docker: trust the mesh's registry from the runtime's own module (hq ADR 0222, issue 190 — 2 of 3) #72

2026-10-05T20:22:40Z

mesh-admin commented

2026-10-05 20:22:40 +00:00

The daemon resource becomes {"live-restore": true, "insecure-registries": ["${seat:mesh-artifact-store:reach}"]} (still into: json; runtime still reloads on it). README updated: the overlay's "still elsewhere" note for insecure-registries is gone, the order it lands in is written down.

Merge order (issue 190):

mesh-controller #62 (the placeholder) — merged and deployed first. A controller that does not know ${seat:…:reach} would send it through unfilled and the runtime would be told to trust the literal string.
this PR
mesh-controller (overlay stops generating registry-trust/registry-trust-reload; collision check over generated resources) — after this one.

Between 2 and 3 both the overlay and docker declare the same member; the host tolerates that (the member stays the overlay's record's, docker finds it present). In 3's apply the host removes the overlay's record first (member leaves the list) and then applies docker's (member added back, recorded as docker's); one reload. Pinned by the mesh-host PR's test.

Tests: go test ./... in modules/docker passes; mesh-controller with this branch as its sibling passes (TestTheRuntimesModuleTrustsTheMeshsRegistry in controller PR 3 composes this manifest).

The `daemon` resource becomes `{"live-restore": true, "insecure-registries": ["${seat:mesh-artifact-store:reach}"]}` (still `into: json`; `runtime` still reloads on it). README updated: the overlay's "still elsewhere" note for `insecure-registries` is gone, the order it lands in is written down. **Merge order (issue 190):** 1. mesh-controller #62 (the placeholder) — merged **and deployed** first. A controller that does not know `${seat:…:reach}` would send it through unfilled and the runtime would be told to trust the literal string. 2. **this PR** 3. mesh-controller (overlay stops generating `registry-trust`/`registry-trust-reload`; collision check over generated resources) — after this one. Between 2 and 3 both the overlay and docker declare the same member; the host tolerates that (the member stays the overlay's record's, docker finds it present). In 3's apply the host removes the overlay's record first (member leaves the list) and then applies docker's (member added back, recorded as docker's); one reload. Pinned by the mesh-host PR's test. Tests: `go test ./...` in modules/docker passes; mesh-controller with this branch as its sibling passes (`TestTheRuntimesModuleTrustsTheMeshsRegistry` in controller PR 3 composes this manifest).

mesh-admin added 1 commit 2026-10-05 20:22:40 +00:00

docker: trust the mesh's registry from the runtime's own module (hq issue 190) 964a4fdfbc

The controller's private network writes insecure-registries into daemon.json, a file this
module owns. The runtime's module states it instead, through ${seat:mesh-artifact-store:reach}
(hq ADR 0222), so the controller can stop generating its registry-trust resources.

mesh-admin merged commit 5c89eaf9a6 into main

2026-10-05 20:39:05 +00:00

mesh-admin deleted branch fix/190-docker-insecure-registries

2026-10-05 20:39:05 +00:00

mesh-admin commented

2026-10-06 23:08:40 +00:00

Delivery novox/mesh-catalog@5c89eaf9a64c — held since 2026-10-06T23:05:28Z

Held for a person: merged without a passing check: only a person decides that it goes on — mesh-delivery.release with why lets it go on.

Delivery plan — builds docker → ace, g14, novox, shanks; no bus step

tier 0: docker
ace: receives docker
g14: receives docker
novox: receives docker
shanks: receives docker

Transitions

2026-10-06 23:05 (new) → proposed (announced): novox/mesh-catalog#72 merged; its head was not heard by this owner, so it is made from the forge's word
2026-10-06 23:05 proposed → held (merged-unchecked): merged without a passing check — a verdict known with it is taken first: only a person decides that it goes on

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

**Delivery** `novox/mesh-catalog@5c89eaf9a64c` — **held** since 2026-10-06T23:05:28Z Held for a person: merged without a passing check: only a person decides that it goes on — `mesh-delivery.release` with why lets it go on. **Delivery plan** — builds docker → ace, g14, novox, shanks; no bus step - tier 0: docker - ace: receives docker - g14: receives docker - novox: receives docker - shanks: receives docker **Transitions** - 2026-10-06 23:05 (new) → proposed (announced): novox/mesh-catalog#72 merged; its head was not heard by this owner, so it is made from the forge's word - 2026-10-06 23:05 proposed → held (merged-unchecked): merged without a passing check — a verdict known with it is taken first: only a person decides that it goes on The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

mesh-tools referenced this pull request

2026-10-23 13:52:46 +00:00

Checks under 5 minutes (mesh-build-go): siblings only in the digests that read them, selected dirs in a pool, a mirror and verify once, and a change judged by its own build module (issues 1896, 890, 1898; ADR 0535, 0536) #460

mesh-tools referenced this pull request

2026-10-26 14:45:22 +00:00

An approved group merges whole or not at all, and two groups never interleave in one repository (issue 1275) #501

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-catalog#72