[rudycelekli]

Bug

docker_isolation.registry is documented as the custom registry for isolation images, and air-gapped installs depend on it (see isolation_git_image_registry_test.go). buildFullImageName treats any image containing a / as already qualified and returns it unchanged. A Docker Hub namespaced image such as myorg/node-mcp:1 therefore bypasses the configured registry and is pulled from docker.io. The final registry + "/" + image branch is unreachable.

Docker's own rule is that the first path component is a registry host only if it contains . or :, or is localhost. Otherwise it is a Docker Hub namespace.

Trigger

"docker_isolation": {
  "enabled": true,
  "registry": "mirror.corp",
  "default_images": {"node": "myorg/node-mcp:1"}
}

A per-server isolation.image: "myorg/node-mcp:1" triggers it too.

• Expected image: mirror.corp/myorg/node-mcp:1.
• Actual image: myorg/node-mcp:1, which a host without internet access cannot pull.

Fix

Use Docker's host rule (imageHasRegistryHost) to decide whether a reference is already qualified. With a custom registry configured, namespaced images get the registry prefix like official images already do. With no registry configured, org/image is still returned unchanged, so ordinary installs see no difference. Fully qualified references (ghcr.io/..., localhost:5000/..., registry.local/...@sha256:...) are untouched.

Test

TestBuildFullImageName_ConfiguredRegistryPrefixesNamespacedImages is a table test covering the configured-registry and no-registry cases above.

Commands run

• CGO_ENABLED=0 go test -count=1 ./internal/upstream/core: ok (includes the existing git-image registry tests)
• With the fix reverted (git stash of isolation.go), the new test fails with buildFullImageName("myorg/node-mcp:1") = "myorg/node-mcp:1", want "mirror.corp/myorg/node-mcp:1".
• gofmt -l on the edited files: no output

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[Dumbris]

Verified: the PR test fails on main for the reason described and passes on this branch merged with main; race tests for the touched packages and CI lint (bare and server tags) are clean. Also built and tested together with the rest of this batch, independently reviewed, and cross-reviewed with a second model.

[Dumbris]

Merged. Thank you, @rudycelekli! docker_isolation.registry now applies to Docker Hub namespaced images, which air-gapped installs depend on.