add npx wrangler containers registry commands by emily-shen · Pull Request #10605 · cloudflare/workers-sdk

emily-shen · 2025-09-10T18:37:06Z

CC-5835

Add commands to support configuring credentials for external (non cloudflare) registries. Currently this should only be AWS ECR. We are still working on this incrementally so the commands are hidden.

This works by integrating with the secrets store. Credentials for registries usually consist of a public and private component - only the actually secret bit is stored in the secret store, which wrangler will create for you. The secret is either added interactively or piped in. Currently we don't allow you to provide an existing secret. The secret store id and secret name are then passed to the containers control plane.

The public part is passed in via --public-credential and stored in the containers control plane.

You can provide a store id but currently secret store only allows for one store per account so that is a bit redundant.

Tests
- Tests included
- Tests not necessary because:
Public documentation
- Cloudflare docs PR(s):
- Documentation not necessary because: wip feature
Wrangler V3 Backport
- Wrangler PR:
- Not necessary because: new feature

changeset-bot · 2025-09-10T18:37:11Z

🦋 Changeset detected

Latest commit: a52538e

The changes in this PR will be included in the next version bump.

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

pkg-pr-new · 2025-09-10T18:39:50Z

create-cloudflare

npm i https://pkg.pr.new/create-cloudflare@10605

@cloudflare/kv-asset-handler

npm i https://pkg.pr.new/@cloudflare/kv-asset-handler@10605

miniflare

npm i https://pkg.pr.new/miniflare@10605

@cloudflare/pages-shared

npm i https://pkg.pr.new/@cloudflare/pages-shared@10605

@cloudflare/unenv-preset

npm i https://pkg.pr.new/@cloudflare/unenv-preset@10605

@cloudflare/vite-plugin

npm i https://pkg.pr.new/@cloudflare/vite-plugin@10605

@cloudflare/vitest-pool-workers

npm i https://pkg.pr.new/@cloudflare/vitest-pool-workers@10605

@cloudflare/workers-editor-shared

npm i https://pkg.pr.new/@cloudflare/workers-editor-shared@10605

@cloudflare/workers-utils

npm i https://pkg.pr.new/@cloudflare/workers-utils@10605

wrangler

npm i https://pkg.pr.new/wrangler@10605

commit: a52538e

vicb · 2025-11-04T11:36:07Z

 });
+
+export const validateSecretName = (name: string) => {
+	const validName = /^[A-z0-9-_]+$/;


This looks like a valid concern, maybe switch to /^[\w-]+$/ (\w include _)

this is the same regex that secret store applies api side

vicb · 2025-11-04T11:39:01Z


 /**
 * Request body for creating a new image registry configuration
 */


Why is this comment removed?
Should the new fields be documented?

vicb · 2025-11-04T11:39:38Z

+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+


Could this be removed everywhere it is added (not applicable to this repo)?

everything in containers-shared/src/client/ is autogenerated from an openapi spec in the cloudchamber repo, and this is unfortunately full of 'any' uses so we do actually need to disable eslint.
we could remove the others but again i'd like to avoid unnecessarily increasing the diff here.

vicb · 2025-11-04T11:41:23Z

+ * The type of external registry that is being configured.
+ */
+export enum ExternalRegistryKind {
+	ECR = "ECR",


nit: any particular reason to give this an explicit name ( = "ECR")?

vicb · 2025-11-04T11:42:02Z

+/* eslint-disable */
+
+/**
+ * A JSON string that encodes the auth required to authenticate with an external image registry. The format of the JSON object is determined by the registry being configured.


vicb · 2025-11-04T11:44:35Z

 	options: Exclude<ContainerDevOptions, DockerfileConfig>
 ): Promise<{ abort: () => void; ready: Promise<void> }> {
-	await dockerLoginManagedRegistry(dockerPath);
+	const domain = new URL(`http://${options.image_uri}`).hostname;


This could throw, should the error be handled?

this will already be validated by this point so it shouldn't, adding a comment to explain

ascorbic · 2025-11-04T11:11:17Z

+	let url: URL;
+	try {
+		url = new URL(`http://${domain}`);
+	} catch (e) {
+		if (e instanceof Error) {
+			throw new Error(`${domain} is invalid:\n${e.message}`);
+		}
+		throw e;
+	}


You could use URL.canParse here

alas we still support node 20 where this doesn't exist

ascorbic · 2025-11-04T11:33:21Z


 	// containers
-	wrangler.command("containers", false, (containersArgs) => {
+	wrangler.command("containers", "📦 Manage Containers ", (containersArgs) => {


Suggested change

wrangler.command("containers", "📦 Manage Containers ", (containersArgs) => {

wrangler.command("containers", "📦 Manage Containers", (containersArgs) => {

Not sure if this will break all the snapshots!

