fix(registry): preserve mirror URL path prefix when resolving/pulling backend images

[ilopezluna]

Context

Follow-up to #974, which routed the llama.cpp backend tag→digest resolution through the mirror-aware containerd resolver. While diagnosing CSESC-1468 on the latest logs, the backend pull still failed with a 403 Forbidden HEAD to registry-1.docker.io, even though the mirror was configured and active.

Root cause: registryutil.RegistryHosts dropped the path component of the configured mirror URL and hardcoded the Registry v2 API root to /v2 on the bare host. A mirror served under a path prefix — notably a JFrog Artifactory repository path like /artifactory/api/docker/<repo> — was therefore queried at the host root (<host>/v2/...), missed, and the resolver fell through to the upstream registry-1.docker.io, which 403s behind the corporate proxy. The upstream 403 masked the real (silent) mirror miss.

This is independent of #974 and affects both code paths that build hosts via RegistryHosts: tag resolution (ResolveDigest) and the image pull (PullPlatform).

Changes

• Preserve the mirror path — RegistryHosts now builds Path = strings.TrimRight(u.Path, "/") + "/v2" instead of forcing /v2 on the bare host. A mirror https://host/artifactory/api/docker/<repo> now resolves manifests at https://host/artifactory/api/docker/<repo>/v2/<name>/manifests/<ref>.
• Robust scheme-less parsing — a mirror given without a scheme (e.g. host:5000/path) parses with an empty Host and the whole value in Path; re-parse it as https://… so host and path are separated correctly (the previous code put the entire string into Host).
• Mirrors with no path keep the prior /v2 behavior.

Tests

• pkg/internal/registryutil/mirrors_test.go (new) — table-driven coverage of the resulting Host/Scheme/Path across mirror forms (path prefix, trailing slash, no path, scheme-less with/without path, http scheme), plus the upstream fallback ordering and the non-Docker-Hub bypass.
• pkg/internal/dockerhub/download_test.go — TestResolveDigest_UsesMirrorPathPrefix: an httptest registry that serves only under /artifactory/docker/v2 (404 at the host root), so it fails if the path-preserving behavior regresses.

Verification

• go build ./..., go vet ./pkg/internal/registryutil/... ./pkg/internal/dockerhub/...
• go test ./pkg/internal/registryutil/... ./pkg/internal/dockerhub/... (goleak clean)

Note

This fix is necessary but not sufficient on its own for the CSESC-1468 customer: they still need to identify the exact URL at which their Artifactory exposes a compatible Docker Registry v2 API (their /artifactory/docker/v2/ returned 404). Once that base URL is configured as the mirror, this change ensures Model Runner honors its path.

🤖 Generated with Claude Code

[gemini-code-assist]

Code Review

This pull request adds support for preserving path prefixes on registry mirrors (such as JFrog Artifactory) and improves the parsing of scheme-less mirror URLs, accompanied by comprehensive tests. The review feedback correctly identifies a critical parsing bug where scheme-less mirrors using IP addresses with ports (e.g., 127.0.0.1:5000) will fail to parse and be silently skipped. Refactoring the URL parsing logic to prepend the scheme before parsing and adding a corresponding test case is highly recommended to resolve this issue.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[sourcery-ai]

Hey - I've found 1 issue

Prompt for AI Agents

Please address the comments from this code review:

## Individual Comments

### Comment 1
<location path="pkg/internal/registryutil/mirrors.go" line_range="59" />
<code_context>
+			// repository path "/artifactory/api/docker/<repo>") and append the
+			// Registry v2 API root. Without this, a mirror configured with a path
+			// would be queried at the host root and fail.
+			path := strings.TrimRight(u.Path, "/") + "/v2"
 			hosts = append(hosts, docker.RegistryHost{
 				Client:       mirrorClient,
</code_context>
<issue_to_address>
**issue (bug_risk):** Path handling may produce a duplicated `/v2` segment for mirrors already configured with a `/v2` suffix.

For mirrors whose configured path already ends with `/v2` (e.g. `https://host/artifactory/api/docker/repo/v2`), this will produce `/artifactory/api/docker/repo/v2/v2`. Consider guarding against this by only appending `/v2` when the path does not already have that suffix (e.g. via `strings.HasSuffix(u.Path, "/v2")`).
</issue_to_address>

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[ilopezluna]

@sourcery-ai review

[sourcery-ai]

Hey - I've left some high level feedback:

• The scheme-less mirror handling and path suffix logic in RegistryHosts is becoming a bit dense; consider extracting the parsing/normalization of the mirror URL into a small helper to make the behavior and edge cases (e.g., existing /v2 suffixes, scheme defaults) easier to reason about and maintain.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- The scheme-less mirror handling and path suffix logic in `RegistryHosts` is becoming a bit dense; consider extracting the parsing/normalization of the mirror URL into a small helper to make the behavior and edge cases (e.g., existing `/v2` suffixes, scheme defaults) easier to reason about and maintain.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[ilopezluna]

Thanks @sourcery-ai — extracted the mirror URL normalization (scheme defaulting, path-prefix preservation, /v2 suffix handling) into a documented parseMirror helper in db8f0c4, keeping the RegistryHosts loop small. No behavior change; existing tests still cover the edge cases.

[ilopezluna]

@sourcery-ai review

[sourcery-ai]

Hey - I've reviewed your changes and they look great!

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}