kitchen-dokken 2.23.1 → 2.23.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2d17cea32434bc8b2b07ab6d5354b1f47462b369a75da4c5f590ea5f5584203f
-  data.tar.gz: d35e888e3d94ec39baae9a00bffb3c2d6fb4ec9ca119cff17f0813925bfedc2e
+  metadata.gz: 9bbe79ca0ad5a4b71659c1359871a9e4c86f6e243d83d694ab76341f94a0e6c0
+  data.tar.gz: 2e6dd411ce0d408331cf312249d208c6b6345382cc94d2d83cba0cf7b407d0be
 SHA512:
-  metadata.gz: 4b7537a361c7b640ba5387e7f2b96037f0ca1225e754743d7f15efcbfbb01ee7d437576d8aa739066e8a2b410d2f202c50ab375c50bd27c656399750681ff5ed
-  data.tar.gz: 59ddda252eec17939ef63a3decaaf396fa733eb8021d480d76809033af1480b80eeb681c7f9936fe5b3c0089f78b7fc98cc4e3457c2f57a1303537a119c44c48
+  metadata.gz: a14d2a57ab4bdb76e6192107fd2f0c185df2f1fab90522c1fa45546420c8a508e0adfb9b893a56c2c9ef6e84c4b7fd5cf1428f578b614f788659b523e6219753
+  data.tar.gz: df6506e366a8379682f5bbbfc3e3b1574d841a3da048d7ab35d61b944f4b28996277cf30907fa1b1de3b21aa36c52fd01521844344c51c0ec976cd93b396ed1e

data/lib/kitchen/driver/dokken.rb

@@ -16,6 +16,7 @@
 # limitations under the License.
 
 require "digest" unless defined?(Digest)
+require "json" unless defined?(JSON)
 require "kitchen"
 require "tmpdir" unless defined?(Dir.mktmpdir)
 require "docker"
@@ -80,7 +81,7 @@ module Kitchen
       default_config :write_timeout, 3600
       default_config :user_ns_mode, nil
       default_config :creds_file, nil
-      default_config :docker_config_creds, false
+      default_config :docker_config_creds, true
 
       # (see Base#create)
       def create(state)
@@ -370,7 +371,7 @@ module Kitchen
           config["HostConfig"]["UsernsMode"] = "host"
         end
 
-        runner_container = run_container(config)
+        runner_container = run_container(config, platform: self[:platform])
         state[:runner_container] = runner_container.json
       end
 
@@ -397,6 +398,12 @@ module Kitchen
             },
           }
         end
+        # Deliberately not pinned to config[:platform]: this container only
+        # serves kitchen's files over ssh, so its architecture is irrelevant to
+        # the system under test. The data image is built locally from
+        # almalinux:9 (see Helpers#create_data_image) and is therefore always
+        # host-architecture -- pinning it fails outright whenever the platform
+        # under test differs from the host.
         data_container = run_container(config)
         state[:data_container] = data_container.json
       end
@@ -443,7 +450,9 @@ module Kitchen
                 "NetworkMode" => self[:network_mode],
               },
             }
-            chef_container = create_container(config)
+            # /opt/chef from this container is mounted into the runner, so it
+            # has to be built for the same architecture as the runner.
+            chef_container = create_container(config, platform: self[:platform])
             state[:chef_container] = chef_container.json
           rescue ::Docker::Error, StandardError => e
             raise "driver - #{chef_container_name} failed to create #{e}"
@@ -504,20 +513,68 @@ module Kitchen
         @docker_config_creds
       end
 