vicb · 2025-11-04T11:50:54Z

+	}
+
+	const acceptedRegistries: RegistryPattern[] = [
+		{


Would it make sense to consolidate this object (for ext registries) and type in an ExternalRegistry.ts file that would also have the content from the current ExternalRegistryKind.ts

Everything in containers-shared/src/client/ is autogenerated from an open api spec in the cloudchamber internal repo, and I would prefer to not mix in hand written code with the autogenerated code. also the autogenerated client will be removed soon anyway in favour of the cloudflare ts sdk :)

vicb · 2025-11-04T11:56:24Z

 		expect(result[0].rollout_step_percentage).toBe(100);
 	});
+
+	describe("image validation and resolution", async () => {


Is "image validation" accurate here?
It looks like this is validating registries instead?

it is also validating how we resolve image names (e.g. adding account ids)

vicb · 2025-11-04T11:59:42Z

+		)
+		.command(
+			"registries",
+			// hide for now so it doesn't show up in help while we not publicly available


Suggested change

// hide for now so it doesn't show up in help while we not publicly available

// hide for now so it doesn't show up in help while not publicly available

vicb · 2025-11-04T12:02:15Z

+				description:
+					"The public part of the registry credentials, e.g. `AWS_ACCESS_KEY_ID` for ECR",
+				demandOption: true,
+				alias: ["aws-access-key-id"],


Isn't that going to be a problem when we add more registry types?
i.e. you'll be able to use aws-access-key-id to configure GCP containers

vicb · 2025-11-04T12:03:22Z

+	log("\n");
+	log("Setting up integration with Secrets Store...\n");


Suggested change

log("\n");

log("Setting up integration with Secrets Store...\n");

log("\nSetting up integration with Secrets Store...\n");

vicb · 2025-11-04T12:07:15Z

+		const stores = await listStores(config, accountId);
+		if (stores.length === 0) {
+			const defaultStoreName = "default_secret_store";
+			const check = await confirm(


nit: use yes/create instead? The former is consistent with other usage in this PR, create is also nice to describe what is being done/asked.

vicb

The regexp should be updated.

Also added other minor comments.

LGTM with the changes.

petebacondarwin · 2025-11-04T14:15:01Z

+/**
+ * get type of container registry, and validate
+ * currently we support cloudflare managed registries and AWS ECR
+ * when using cloudflare mananged registries we expect CLOUDFLARE_CONTAINER_REGISTRY to be set


Suggested change

* when using cloudflare mananged registries we expect CLOUDFLARE_CONTAINER_REGISTRY to be set

* when using cloudflare managed registries we expect CLOUDFLARE_CONTAINER_REGISTRY to be set

petebacondarwin · 2025-11-04T14:15:36Z

 }
+
+/**
+ * get type of container registry, and validate


Suggested change

* get type of container registry, and validate

* Get type of container registry, and validate

emily-shen · 2025-11-05T11:03:06Z

merging this as-is because the remaining comments are nits, this is hidden and i am going to do a follow-up pr immediately after

…n for `fedramp_high` (#11196) * Fix nits from #10605 * non-secret-store mode * update containers api client * clean up fedramp region code * add tests * changeset * containers-shared minor * prettify --------- Co-authored-by: Nikita Sharma <nsharma@cloudflare.com>

workers-devprod added this to workers-sdk Sep 10, 2025

github-project-automation Bot moved this to Untriaged in workers-sdk Sep 10, 2025

emily-shen force-pushed the emily/registries-cmd branch from 31e3a27 to 66fc3ae Compare September 11, 2025 12:42

emily-shen changed the title ~~[draft] add npx wrangler containers registry configure command~~ [draft] add npx wrangler containers registry put command Sep 11, 2025

emily-shen force-pushed the emily/registries-cmd branch from 66fc3ae to 8a5ab65 Compare September 11, 2025 13:21

github-advanced-security AI found potential problems Sep 11, 2025

View reviewed changes

Comment thread packages/containers-shared/src/images.ts Fixed

Comment thread packages/wrangler/src/containers/config.ts Fixed

emily-shen force-pushed the emily/registries-cmd branch from 8a5ab65 to 186ea83 Compare September 12, 2025 14:18

emily-shen changed the base branch from main to cdr/containers-push-resolve September 12, 2025 14:26

emily-shen force-pushed the emily/registries-cmd branch from 186ea83 to fa77070 Compare September 12, 2025 14:56

IRCody force-pushed the cdr/containers-push-resolve branch 2 times, most recently from 2756e4a to 4767a79 Compare September 17, 2025 22:21

emily-shen force-pushed the emily/registries-cmd branch from fa77070 to 0a7dd25 Compare September 23, 2025 11:59

