feat(mirror): add $registry placeholder for repoPrefix templating (#208)

* feat(mirror): add $registry placeholder for repoPrefix templating

* fix(mirror): fix nil pointer in $registry integration test

Author: matzegebbe

README.md

@@ -174,6 +174,7 @@ When a `repoPrefix` is configured (via config file or environment variables), th
 - `$podname` — Name of the owning resource (or Pod when available).
 - `$container_name` — Container name that uses the image.
 - `$arch` — Architecture of the mirrored image. When `digestPull` is enabled this is the architecture of the selected manifest (for example `amd64`). When mirroring a manifest list, the placeholder expands to a hyphen-separated list of all mirrored architectures (for example `386-amd64-arm64-ppc64le-riscv64-s390x`). If copycat cannot determine the architecture it leaves the segment blank.
+- `$registry` — Source registry of the image (for example `ghcr.io` or `quay.io`). Images from Docker Hub (including short names like `nginx`) are normalised to `docker.io`.
 
 For example, setting `repoPrefix: "$namespace/$podname"` keeps target repositories unique across namespaces even when multiple workloads reference the same source image. To separate images by architecture you can combine placeholders:
 

internal/mirror/pusher.go

@@ -52,6 +52,7 @@ type Metadata struct {
 	Architecture  string
 	OS            string
 	ImageID       string
+	Registry      string
 }
 
 type platformSpec struct {
@@ -348,6 +349,16 @@ func (p *pusher) Mirror(ctx context.Context, src string, meta Metadata) error {
 		return fmt.Errorf("parse source: %w", err)
 	}
 
+	// Populate source registry in metadata for repoPrefix templating.
+	if meta.Registry == "" {
+		reg := srcRef.Context().RegistryStr()
+		// Normalize Docker Hub registry to docker.io.
+		if reg == name.DefaultRegistry {
+			reg = "docker.io"
+		}
+		meta.Registry = reg
+	}
+
 	// Build target repo path
 	srcRepo := srcRef.Context().RepositoryStr()
 	repo := p.resolveRepoPath(srcRepo, meta)
@@ -1459,6 +1470,7 @@ func expandRepoPrefix(prefix string, meta Metadata) string {
 		"$podname", meta.PodName,
 		"$container_name", meta.ContainerName,
 		"$arch", meta.Architecture,
+		"$registry", meta.Registry,
 	)
 	expanded := replacer.Replace(prefix)
 	expanded = strings.TrimSpace(expanded)

internal/mirror/pusher_test.go

@@ -188,6 +188,19 @@ func TestResolveRepoPathWithArchitectureMetadata(t *testing.T) {
 	}
 }
 
+func TestResolveRepoPathWithRegistryMetadata(t *testing.T) {
+	p := &pusher{
+		target:    fakeTarget{prefix: "$registry/$namespace"},
+		transform: util.CleanRepoName,
+	}
+
+	repo := p.resolveRepoPath("library/nginx", Metadata{Namespace: "prod", Registry: "ghcr.io"})
+	want := "ghcr.io/prod/library/nginx"
+	if repo != want {
+		t.Fatalf("expected %q, got %q", want, repo)
+	}
+}
+
 func TestDryPullOption(t *testing.T) {
 	p := NewPusher(fakeTarget{}, true, true, nil, testr.New(t), nil, 0, 0, false, true, nil, nil)
 
@@ -514,6 +527,66 @@ func TestMirrorSkipsExcludedRegistry(t *testing.T) {
 	}
 }
 
+func TestMirrorPopulatesRegistryMetadataFromSource(t *testing.T) {
+	cases := []struct {
+		name     string
+		source   string
+		wantRepo string
+	}{
+		{
+			name:     "docker hub image normalizes to docker.io",
+			source:   "docker.io/library/nginx:1.28",
+			wantRepo: "example.com/docker.io/default/library/nginx:1.28",
+		},
+		{
+			name:     "ghcr.io image preserves registry",
+			source:   "ghcr.io/org/app:v1",
+			wantRepo: "example.com/ghcr.io/default/org/app:v1",
+		},
+		{
+			name:     "quay.io image preserves registry",
+			source:   "quay.io/prometheus/node-exporter:latest",
+			wantRepo: "example.com/quay.io/default/prometheus/node-exporter:latest",
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			originalGet := remoteGetFunc
+			remoteGetFunc = func(ref name.Reference, _ ...remote.Option) (*remote.Descriptor, error) {
+				return nil, errors.New("stop after target resolution")
+			}
+			t.Cleanup(func() { remoteGetFunc = originalGet })
+
+			// Use a custom logger to capture the target from log output.
+			var logMu sync.Mutex
+			var logMessages []string
+			logger := funcr.New(func(prefix, args string) {
+				logMu.Lock()
+				defer logMu.Unlock()
+				logMessages = append(logMessages, prefix+args)
+			}, funcr.Options{Verbosity: 10})
+
+			p := NewPusher(fakeTarget{prefix: "$registry/$namespace"}, false, false, nil, logger, nil, 0, 0, false, true, nil, nil)
+
+			_ = p.Mirror(context.Background(), tc.source, Metadata{Namespace: "default"})
+
+			logMu.Lock()
+			defer logMu.Unlock()
+			found := false
+			for _, msg := range logMessages {
+				if strings.Contains(msg, tc.wantRepo) {
+					found = true
+					break
+				}
+			}
+			if !found {
+				t.Fatalf("expected target %q in log output, got messages: %v", tc.wantRepo, logMessages)
+			}
+		})
+	}
+}
+
 func TestMirrorSkipsWithoutPodDigestWhenDigestPullEnabled(t *testing.T) {
 	p := &pusher{
 		target:         fakeTarget{prefix: "$namespace"},
@@ -627,6 +700,30 @@ func TestExpandRepoPrefixSkipsEmptySegments(t *testing.T) {
 			meta: Metadata{Namespace: "default", Architecture: "amd64"},
 			want: "amd64/default",
 		},
+		{
+			name: "registry placeholder with ghcr",
+			pref: "$registry/$namespace",
+			meta: Metadata{Namespace: "prod", Registry: "ghcr.io"},
+			want: "ghcr.io/prod",
+		},
+		{
+			name: "registry placeholder with docker.io",
+			pref: "$registry/$namespace",
+			meta: Metadata{Namespace: "prod", Registry: "docker.io"},
+			want: "docker.io/prod",
+		},
+		{
+			name: "registry placeholder omitted when empty",
+			pref: "$registry/$namespace",
+			meta: Metadata{Namespace: "prod"},
+			want: "prod",
+		},
+		{
+			name: "all placeholders including registry",
+			pref: "$registry/$namespace/$arch",
+			meta: Metadata{Namespace: "team-a", Architecture: "arm64", Registry: "quay.io"},
+			want: "quay.io/team-a/arm64",
+		},
 	}
 
 	for _, tc := range cases {