feat(supervisor): optional image registry rewrite for run pods

[nicktrn]

Adds an optional registry rewrite for run pod images, so a supervisor can pull a run's image from a registry host of your choosing.

Off by default and inert unless both ends are set:

KUBERNETES_IMAGE_REGISTRY_REWRITE_FROM
KUBERNETES_IMAGE_REGISTRY_REWRITE_TO

When both are set, a run pod image whose host matches FROM has that host replaced with TO; everything after the host - repository, tag, digest - is untouched. Anything else passes through unchanged. It sits beside the existing KUBERNETES_STRIP_IMAGE_DIGEST transform and follows the same shape.

The rewrite is applied where the pod spec is built, so the final host is present in the spec from the start and image pull credentials resolve against the host that is actually contacted.

Matching

The match is an exact host-prefix test (FROM followed by /), not a regex, so a look-alike host cannot be matched by accident:

<from>/some/repo:tag                   rewritten
<from>.example.org/some/repo:tag       untouched
registry.example.com/<from>/repo:tag   untouched
ghcr.io/some/other:tag                 untouched

Tests

imageRegistry.test.ts covers the rewrite, digest preservation, both half-configured cases, unrelated registries, and the two host-boundary cases above.

The rewrite lives in its own module rather than in kubernetes.ts, because that module parses the environment at import time and a unit test cannot satisfy that.

Verified with vitest run ./src/workloadManager/ (30 tests across 3 files), plus typecheck --filter supervisor, format and lint. The boundary assertion was mutation-checked - relaxing the match to a bare prefix makes it fail - so it is not passing by construction.

No changeset or .server-changes/ note: this is off by default and changes nothing a user would notice.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 4745a29

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 58a63263-2f1f-4123-a998-0d697e23c0af

📥 Commits

Reviewing files that changed from the base of the PR and between a36be18 and 4745a29.

📒 Files selected for processing (2)

• apps/supervisor/src/env.ts
• apps/supervisor/src/workloadManager/kubernetes.ts

🚧 Files skipped from review as they are similar to previous changes (2)

• apps/supervisor/src/env.ts
• apps/supervisor/src/workloadManager/kubernetes.ts

Included review availability: Your plan includes up to 10 reviews per rolling hour; 7 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (6)

• GitHub Check: typecheck / typecheck
• GitHub Check: code-quality / code-quality
• GitHub Check: audit
• GitHub Check: audit
• GitHub Check: Analyze (actions)
• GitHub Check: Analyze (javascript-typescript)

---

Walkthrough

Adds optional environment variables for Kubernetes image registry rewriting. Adds rewriteImageRegistry with guards for missing configuration and host-boundary matching. Adds tests for rewrites, no-op cases, digest preservation, and unrelated registries. Applies the rewrite to the digest-stripped runner container image during Kubernetes workload creation.

Merge Risk: ⚪ Minimal · up to 4745a

This adds an opt-in image registry rewrite without changing default behavior; no actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the optional image registry rewrite added for supervisor run pods.
Description check	✅ Passed	The description clearly covers the change, configuration, matching behavior, testing, and user impact, but omits the template checklist, issue reference, and screenshots sections.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/supervisor-image-registry-rewrite

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.