fix(container): correct image parsing with registry port by suzutan · Pull Request #1186 · falcosecurity/plugins

suzutan · 2026-01-30T07:56:46Z

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind bug

/kind cleanup

/kind design

/kind documentation

/kind failing-test

/kind feature

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area plugins

/area registry

/area build

/area documentation

What this PR does / why we need it:

Fixes container image parsing when the registry URL contains a port number.

Previously, the code used strings.Split(image, ":") which incorrectly split on ALL colons, making it unable to distinguish between registry ports and image tags. For example:

registry.example.com:5000/foo/bar:latest would fail parsing (3 parts, fails len==2 check)
registry.example.com:5000/foo/bar would incorrectly parse registry.example.com as repo and 5000/foo/bar as tag

This PR introduces a new parseImageRepoTag function that correctly parses image references by:

Only splitting on the last colon that appears after the last slash
Properly handling registry URLs with ports
Maintaining backward compatibility with simple image references

The fix has been applied to all container runtime engines: Docker, Podman, containerd, and CRI.

Which issue(s) this PR fixes:

Fixes #1139

Special notes for your reviewer:

This is the same bug as inconsistent splitting of container image information #825, which was auto-closed by the stale bot without being fixed
Added comprehensive unit tests covering various image reference formats including:
- Registry with port and tag
- Registry with port without tag
- Multi-level paths with registry ports
- Digest-based images
The parsing logic now correctly handles all edge cases mentioned in the issue

poiana · 2026-01-30T07:56:55Z

Welcome @suzutan! It looks like this is your first PR to falcosecurity/plugins 🎉

poiana · 2026-01-30T07:56:59Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: suzutan
Once this PR has been reviewed and has the lgtm label, please assign deepskyblue86 for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

plugins/container/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Container image name/tag parsing failed when the registry URL included a port number (e.g., registry.example.com:5000/foo/bar:latest). The previous implementation used strings.Split(image, ":") which split on all colons, unable to distinguish between registry port (:5000) and image tag (:latest). Changes: - Add parseImageRepoTag() helper function in engine.go that only splits on the last colon appearing after the last slash - Update all engine implementations (docker, podman, containerd, cri) to use the new parser - Add comprehensive test cases covering various image formats including registry with port, multi-level paths, and digest-based images Fixes: falcosecurity#1139 Signed-off-by: suzutan <6679870+suzutan@users.noreply.github.com>

irozzo-1A

LGTM overall, just a nit

plugins/container/go-worker/pkg/container/engine_test.go

github-actions · 2026-02-03T09:43:00Z

Rules files suggestions

…arsing Improve parseImageRepoTag to properly handle digest-based image references by stripping the digest portion and returning an empty tag, preventing the digest from being incorrectly parsed as a tag. Signed-off-by: suzutan <6679870+suzutan@users.noreply.github.com>

github-actions · 2026-02-05T09:14:09Z

Rules files suggestions

irozzo-1A

Some minor changes and it's ready to go. Thanks!

irozzo-1A · 2026-02-05T14:18:56Z

plugins/container/go-worker/pkg/container/engine_test.go

+			expectedRepo: "registry.example.com:5000/foo/bar",
+			expectedTag:  "",
+		},
+		"Multi-level path with registry port and tag": {


https://github.com/opencontainers/distribution-spec/blob/main/spec.md#pulling-manifests

refers to the namespace of the repository. MUST be either (a) the digest of the manifest or (b) a tag. The MUST NOT be in any other format. Throughout this document, MUST match the following regular expression:

[a-z0-9]+((.||__|-+)[a-z0-9]+)*(/[a-z0-9]+((.||__|-+)[a-z0-9]+))

I think you can have both digest and tag, from my tests with docker at least. The OCI spec says or, but I think it's an inclusive or. I would add a test to cover this scenario e.g.

