Merge branch 'main' into buildkit-providerless

Author: DDtKey

.cargo/audit.toml

@@ -0,0 +1,9 @@
+[advisories]
+ignore = [
+  # This advisory comes from `russh -> rsa` which is optional dependency
+  "RUSTSEC-2023-0071",
+]
+
+[output]
+deny = ["warnings"]
+quiet = false

.github/workflows/audit.yml

@@ -0,0 +1,20 @@
+name: Security audit
+on:
+  workflow_dispatch:
+  push:
+    paths: 
+      - '**/Cargo.toml'
+      - '**/Cargo.lock'
+jobs:
+  security_audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Generate Cargo.lock if doesn't exist
+        run: |
+          if [ ! -f Cargo.lock ]; then
+            cargo generate-lockfile
+          fi
+      - uses: rustsec/[email protected]
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/ci.yml

@@ -31,10 +31,8 @@ jobs:
       - uses: taiki-e/install-action@v2
         with:
           tool: cargo-hack
-      - name: Build (without host-port-exposure)
-        run: cargo hack build --feature-powerset --depth 2 --keep-going --exclude-features host-port-exposure
-      - name: Build (host-port-exposure with TLS backend)
-        run: cargo hack build --feature-powerset --depth 2 --keep-going --include-features host-port-exposure,ring,aws-lc-rs --at-least-one-of ring,aws-lc-rs
+      - name: Build
+        run: cargo hack build --feature-powerset --depth 2 --clean-per-run
 
   test:
     name: Test
@@ -68,10 +66,8 @@ jobs:
       - uses: taiki-e/install-action@v2
         with:
           tool: cargo-hack
-      - name: Tests (without host-port-exposure)
-        run: cargo hack test --feature-powerset --depth 2 --clean-per-run --partition ${{ matrix.partition }} --exclude-features host-port-exposure
-      - name: Tests (host-port-exposure with TLS backend)
-        run: cargo hack test --feature-powerset --depth 2 --clean-per-run --partition ${{ matrix.partition }} --include-features host-port-exposure,ring,aws-lc-rs --at-least-one-of ring,aws-lc-rs
+      - name: Tests
+        run: cargo hack test --feature-powerset --depth 2 --clean-per-run --partition ${{ matrix.partition }}
 
   fmt:
     name: Rustfmt check

CHANGELOG.md

@@ -2,6 +2,42 @@
 
 All notable changes to this project will be documented in this file.
 
+## [0.25.2] - 2025-10-27
+### Details
+#### Features
+- Platform config passing through ImageExt trait ([#838](https://github.com/testcontainers/testcontainers-rs/pull/838))
+
+#### Miscellaneous Tasks
+- Remove usage of reqwest hickory dns feature ([#860](https://github.com/testcontainers/testcontainers-rs/pull/860))
+- Drop weak dependencies due to cargo bug ([#862](https://github.com/testcontainers/testcontainers-rs/pull/862))
+
+## [0.25.1] - 2025-10-27
+### Details
+#### Bug Fixes
+- Replace tokio-tar with astral-tokio-tar ([#852](https://github.com/testcontainers/testcontainers-rs/pull/852))
+
+#### Documentation
+- Rustdoc for builder API ([#820](https://github.com/testcontainers/testcontainers-rs/pull/820))
+
+#### Features
+- Use DOCKER_DEFAULT_PLATFORM env var to specify platform ([#800](https://github.com/testcontainers/testcontainers-rs/pull/800))
+- Fallback to platform linux/amd64 when image pull fails ([#837](https://github.com/testcontainers/testcontainers-rs/pull/837))
+- Add support for devices request ([#832](https://github.com/testcontainers/testcontainers-rs/pull/832))
+- Add configurable tmpfs mount sizes ([#853](https://github.com/testcontainers/testcontainers-rs/pull/853))
+- Support `http_wait` functionallity without tls dependencies ([#850](https://github.com/testcontainers/testcontainers-rs/pull/850))
+- Add container hostname support ([#848](https://github.com/testcontainers/testcontainers-rs/pull/848))
+- Expose host ports between host and containers via ssh sidecar ([#846](https://github.com/testcontainers/testcontainers-rs/pull/846))
+
+#### Miscellaneous Tasks
+- Update bollard-stubs requirement from =1.48.3-rc.28.0.4 to =1.49.0-rc.28.3.3 ([#828](https://github.com/testcontainers/testcontainers-rs/pull/828))
+
+#### Refactor
+- Remove bollard_stubs dependency as bollard re-exports it ([#844](https://github.com/testcontainers/testcontainers-rs/pull/844))
+
+#### Testing
+- Avoid flakiness in `platform` test
+- Switch to testcontainers/helloworld and reduce some flakiness ([#855](https://github.com/testcontainers/testcontainers-rs/pull/855))
+
 ## [0.25.0] - 2025-07-27
 ### Details
 #### Bug Fixes