IRCody force-pushed the cdr/containers-push-resolve branch from 4767a79 to 9555cd6 Compare September 23, 2025 19:56

petebacondarwin force-pushed the cdr/containers-push-resolve branch from 9555cd6 to 19e753d Compare September 26, 2025 12:51

Base automatically changed from cdr/containers-push-resolve to main September 26, 2025 15:54

emily-shen force-pushed the emily/registries-cmd branch from 84bb09e to 587323e Compare September 29, 2025 13:40

nikitassharma reviewed Sep 29, 2025

View reviewed changes

Comment thread packages/wrangler/src/__tests__/containers/registries.test.ts Outdated

Comment thread packages/containers-shared/src/login.ts Outdated

Comment thread packages/containers-shared/src/login.ts Outdated

emily-shen changed the title ~~[draft] add npx wrangler containers registry put command~~ [draft] add npx wrangler containers registry commands Sep 30, 2025

emily-shen force-pushed the emily/registries-cmd branch 2 times, most recently from f6643b0 to 643f892 Compare October 1, 2025 10:49

emily-shen changed the title ~~[draft] add npx wrangler containers registry commands~~ add npx wrangler containers registry commands Oct 1, 2025

emily-shen force-pushed the emily/registries-cmd branch 2 times, most recently from 1f4e96e to 05c4367 Compare October 1, 2025 11:55

nikitassharma reviewed Oct 1, 2025

View reviewed changes

emily-shen force-pushed the emily/registries-cmd branch from 05c4367 to d1a85f8 Compare October 6, 2025 17:03

nikitassharma reviewed Oct 15, 2025

View reviewed changes

Comment thread packages/wrangler/src/containers/index.ts Outdated

nikitassharma reviewed Oct 15, 2025

View reviewed changes

Comment thread packages/wrangler/src/containers/registries.ts Outdated

emily-shen force-pushed the emily/registries-cmd branch from d1a85f8 to 7e1f886 Compare October 16, 2025 10:39

vicb reviewed Nov 4, 2025

View reviewed changes

Comment thread packages/containers-shared/src/images.ts

ascorbic reviewed Nov 4, 2025

View reviewed changes

vicb reviewed Nov 4, 2025

View reviewed changes

vicb approved these changes Nov 4, 2025

View reviewed changes

mark containers commands as in open beta

a52538e

emily-shen force-pushed the emily/registries-cmd branch from 0f96364 to a52538e Compare November 4, 2025 12:11

petebacondarwin approved these changes Nov 4, 2025

View reviewed changes

emily-shen merged commit b55a3c7 into main Nov 5, 2025
38 checks passed

github-project-automation Bot moved this from Approved to Done in workers-sdk Nov 5, 2025

emily-shen deleted the emily/registries-cmd branch November 5, 2025 11:03

workers-devprod mentioned this pull request Nov 5, 2025

Version Packages #11175

Merged

emily-shen added a commit that referenced this pull request Nov 5, 2025

Fix nits from #10605

ca81b26

lrapoport-cf mentioned this pull request Nov 6, 2025

Update rare-bushes-prove.md #11191

Merged

6 tasks

emily-shen added a commit that referenced this pull request Nov 20, 2025

Fix nits from #10605

b7fb148

emily-shen added a commit that referenced this pull request Dec 17, 2025

Fix nits from #10605

41b6529

edmundhung pushed a commit that referenced this pull request Dec 17, 2025

Fix nits from #10605

a2ac2d5

	wrangler.command("containers", "📦 Manage Containers ", (containersArgs) => {
	wrangler.command("containers", "📦 Manage Containers", (containersArgs) => {

	// hide for now so it doesn't show up in help while we not publicly available
	// hide for now so it doesn't show up in help while not publicly available

		log("\n");
		log("Setting up integration with Secrets Store...\n");

	log("\n");
	log("Setting up integration with Secrets Store...\n");
	log("\nSetting up integration with Secrets Store...\n");

	* when using cloudflare mananged registries we expect CLOUDFLARE_CONTAINER_REGISTRY to be set
	* when using cloudflare managed registries we expect CLOUDFLARE_CONTAINER_REGISTRY to be set

	* get type of container registry, and validate
	* Get type of container registry, and validate

Uh oh!

Conversation

emily-shen commented Sep 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

changeset-bot Bot commented Sep 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

pkg-pr-new Bot commented Sep 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

vicb Nov 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

emily-shen Nov 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

vicb left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

emily-shen commented Nov 5, 2025

Uh oh!

Uh oh!

Reviewers

emily-shen commented Sep 10, 2025 •

edited

Loading

changeset-bot Bot commented Sep 10, 2025 •

edited

Loading

pkg-pr-new Bot commented Sep 10, 2025 •

edited

Loading

vicb Nov 4, 2025 •

edited

Loading

emily-shen Nov 4, 2025 •

edited

Loading