+      # The `auths` key `docker login` itself writes for Docker Hub.
+      DOCKER_HUB_REGISTRY_KEY = "https://index.docker.io/v1/".freeze
+
+      # Registry hosts that all refer to Docker Hub. Docker writes the legacy
+      # v1 URL above, but hand-written and tool-generated configs use any of
+      # these. Listed in preference order.
+      DOCKER_HUB_HOSTS = %w{index.docker.io docker.io registry-1.docker.io}.freeze
+
+      # An explicit "no credentials" value. Returning nil here instead would let
+      # docker-api fall back to the process-global ::Docker.creds, which
+      # authenticate! populates from creds_file and never clears -- so another
+      # instance's private registry password would be sent to this registry,
+      # which is the very leak this scoping exists to prevent.
+      NO_DOCKER_CREDS = {}.freeze
+
+      # Return the registry host an image reference points at, or nil when the
+      # reference resolves to Docker Hub. The leading path component only names
+      # a registry when it contains a "." or a ":", or is exactly "localhost" --
+      # the same heuristic Docker uses to tell "quay.io/org/image" apart from
+      # the Hub shorthand "dokken/almalinux-8".
+      def image_registry_host(image)
+        first, remainder = image.split("/", 2)
+        return nil if remainder.nil?
+        return nil unless first.include?(".") || first.include?(":") || first == "localhost"
+
+        first
+      end
+
+      # Look up the ~/.docker/config.json entry that applies to an image's
+      # registry. Returns nil when that registry has no entry so the pull is
+      # attempted anonymously, rather than offering it another registry's
+      # credentials.
+      # Pick the config.json key that holds the Docker Hub credentials. A
+      # config may spell Hub several ways, so prefer the canonical key and then
+      # a fixed alias order rather than whichever happens to be listed first.
+      def docker_hub_creds_key
+        keys = docker_config_creds.keys.select { |k| DOCKER_HUB_HOSTS.include?(parse_registry_host(k)) }
+        return if keys.empty?
+
+        keys.find { |k| k == DOCKER_HUB_REGISTRY_KEY } ||
+          keys.min_by { |k| DOCKER_HUB_HOSTS.index(parse_registry_host(k)) }
+      end
+
+      def docker_config_creds_for_image(image)
+        host = image_registry_host(image)
+
+        key = if host.nil? || DOCKER_HUB_HOSTS.include?(host)
+                docker_hub_creds_key
+              else
+                docker_config_creds.keys.find { |k| parse_registry_host(k) == host }
+              end
+        return if key.nil?
+
+        c = docker_config_creds[key]
+        c.respond_to?(:call) ? c.call : c
+      end
+
       def docker_creds_for_image(image)
         return docker_creds if config[:creds_file]
+        return NO_DOCKER_CREDS unless config[:docker_config_creds]
 
-        image_registry = image.split("/").first
-
-        # NOTE: Try to use DockerHub auth if exact registry match isn't found
-        default_registry = "https://index.docker.io/v1/"
-        if docker_config_creds.key?(image_registry)
-          c = docker_config_creds[image_registry]
-          c.respond_to?(:call) ? c.call : c
-        elsif docker_config_creds.key?(default_registry)
-          c = docker_config_creds[default_registry]
-          c.respond_to?(:call) ? c.call : c
-        end
+        docker_config_creds_for_image(image) || NO_DOCKER_CREDS
       end
 
       def pull_platform_image
@@ -596,18 +653,17 @@ module Kitchen
         end
       end
 
-      def create_container(args)
+      def create_container(args, platform: nil)
         with_retries { @container = ::Docker::Container.get(args["name"], {}, docker_connection) }
       rescue
         with_retries do
           args["Env"] = [] if args["Env"].nil?
           args["Env"] << "TEST_KITCHEN=1"
           args["Env"] << "CI=#{ENV["CI"]}" if ENV.include? "CI"
-          args["Platform"] = config[:platform]
           info "Creating container #{args["name"]}"
           debug "driver - create_container args #{args}"
           with_retries do
-            @container = ::Docker::Container.create(args.clone, docker_connection)
+            @container = create_container_for_platform(args.clone, platform)
           rescue ::Docker::Error::ConflictError
             debug "driver - rescue ConflictError: #{args["name"]}"
             with_retries { @container = ::Docker::Container.get(args["name"], {}, docker_connection) }
@@ -618,8 +674,25 @@ module Kitchen
         end
       end
 
