))
+				assert.Contains(t, out, image,
+					"the image URI must reach the API verbatim (%v)", args)
+			}
+		}
+	})
+
+	// An unusable scheme has to say so.
+	t.Run("reports an unusable scheme", func(t *testing.T) {
+		r := runner(t, false, []string{staging, stable, prod})
+
+		out := r.Run(t, []string{
+			"unikraft", "instance", "create", "--dry-run",
+			"--metro", "fra",
+			"--name", "test-" + uniq(),
+			"--image", "oci-archive:///tmp/image.tar",
+		}, integ.ExpectFail())
+
+		assert.Regexp(t, `addresses a local image`, out)
+		assert.NotRegexp(t, `invalid reference format`, out,
+			"a scheme this CLI cannot address is not a malformed reference")
+	})
+}

internal/builder/kernel.go

@@ -12,6 +12,7 @@ import (
 	"github.com/containerd/platforms"
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
 	imagespec "unikraft.com/x/image-spec"
+	"unikraft.com/x/image-spec/imageref"
 
 	"unikraft.com/cli/internal/images"
 )
@@ -26,7 +27,7 @@ func BuildKernel(ctx context.Context, opts BuildOpts) ([]*imagespec.Image, error
 	if err != nil {
 		return nil, fmt.Errorf("parsing runtime reference: %w", err)
 	}
-	if runtime.Scheme != imagespec.URISchemeOCI {
+	if runtime.Scheme != imageref.SchemeOCI {
 		return nil, fmt.Errorf("unsupported runtime reference scheme: %s", runtime.Scheme)
 	}
 

internal/cmd/build.go

@@ -17,6 +17,7 @@ import (
 	"unikraft.com/cli/internal/images"
 	"unikraft.com/cli/internal/resource"
 	imagespec "unikraft.com/x/image-spec"
+	"unikraft.com/x/image-spec/imageref"
 	"unikraft.com/x/kingkong"
 	"unikraft.com/x/kraftfile"
 	"unikraft.com/x/log"
@@ -166,7 +167,7 @@ func (c *ImageBuildCmd) Run(ctx context.Context, cfg *config.Config, sandbox *re
 		return err
 	}
 
-	if sandbox != nil && output.Scheme == imagespec.URISchemeOCI {
+	if sandbox != nil && output.Scheme == imageref.SchemeOCI {
 		if err := addImageToSandbox(ctx, sandbox, output.Path); err != nil {
 			return fmt.Errorf("adding built image to sandbox: %w", err)
 		}