[shunping]

Part of #40569

The Dataflow runners hardcode gcr.io/cloud-dataflow/v1beta3 for the default SDK container images. Python and Java also use it when they rewrite cross-language apache/beam* images. Trusted Partner Cloud (TPC) universes have their own registries (e.g. docker.example.com/my-proj/cloud-dataflow/v1beta3), so workers there can't pull these images.

This PR adds an option that replaces that prefix:

SDK	Option
Python	--dataflow_container_base_repository
Java	--dataflowContainerBaseRepository
Go	--dataflow_container_base_repository

• It is used for the default SDK image and for rewriting cross-language apache/beam* images.
• sdk_container_image and sdk_harness_container_image_overrides still take precedence.
• If the option is unset, behavior is unchanged. In Go, cross-language images are only rewritten when the flag is set.

[codecov]

Codecov Report

❌ Patch coverage is 78.72340% with 10 lines in your changes missing coverage. Please review.
✅ Project coverage is 56.38%. Comparing base (76f6e6d) to head (7696ceb).
⚠️ Report is 255 commits behind head on master.

Files with missing lines	Patch %	Lines
sdks/go/pkg/beam/runners/dataflow/dataflow.go	69.69%	7 Missing and 3 partials ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##             master   #40690      +/-   ##
============================================
+ Coverage     56.16%   56.38%   +0.21%     
============================================
  Files          1124      871     -253     
  Lines        178336   154010   -24326     
  Branches       1489        0    -1489     
============================================
- Hits         100170    86841   -13329     
+ Misses        75645    65312   -10333     
+ Partials       2521     1857     -664     

Flag	Coverage Δ
go	28.87% <69.69%> (-0.27%)	⬇️
java	?
python	80.03% <100.00%> (+0.47%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

📋 Review Summary

This PR adds the --dataflow_container_base_repository (--dataflowContainerBaseRepository in Java) pipeline option across the Java, Python, and Go Dataflow runners to allow overriding the base container registry/repository for default SDK and cross-language container images. The implementation is well-structured, consistent across all three SDKs, and includes comprehensive unit test coverage.

🔍 General Feedback

• The option precedence (sdk_container_image > dataflow_container_base_repository > default GCR repository) and trailing-slash normalization are handled cleanly and consistently across Java, Python, and Go.
• In the Python SDK, container prebuilding (--prebuild_sdk_container_engine) currently bypasses --dataflow_container_base_repository when selecting the default base image to build from (see inline comment).

---

💡 Tip: Comment /gemini review on this pull request to trigger a new Gemini code review.

💬 Inline Findings

• sdks/python/apache_beam/options/pipeline_options.py (line 1280): 🟡 Medium: When --prebuild_sdk_container_engine is used on Dataflow without --sdk_container_image, sdk_container_builder._get_cloud_build_id_and_image_name (in sdks/python/apache_beam/runners/portability/sdk_container_builder.py) resolves the base image via environments.DockerEnvironment.default_docker_image() and only rewrites the apache/beam prefix to names.DATAFLOW_CONTAINER_IMAGE_REPOSITORY when sdk_location == 'default'. As a result, prebuilding a container with --dataflow_container_base_repository set will still pull the base image from gcr.io/cloud-dataflow/v1beta3 (or apache/beam), which will fail in restricted environments where only the custom mirror repository is accessible. Consider using apiclient.get_container_image_from_options(pipeline_options) (or get_container_base_repository_from_options) when determining the default base image in sdk_container_builder.py.

• runners/google-cloud-dataflow-java/src/main/java/org/apache/beam/runners/dataflow/options/DataflowPipelineWorkerPoolOptions.java (line 150): 🟢 Low: For consistency with other optional string getters in this interface (and since getDataflowContainerBaseRepository() returns null when unset, as checked in DataflowRunner.getContainerImageForJob), consider annotating the return type with @Nullable.

  @Nullable String getDataflowContainerBaseRepository();

[github-actions]

Assigning reviewers:

R: @jrmccluskey for label python.
Backup reviewer: damccorm (if the main reviewer is unresponsive, you can escalate to them by tagging their username)

Note: If you would like to opt out of this review, comment assign to next reviewer.

Available commands:

• stop reviewer notifications - opt out of the automated review tooling
• remind me after tests pass - tag the comment author after tests pass
• waiting on author - shift the attention set back to the author (any comment or push by the author will return the attention set to the reviewers)

The PR bot will only process comments in the main thread (not review comments).

[jrmccluskey]

+1 to model findings, otherwise LGTM

[shunping]

sdks/python/apache_beam/options/pipeline_options.py (line 1280): 🟡 Medium: When --prebuild_sdk_container_engine is used on Dataflow without --sdk_container_image, sdk_container_builder._get_cloud_build_id_and_image_name (in sdks/python/apache_beam/runners/portability/sdk_container_builder.py) resolves the base image via environments.DockerEnvironment.default_docker_image() and only rewrites the apache/beam prefix to names.DATAFLOW_CONTAINER_IMAGE_REPOSITORY when sdk_location == 'default'. As a result, prebuilding a container with --dataflow_container_base_repository set will still pull the base image from gcr.io/cloud-dataflow/v1beta3 (or apache/beam), which will fail in restricted environments where only the custom mirror repository is accessible. Consider using apiclient.get_container_image_from_options(pipeline_options) (or get_container_base_repository_from_options) when determining the default base image in sdk_container_builder.py.

Good catch on the gap, though the details differ: the prebuild base image comes from SdkContainerImageBuilder.__init__ (sdk_container_image or apache/beam_python3.X_sdk:<ver> on Docker Hub), not from gcr.io or a non-existent _get_cloud_build_id_and_image_name helper. Fixed in dataflow_runner.py to consider --dataflow_container_base_repository when it is set.

runners/google-cloud-dataflow-java/src/main/java/org/apache/beam/runners/dataflow/options/DataflowPipelineWorkerPoolOptions.java (line 150): 🟢 Low: For consistency with other optional string getters in this interface (and since getDataflowContainerBaseRepository() returns null when unset, as checked in DataflowRunner.getContainerImageForJob), consider annotating the return type with @nullable.

Done: annotated the getter and setter with @nullable

[jrmccluskey]

LGTM