-      def run_container(args)
-        create_container(args)
+      # Create a container, optionally pinned to an OCI platform.
+      #
+      # /containers/create takes `platform` as a *query* parameter, but
+      # Docker::Container.create only ever forwards `name` to the query string
+      # and dumps everything else into the request body. A "Platform" body key
+      # is therefore accepted and silently ignored by the daemon, which is why
+      # the platform config had no effect on container creation. Post directly
+      # when a platform is wanted; otherwise use the gem as before.
+      def create_container_for_platform(args, platform)
+        return ::Docker::Container.create(args, docker_connection) if platform.to_s.empty?
+
+        query = { "name" => args["name"], "platform" => platform }
+        body = args.reject { |k, _| k == "name" }
+        docker_connection.post("/containers/create", query, body: JSON.dump(body))
+        ::Docker::Container.get(args["name"], {}, docker_connection)
+      end
+
+      def run_container(args, platform: nil)
+        create_container(args, platform: platform)
         with_retries do
           @container.start
           @container = ::Docker::Container.get(args["name"], {}, docker_connection)
@@ -664,7 +737,7 @@ module Kitchen
 
       def chef_container_name
         prefix = instance.provisioner[:product_name] == "cinc" ? "cinc" : "chef"
-        config[:platform] != "" ? "#{prefix}-#{chef_version}-" + config[:platform].sub("/", "-") : "#{prefix}-#{chef_version}"
+        config[:platform] != "" ? "#{prefix}-#{chef_version}-" + config[:platform].tr("/", "-") : "#{prefix}-#{chef_version}"
       end
 
       def chef_image
@@ -733,18 +806,24 @@ module Kitchen
             original_image = Docker::Image.get(path, { "platform" => oci_platform(config[:platform]) }, docker_connection)
           end
 
-          new_image = Docker::Image.create({ "fromImage" => path, "platform" => config[:platform] }, docker_creds_for_image(image), docker_connection)
+          new_image = Docker::Image.create({ "fromImage" => path, "platform" => config[:platform] }, docker_creds_for_image(path), docker_connection)
 
           !(original_image&.id&.start_with?(new_image.id))
         end
       end
 
+      # Convert an "os/arch[/variant]" platform string into the JSON OCI
+      # platform spec the Docker API expects as an image filter. The variant
+      # matters: the daemon will not match a filter of
+      # {"os":"linux","architecture":"amd64"} against a linux/amd64/v2 image,
+      # so dropping it makes every image lookup for a variant image miss.
       def oci_platform(platform)
-        if !platform.nil? && platform.include?("/")
-          os, arch = platform.split("/")
-          platform = { os: os, architecture: arch }.to_json
-        end
-        platform
+        return platform if platform.nil? || !platform.include?("/")
+
+        os, architecture, variant = platform.split("/")
+        spec = { os: os, architecture: architecture }
+        spec[:variant] = variant unless variant.nil? || variant.empty?
+        spec.to_json
       end
 
       def runner_container_name

data/lib/kitchen/driver/dokken_version.rb

@@ -18,6 +18,6 @@
 module Kitchen
   module Driver
     # Version string for Dokken Kitchen driver
-    DOKKEN_VERSION = "2.23.1".freeze
+    DOKKEN_VERSION = "2.23.3".freeze
   end
 end

data/lib/kitchen/helpers.rb

@@ -204,9 +204,7 @@ module Dokken
       else
         x = Array(v).map { |a| parse_port(a) }
         x.flatten!
-        x.each_with_object({}) do |y, h|
-          h[y["container_port"]] = {}
-        end
+        x.to_h { |y| [y["container_port"], {}] }
       end
     end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: kitchen-dokken
 version: !ruby/object:Gem::Version
-  version: 2.23.1
+  version: 2.23.3
 platform: ruby
 authors:
 - Sean OMeara
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-05-21 00:00:00.000000000 Z
+date: 2026-07-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: docker-api