Use Desktop proxy for OCI registry operations

Assisted-By: docker-agent

Author: gtardif

cmd/root/push.go

@@ -51,7 +51,7 @@ func runPushCommand(cmd *cobra.Command, args []string) error {
 
 	out.Printf("Pushing agent %s to %s\n", agentFilename, tag)
 
-	err = remote.Push(tag)
+	err = remote.Push(ctx, tag)
 	if err != nil {
 		return fmt.Errorf("failed to push artifact: %w", err)
 	}

pkg/remote/pull.go

@@ -12,7 +12,7 @@ import (
 
 // Pull pulls an artifact from a registry and stores it in the content store
 func Pull(ctx context.Context, registryRef string, force bool, opts ...crane.Option) (string, error) {
-	opts = append(opts, crane.WithContext(ctx))
+	opts = append(opts, crane.WithContext(ctx), crane.WithTransport(newTransport(ctx)))
 
 	ref, err := name.ParseReference(registryRef)
 	if err != nil {

pkg/remote/pull_test.go

@@ -68,7 +68,7 @@ func TestPullIntegration(t *testing.T) {
 	require.NoError(t, err)
 	assert.NotNil(t, retrievedImg)
 
-	err = Push("invalid:reference:with:too:many:colons")
+	err = Push(t.Context(), "invalid:reference:with:too:many:colons")
 	require.Error(t, err)
 }
 

pkg/remote/push.go

@@ -1,6 +1,7 @@
 package remote
 
 import (
+	"context"
 	"fmt"
 
 	"github.com/google/go-containerregistry/pkg/crane"
@@ -13,7 +14,7 @@ import (
 )
 
 // Push pushes an artifact from the content store to an OCI registry
-func Push(reference string) error {
+func Push(ctx context.Context, reference string) error {
 	store, err := content.NewStore()
 	if err != nil {
 		return fmt.Errorf("creating content store: %w", err)
@@ -45,7 +46,7 @@ func Push(reference string) error {
 		return fmt.Errorf("parsing registry reference %s: %w", reference, err)
 	}
 
-	if err := crane.Push(img, ref.String()); err != nil {
+	if err := crane.Push(img, ref.String(), crane.WithContext(ctx), crane.WithTransport(newTransport(ctx))); err != nil {
 		return fmt.Errorf("pushing image to registry %s: %w", reference, err)
 	}
 

pkg/remote/push_test.go

@@ -38,18 +38,18 @@ func TestPush(t *testing.T) {
 	require.NoError(t, err)
 	assert.NotNil(t, loadedImg)
 
-	err = Push("invalid:reference:with:too:many:colons")
+	err = Push(t.Context(), "invalid:reference:with:too:many:colons")
 	require.Error(t, err)
 
-	err = Push("invalid:reference:with:too:many:colons")
+	err = Push(t.Context(), "invalid:reference:with:too:many:colons")
 	require.Error(t, err)
 }
 
 func TestPushNonExistentArtifact(t *testing.T) {
-	err := Push("registry.example.com/test:latest")
+	err := Push(t.Context(), "registry.example.com/test:latest")
 	require.Error(t, err)
 
-	err = Push("registry.example.com/test:latest")
+	err = Push(t.Context(), "registry.example.com/test:latest")
 	require.Error(t, err)
 }
 

pkg/remote/transport.go

@@ -0,0 +1,34 @@
+package remote
+
+import (
+	"context"
+	"net"
+	"net/http"
+	"net/url"
+
+	"github.com/docker/docker-agent/pkg/desktop"
+	socket "github.com/docker/docker-agent/pkg/desktop/socket"
+)
+
+// newTransport returns an HTTP transport that uses Docker Desktop proxy if available.
+func newTransport(ctx context.Context) http.RoundTripper {
+	t, ok := http.DefaultTransport.(*http.Transport)
+	if !ok {
+		return http.DefaultTransport
+	}
+	transport := t.Clone()
+
+	if desktop.IsDockerDesktopRunning(ctx) {
+		// Route all traffic through Docker Desktop's HTTP proxy socket
+		// Set a dummy proxy URL - the actual connection happens via DialContext
+		transport.Proxy = http.ProxyURL(&url.URL{
+			Scheme: "http",
+		})
+		// Override the dialer to connect to the Unix socket for the proxy
+		transport.DialContext = func(ctx context.Context, network, addr string) (net.Conn, error) {
+			return socket.DialUnix(desktop.Paths().ProxySocket)
+		}
+	}
+
+	return transport
+}

pkg/remote/transport_test.go

@@ -0,0 +1,56 @@
+package remote
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/docker/docker-agent/pkg/desktop"
+)
+
+func TestNewTransport_UsesDesktopProxyWhenAvailable(t *testing.T) {
+	t.Parallel()
+
+	ctx := t.Context()
+
+	// Create a transport
+	transport := newTransport(ctx)
+	require.NotNil(t, transport)
+
+	// Verify that it's an http.Transport
+	httpTransport, ok := transport.(*http.Transport)
+	require.True(t, ok, "transport should be *http.Transport")
+
+	// If Docker Desktop is running, verify proxy is configured
+	if desktop.IsDockerDesktopRunning(ctx) {
+		assert.NotNil(t, httpTransport.Proxy, "proxy should be configured when Docker Desktop is running")
+		assert.NotNil(t, httpTransport.DialContext, "custom DialContext should be set when Docker Desktop is running")
+	}
+}
+
+func TestNewTransport_WorksWithoutDesktopProxy(t *testing.T) {
+	t.Parallel()
+
+	// Create a test server to simulate a registry
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer server.Close()
+
+	ctx := t.Context()
+
+	// Create a transport (should work whether Desktop is running or not)
+	transport := newTransport(ctx)
+	require.NotNil(t, transport)
+
+	// Make a simple HTTP request to verify the transport works
+	client := &http.Client{Transport: transport}
+	resp, err := client.Get(server.URL)
+	require.NoError(t, err)
+	defer resp.Body.Close()
+
+	assert.Equal(t, http.StatusOK, resp.StatusCode)
+}