Suggested change

"Multi-level path with registry port and tag": {

"Both tag and digest": {

image: "registry.example.com:5000/foo/bar:latest@sha256:abc123",

expectedRepo: "registry.example.com:5000/foo/bar",

expectedTag: "latest",

},

irozzo-1A · 2026-02-05T14:30:35Z

plugins/container/go-worker/pkg/container/engine.go

+	// Split at the last colon
+	if digestRef {
+		return image[:lastColon], ""
+	}


Why don't we return the tag in case we have both tag and digest?

Suggested change

// Split at the last colon

if digestRef {

return image[:lastColon], ""

}

irozzo-1A · 2026-02-05T14:30:47Z

plugins/container/go-worker/pkg/container/engine.go

+	if at := strings.Index(image, "@"); at != -1 {
+		image = image[:at]
+		digestRef = true
+	}


See my previous comment:

Suggested change

}

if at := strings.Index(image, "@"); at != -1 {

image = image[:at]

}

poiana added kind/bug Something isn't working dco-signoff: no area/plugins labels Jan 30, 2026

poiana added the do-not-merge/contains-merge-commits label Jan 30, 2026

poiana requested review from deepskyblue86 and irozzo-1A January 30, 2026 07:57

poiana added the size/L label Jan 30, 2026

suzutan force-pushed the fix-container-port-parsing branch from 7bb0773 to c3f9c14 Compare January 30, 2026 07:58

poiana added dco-signoff: yes and removed dco-signoff: no labels Jan 30, 2026

suzutan force-pushed the fix-container-port-parsing branch from c3f9c14 to 0936b5e Compare January 30, 2026 07:58

poiana removed the do-not-merge/contains-merge-commits label Jan 30, 2026

irozzo-1A reviewed Feb 2, 2026

View reviewed changes

plugins/container/go-worker/pkg/container/engine_test.go Show resolved Hide resolved

poiana added dco-signoff: no and removed dco-signoff: yes labels Feb 5, 2026

suzutan force-pushed the fix-container-port-parsing branch from 260d098 to 01d4cc8 Compare February 5, 2026 08:17

poiana added dco-signoff: yes and removed dco-signoff: no labels Feb 5, 2026

irozzo-1A reviewed Feb 5, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(container): correct image parsing with registry port#1186

fix(container): correct image parsing with registry port#1186
suzutan wants to merge 2 commits intofalcosecurity:mainfrom
suzutan:fix-container-port-parsing

suzutan commented Jan 30, 2026

Uh oh!

poiana commented Jan 30, 2026

Uh oh!

poiana commented Jan 30, 2026

Uh oh!

irozzo-1A left a comment

Uh oh!

Uh oh!

github-actions bot commented Feb 3, 2026

Uh oh!

github-actions bot commented Feb 5, 2026

Uh oh!

irozzo-1A left a comment

Uh oh!

irozzo-1A Feb 5, 2026

Uh oh!

irozzo-1A Feb 5, 2026

Uh oh!

irozzo-1A Feb 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

-		"Multi-level path with registry port and tag": {
+		"Both tag and digest": {
+			image:        "registry.example.com:5000/foo/bar:latest@sha256:abc123",
+			expectedRepo: "registry.example.com:5000/foo/bar",
+			expectedTag:  "latest",
+		},

Conversation

suzutan commented Jan 30, 2026

Uh oh!

poiana commented Jan 30, 2026

Uh oh!

poiana commented Jan 30, 2026

Uh oh!

irozzo-1A left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions bot commented Feb 3, 2026

Rules files suggestions

Uh oh!

github-actions bot commented Feb 5, 2026

Rules files suggestions

Uh oh!

irozzo-1A left a comment

Choose a reason for hiding this comment

Uh oh!

irozzo-1A Feb 5, 2026

Choose a reason for hiding this comment

Uh oh!

irozzo-1A Feb 5, 2026

Choose a reason for hiding this comment

Uh oh!

irozzo-1A Feb 5, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants