)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"b98316cda972f6c07a1078aa518e37d19809c36b","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":1,"id":"c137d5d1_bf52cc81","updated":"2026-07-30 16:38:06.000000000","message":"This really is a +2, I\u0027m just not putting +2 on any of this until I get to the end of the chain.","commit_id":"55bc9e7cfafa83175539c68019862bcb63d96c5d"}],"ironic_python_agent/hardware_managers/container.py":[{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"b98316cda972f6c07a1078aa518e37d19809c36b","unresolved":true,"context_lines":[{"line_number":42,"context_line":"            LOG.debug(\"Error loading steps from YAML file: %s\", e)"},{"line_number":43,"context_line":"            return []"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"    def _check_permitted(self, container_url, pull_options, run_options,"},{"line_number":46,"context_line":"                         trusted):"},{"line_number":47,"context_line":"        \"\"\"Apply container policy and return the options to execute with."},{"line_number":48,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"1d86bf04_72f52085","line":45,"updated":"2026-07-30 16:38:06.000000000","message":"nit: I don\u0027t love the name of this given it\u0027s doing more work than just checking if it\u0027s permitted. Probably not worth the churn to change it.","commit_id":"55bc9e7cfafa83175539c68019862bcb63d96c5d"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"6257ccfe07d96e6bf0d82a089b0086bb08eb4c1d","unresolved":true,"context_lines":[{"line_number":61,"context_line":""},{"line_number":62,"context_line":"        if container_url not in CONF.container.allowed_containers:"},{"line_number":63,"context_line":"            LOG.error(\"Refusing to run container %s: it is not listed in \""},{"line_number":64,"context_line":"                      \"[container]allowed_containers\", container_url)"},{"line_number":65,"context_line":"            raise errors.ContainerNotPermittedError(container_url)"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"        # NOTE(cid): options alone defeat an image allowlist (--privileged,"}],"source_content_type":"text/x-python","patch_set":1,"id":"8be203ca_5bd14786","line":64,"updated":"2026-07-31 14:00:22.000000000","message":"nit: We may want to be a bit more verbose here, because we expect complete and exact matches, so meaning someone is going to have to do something like:\n\nfoo.bar/me/container@sha256:0291921930194u0129... OR just use a tag to replace the sha hash. Security tools now flag tag use as well, so that doesn\u0027t really help, but I think the expected pattern will be the full on hash that operators will need to use the super long string just raising the risk of formatting errors.\n\nA good middle ground would be to also log the configuration so its easy to compare in a tight context loop.","commit_id":"55bc9e7cfafa83175539c68019862bcb63d96c5d"},{"author":{"_account_id":4571,"name":"Steve Baker","email":"sbaker@redhat.com","username":"steve-stevebaker"},"change_message_id":"233bfb4ce3983aa2e949eae0932f1f1e67c01680","unresolved":true,"context_lines":[{"line_number":79,"context_line":"        pull_options, run_options \u003d self._check_permitted("},{"line_number":80,"context_line":"            container_url, pull_options, run_options, trusted)"},{"line_number":81,"context_line":"        utils.execute(CONF.container.runner, \"pull\","},{"line_number":82,"context_line":"                      *pull_options, container_url)"},{"line_number":83,"context_line":"        utils.execute(CONF.container.runner, \"run\","},{"line_number":84,"context_line":"                      *run_options, container_url)"},{"line_number":85,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"df609d0e_e8ce91e4","line":82,"updated":"2026-07-30 21:36:56.000000000","message":"Running a pull before any run will hit the image registry unnecessarily if that image has already been pulled.\n\nI\u0027d suggest either refactoring this to only pull unique images once, or maybe a better approach would be to add --policy\u003dmissing to the default PULL_OPTIONS. This would have the bonus behaviour of allowing users to build agent images which have container images already preloaded.","commit_id":"55bc9e7cfafa83175539c68019862bcb63d96c5d"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"6257ccfe07d96e6bf0d82a089b0086bb08eb4c1d","unresolved":true,"context_lines":[{"line_number":79,"context_line":"        pull_options, run_options \u003d self._check_permitted("},{"line_number":80,"context_line":"            container_url, pull_options, run_options, trusted)"},{"line_number":81,"context_line":"        utils.execute(CONF.container.runner, \"pull\","},{"line_number":82,"context_line":"                      *pull_options, container_url)"},{"line_number":83,"context_line":"        utils.execute(CONF.container.runner, \"run\","},{"line_number":84,"context_line":"                      *run_options, container_url)"},{"line_number":85,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"731810a1_334e60b3","line":82,"in_reply_to":"df609d0e_e8ce91e4","updated":"2026-07-31 14:00:22.000000000","message":"That seems like an optimization though, and one it feels like we could just follow-up with...","commit_id":"55bc9e7cfafa83175539c68019862bcb63d96c5d"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"b98316cda972f6c07a1078aa518e37d19809c36b","unresolved":true,"context_lines":[{"line_number":105,"context_line":"                                    pull_options\u003dpull_options,"},{"line_number":106,"context_line":"                                    run_options\u003drun_options, trusted\u003dFalse)"},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"    def _create_cleanup_method(self, container_url, pull_options\u003dNone,"},{"line_number":109,"context_line":"                               run_options\u003dNone):"},{"line_number":110,"context_line":"        \"\"\"Build the callable invoked for a ramdisk-baked step.\"\"\""},{"line_number":111,"context_line":"        return partial(self._container_step, container_url\u003dcontainer_url,"}],"source_content_type":"text/x-python","patch_set":1,"id":"127a9f46_55428369","line":108,"updated":"2026-07-30 16:38:06.000000000","message":"nit: This is a bad name that would be nice to have changed too. Again, probably not worth the churn.","commit_id":"55bc9e7cfafa83175539c68019862bcb63d96c5d"}]}