Skip to content
This repository was archived by the owner on Aug 3, 2026. It is now read-only.

validator: pin sandbox image by local image-id (no registry push) - #74

Merged
bitzic merged 1 commit into
mainfrom
feat/sandbox-local-image-pin
Jun 28, 2026
Merged

validator: pin sandbox image by local image-id (no registry push)#74
bitzic merged 1 commit into
mainfrom
feat/sandbox-local-image-pin

Conversation

@bitzic

@bitzic bitzic commented Jun 28, 2026

Copy link
Copy Markdown
Contributor
  • is_pinned_image() accepts a registry digest (name@sha256:<64hex>) OR a bare local image id (sha256:<64hex>) — both are content hashes, so a locally-built sandbox image can be pinned without pushing to a registry
  • use it in build_docker_argv, preflight._check_image, and _sandboxed_hidden_eval
  • tests: accepts digest + local id, rejects tag/short/empty; argv builds with id

- is_pinned_image() accepts a registry digest (name@sha256:<64hex>) OR a
  bare local image id (sha256:<64hex>) — both are content hashes, so a
  locally-built sandbox image can be pinned without pushing to a registry
- use it in build_docker_argv, preflight._check_image, and _sandboxed_hidden_eval
- tests: accepts digest + local id, rejects tag/short/empty; argv builds with id

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@bitzic
bitzic merged commit 4dd2b06 into main Jun 28, 2026
4 checks passed
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant