Conversation
WalkthroughThe changes introduce support for insecure Docker registry connections for OCI-based gRPC plugins. Environment variables, configuration structures, and registry connection logic are updated to enable plain-HTTP registry access for local development workflows. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes 🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
Comment |
Codecov Report❌ Patch coverage is
❌ Your patch check has failed because the patch coverage (0.00%) is below the target coverage (90.00%). You can increase the patch coverage or adjust the target coverage. Additional details and impacted files@@ Coverage Diff @@
## main #2778 +/- ##
===========================================
- Coverage 64.45% 51.83% -12.63%
===========================================
Files 311 364 +53
Lines 44295 37100 -7195
Branches 4764 467 -4297
===========================================
- Hits 28551 19229 -9322
- Misses 15721 16400 +679
- Partials 23 1471 +1448
🚀 New features to boost your workflow:
|
Router image scan passed✅ No security vulnerabilities found in image: |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@docker-compose.yml`:
- Around line 382-383: The docker-compose ports mapping currently publishes the
registry on all interfaces via the line '- '5050:5000'', exposing an insecure
unauthenticated registry to the LAN; change that mapping to bind to loopback by
replacing the host portion with 127.0.0.1 (i.e., update the '- '5050:5000''
ports entry to use 127.0.0.1:5050:5000') so the registry listens only on
localhost.
In `@router/.env.example`:
- Around line 15-18: Dotenv-linter flags UnorderedKey because the plugin env
variables are not alphabetically ordered; reorder the three keys so they are
alphabetical (PLUGINS_ENABLED, PLUGINS_REGISTRY_INSECURE, PLUGINS_REGISTRY_URL)
while preserving their values (e.g., true/localhost:5050) so the dotenv-linter
no longer reports UnorderedKey for PLUGINS_REGISTRY_URL,
PLUGINS_REGISTRY_INSECURE, and PLUGINS_ENABLED.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: eeebaee6-477f-40bb-bb58-0aa34c5e7a67
📒 Files selected for processing (7)
cli/.env.exampledocker-compose.ymlrouter-tests/testenv/testenv.gorouter/.env.examplerouter/core/graph_server.gorouter/pkg/config/config.gorouter/pkg/grpcconnector/grpcpluginoci/grpc_oci_plugin.go
| ports: | ||
| - '5050:5000' |
There was a problem hiding this comment.
Bind local registry port to loopback to avoid LAN exposure.
Given this registry is intentionally unauthenticated/insecure, publishing on all interfaces is risky.
Safer port mapping
- - '5050:5000'
+ - '127.0.0.1:5050:5000'📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| ports: | |
| - '5050:5000' | |
| ports: | |
| - '127.0.0.1:5050:5000' |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@docker-compose.yml` around lines 382 - 383, The docker-compose ports mapping
currently publishes the registry on all interfaces via the line '- '5050:5000'',
exposing an insecure unauthenticated registry to the LAN; change that mapping to
bind to loopback by replacing the host portion with 127.0.0.1 (i.e., update the
'- '5050:5000'' ports entry to use 127.0.0.1:5050:5000') so the registry listens
only on localhost.
| # For local plugin development with docker-compose registry, set: | ||
| PLUGINS_REGISTRY_URL=localhost:5050 | ||
| PLUGINS_REGISTRY_INSECURE=true | ||
| PLUGINS_ENABLED=true |
There was a problem hiding this comment.
Fix .env key ordering to satisfy dotenv-linter warnings.
Current order triggers UnorderedKey warnings.
Suggested reorder
-PLUGINS_REGISTRY_URL=localhost:5050
-PLUGINS_REGISTRY_INSECURE=true
-PLUGINS_ENABLED=true
+PLUGINS_ENABLED=true
+PLUGINS_REGISTRY_INSECURE=true
+PLUGINS_REGISTRY_URL=localhost:5050📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| # For local plugin development with docker-compose registry, set: | |
| PLUGINS_REGISTRY_URL=localhost:5050 | |
| PLUGINS_REGISTRY_INSECURE=true | |
| PLUGINS_ENABLED=true | |
| # For local plugin development with docker-compose registry, set: | |
| PLUGINS_ENABLED=true | |
| PLUGINS_REGISTRY_INSECURE=true | |
| PLUGINS_REGISTRY_URL=localhost:5050 |
🧰 Tools
🪛 dotenv-linter (4.0.0)
[warning] 17-17: [UnorderedKey] The PLUGINS_REGISTRY_INSECURE key should go before the PLUGINS_REGISTRY_URL key
(UnorderedKey)
[warning] 18-18: [UnorderedKey] The PLUGINS_ENABLED key should go before the PLUGINS_REGISTRY_INSECURE key
(UnorderedKey)
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@router/.env.example` around lines 15 - 18, Dotenv-linter flags UnorderedKey
because the plugin env variables are not alphabetically ordered; reorder the
three keys so they are alphabetical (PLUGINS_ENABLED, PLUGINS_REGISTRY_INSECURE,
PLUGINS_REGISTRY_URL) while preserving their values (e.g., true/localhost:5050)
so the dotenv-linter no longer reports UnorderedKey for PLUGINS_REGISTRY_URL,
PLUGINS_REGISTRY_INSECURE, and PLUGINS_ENABLED.
comatory
requested review from
a team,
Aenimus,
JivusAyrus,
Noroth,
SkArchon,
StarpTech,
devsergiy,
endigma,
jensneuse and
wilsonrivera
as code owners
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Claude Code Review
This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.
Tip: disable this comment in your organization's Code Review settings.
1 participant
When developing #2750, it was not straightforward to test the functionality of publishing gRPC plugins and have them loaded in local instance of the router. The work-around was to use non-public staging registry, which required modifications to docker compose files.
This change adds a new service to the compose file
registry-2which serves as mock docker registry. The goal is to simplify local development in two ways:pnpm wgc router plugin publish ...make start-router(given that correct router token is provided)Caveats
You must provide
PLUGIN_REGISTRY_URLaccording to environment example files. Insecure access to docker registry must be set in the docker configuration. Our setup assumes Orbstack, so this"insecure-registries": ["host.docker.internal:5050"]needs to be added to the docker config.@coderabbitai summary
How to test this change
make infra-downmake infra-uplocalhost:3002/graphqland--label-matcher graph=demo. Publish subgraphs associated with that graph (I'm using cosmo-onboarding repo, use the plugins inplugins/directory):pnpm wgc router plugin publish --name <products-2|reviews> <path-to-local-folder> --label graph=demo --platform linux/amd64 linux/arm64 darwin/arm64(I'm on mac so Darwin is required).GRAPH_API_TOKEN=<new-token> make start-routerChecklist
Open Source AI Manifesto
This project follows the principles of the Open Source AI Manifesto. Please ensure your contribution aligns with its principles.