testcontainers/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "testcontainers"
-version = "0.25.0"
+version = "0.25.2"
 categories = ["development-tools::testing"]
 readme = "README.md"
 authors.workspace = true
@@ -49,17 +49,17 @@ url = { version = "2", features = ["serde"] }
 
 [features]
 default = ["ring"]
-ring = ["bollard/ssl", "russh?/ring"]
-aws-lc-rs = ["bollard/aws-lc-rs", "russh?/aws-lc-rs"]
+ring = ["bollard/ssl"]
+aws-lc-rs = ["bollard/aws-lc-rs"]
 ssl = ["bollard/ssl_providerless"]
 blocking = []
 watchdog = ["signal-hook", "conquer-once"]
-http_wait = ["http_wait_plain", "reqwest/rustls-tls", "reqwest/rustls-tls-native-roots", "reqwest/hickory-dns"]
+http_wait = ["http_wait_plain", "reqwest/rustls-tls", "reqwest/rustls-tls-native-roots"]
 http_wait_plain = ["reqwest"]
 properties-config = ["serde-java-properties"]
 reusable-containers = []
 device-requests = []
-host-port-exposure = ["dep:russh"]
+host-port-exposure = ["dep:russh", "russh/ring"]
 
 [dev-dependencies]
 anyhow = "1.0.86"

testcontainers/src/core/client.rs

@@ -508,10 +508,18 @@ impl Client {
         Ok(())
     }
 
-    pub(crate) async fn pull_image(&self, descriptor: &str) -> Result<(), ClientError> {
+    pub(crate) async fn pull_image(
+        &self,
+        descriptor: &str,
+        platform: Option<String>,
+    ) -> Result<(), ClientError> {
         let pull_options = CreateImageOptionsBuilder::new()
             .from_image(descriptor)
-            .platform(self.config.platform().unwrap_or_default())
+            .platform(
+                platform
+                    .as_deref()
+                    .unwrap_or_else(|| self.config.platform().unwrap_or_default()),
+            )
             .build();
 
         let credentials = self.credentials_for_image(descriptor).await;
@@ -525,7 +533,7 @@ impl Client {
                 Err(BollardError::DockerResponseServerError {
                     status_code: _,
                     message: _,
-                }) => {
+                }) if !matches!(platform.as_deref(), Some("linux/amd64")) => {
                     self.pull_image_linux_amd64(descriptor).await?;
                 }
                 _ => {
@@ -789,7 +797,7 @@ mod tests {
             )
             .await;
 
-        client.pull_image(IMAGE).await?;
+        client.pull_image(IMAGE, None).await?;
 
         let image = client.bollard.inspect_image(IMAGE).await?;
 
@@ -804,7 +812,7 @@ mod tests {
             .remove_image(IMAGE, Option::<RemoveImageOptions>::None, credentials)
             .await?;
 
-        client.pull_image(IMAGE).await?;
+        client.pull_image(IMAGE, None).await?;
 
         let image = client.bollard.inspect_image(IMAGE).await?;
 

testcontainers/src/core/containers/request.rs

@@ -26,6 +26,7 @@ pub struct ContainerRequest<I: Image> {
     pub(crate) image_name: Option<String>,
     pub(crate) image_tag: Option<String>,
     pub(crate) container_name: Option<String>,
+    pub(crate) platform: Option<String>,
     pub(crate) network: Option<String>,
     pub(crate) hostname: Option<String>,
     pub(crate) labels: BTreeMap<String, String>,
@@ -97,6 +98,10 @@ impl<I: Image> ContainerRequest<I> {
         &self.container_name
     }
 
+    pub fn platform(&self) -> &Option<String> {
+        &self.platform
+    }
+
     pub fn env_vars(&self) -> impl Iterator<Item = (Cow<'_, str>, Cow<'_, str>)> {
         self.image
             .env_vars()
@@ -248,6 +253,7 @@ impl<I: Image> From<I> for ContainerRequest<I> {
             image_name: None,
             image_tag: None,
             container_name: None,
+            platform: None,
             network: None,
             hostname: None,
             labels: BTreeMap::default(),
@@ -307,6 +313,7 @@ impl<I: Image + Debug> Debug for ContainerRequest<I> {
             .field("image_name", &self.image_name)
             .field("image_tag", &self.image_tag)
             .field("container_name", &self.container_name)
+            .field("platform", &self.platform)
             .field("network", &self.network)
             .field("hostname", &self.hostname)
             .field("labels", &self.labels)

testcontainers/src/core/image/image_ext.rs

@@ -68,6 +68,20 @@ pub trait ImageExt<I: Image> {
     /// Sets the container name.
     fn with_container_name(self, name: impl Into<String>) -> ContainerRequest<I>;
 
+    /// Sets the platform the container will be run on.
+    ///
+    /// Platform in the format `os[/arch[/variant]]` used for image lookup.
+    ///
+    /// # Examples
+    ///
+    /// ```rust,no_run
+    /// use testcontainers::{GenericImage, ImageExt};
+    ///
+    /// let image = GenericImage::new("image", "tag")
+    ///     .with_platform("linux/amd64");
+    /// ```
+    fn with_platform(self, platform: impl Into<String>) -> ContainerRequest<I>;
+
     /// Sets the network the container will be connected to.
     fn with_network(self, network: impl Into<String>) -> ContainerRequest<I>;
 
@@ -283,6 +297,15 @@ impl<RI: Into<ContainerRequest<I>>, I: Image> ImageExt<I> for RI {
         }
     }
 
+    fn with_platform(self, platform: impl Into<String>) -> ContainerRequest<I> {
+        let container_req = self.into();
+
+        ContainerRequest {
+            platform: Some(platform.into()),
+            ..container_req
+        }
+    }
+
     fn with_network(self, network: impl Into<String>) -> ContainerRequest<I> {
         let container_req = self.into();
         ContainerRequest {

testcontainers/src/runners/async_runner.rs

@@ -187,13 +187,27 @@ where
             None
         };
 
+        let mut options_builder: Option<CreateContainerOptionsBuilder> = None;
+
         // name of the container
         if let Some(name) = container_req.container_name() {
-            let options = CreateContainerOptionsBuilder::new()
-                .name(name)
-                .platform(client.config.platform().unwrap_or_default())
-                .build();
-            create_options = Some(options)
+            let options = CreateContainerOptionsBuilder::new().name(name);
+
+            options_builder = Some(options);
+        }
+
+        // platform of the container
+        if let Some(platform) = container_req.platform() {
+            let options = options_builder.unwrap_or(CreateContainerOptionsBuilder::new());
+            options_builder = Some(options.platform(platform));
+        } else {
+            // set platform from global platform setting if available
+            let options = options_builder.unwrap_or(CreateContainerOptionsBuilder::new());
+            options_builder = Some(options.platform(client.config.platform().unwrap_or_default()));
+        }
+
+        if let Some(options) = options_builder {
+            create_options = Some(options.build());
         }
 
         // handle environment variables
@@ -311,7 +325,12 @@ where
                     status_code: 404, ..
                 },
             )) => {
-                client.pull_image(&container_req.descriptor()).await?;
+                client
+                    .pull_image(
+                        &container_req.descriptor(),
+                        container_req.platform().clone(),
+                    )
+                    .await?;
                 client.create_container(create_options, config).await
             }
             res => res,
@@ -361,7 +380,12 @@ where
     async fn pull_image(self) -> Result<ContainerRequest<I>> {
         let container_req = self.into();
         let client = Client::lazy_client().await?;
-        client.pull_image(&container_req.descriptor()).await?;
+        client
+            .pull_image(
+                &container_req.descriptor(),
+                container_req.platform().clone(),
+            )
+            .await?;
 
         Ok(container_req)
     }