From cbe4824ac334a6a6568c8a961c90e5197cb7b8bb Mon Sep 17 00:00:00 2001 From: henrygd Date: Mon, 21 Sep 2026 10:49:53 -0400 Subject: [PATCH] add env var to disable container image update checks (#2371) --- agent/docker.go | 20 ++++++++++++-------- agent/docker_image_updates.go | 3 +++ agent/docker_image_updates_test.go | 23 +++++++++++++++++++++++ 3 files changed, 38 insertions(+), 8 deletions(-) diff --git a/agent/docker.go b/agent/docker.go index ac3d67f7..3d29272a 100644 --- a/agent/docker.go +++ b/agent/docker.go @@ -68,10 +68,11 @@ type dockerManager struct { excludeContainers []string // Patterns to exclude containers by name usingPodman bool // Whether the Docker Engine API is running on Podman - registryClient *http.Client // Client for registry requests; nil uses a client with a 10-second timeout - imageUpdatesMutex sync.RWMutex // Protects imageUpdates, its entries, and imageUpdatesRunning - imageUpdates map[string]*imageUpdateStatus // Shared update status keyed by normalized image reference - imageUpdatesRunning bool // Whether a background image-update batch is in progress + registryClient *http.Client // Client for registry requests; nil uses a client with a 10-second timeout + imageUpdatesDisabled bool // Whether image update checks are disabled by configuration + imageUpdatesMutex sync.RWMutex // Protects imageUpdates, its entries, and imageUpdatesRunning + imageUpdates map[string]*imageUpdateStatus // Shared update status keyed by normalized image reference + imageUpdatesRunning bool // Whether a background image-update batch is in progress // Cache-time-aware tracking for CPU stats (similar to cpu.go) // Maps cache time intervals to container-specific CPU usage tracking @@ -688,6 +689,8 @@ func newDockerManager(agent *Agent) *dockerManager { userAgent: "Docker-Client/", } + dockerImageCheck, _ := utils.GetEnv("DOCKER_IMAGE_CHECK") + // Read container exclusion patterns from environment variable var excludeContainers []string if excludeStr, set := utils.GetEnv("EXCLUDE_CONTAINERS"); set && excludeStr != "" { @@ -707,10 +710,11 @@ func newDockerManager(agent *Agent) *dockerManager { Timeout: timeout, Transport: userAgentTransport, }, - containerStatsMap: make(map[string]*container.Stats), - sem: make(chan struct{}, 5), - apiContainerList: []*container.ApiInfo{}, - excludeContainers: excludeContainers, + containerStatsMap: make(map[string]*container.Stats), + sem: make(chan struct{}, 5), + apiContainerList: []*container.ApiInfo{}, + excludeContainers: excludeContainers, + imageUpdatesDisabled: dockerImageCheck == "false", // Initialize cache-time-aware tracking structures lastCpuContainer: make(map[uint16]map[string]uint64), diff --git a/agent/docker_image_updates.go b/agent/docker_image_updates.go index 80f14356..b04e7bd4 100644 --- a/agent/docker_image_updates.go +++ b/agent/docker_image_updates.go @@ -31,6 +31,9 @@ func normalizedImageReference(image string) string { // refreshImageUpdates starts at most one background batch. Neither its network // work nor its completion is part of the container metrics wait group. func (dm *dockerManager) refreshImageUpdates(containers []*container.ApiInfo, now time.Time) { + if dm.imageUpdatesDisabled { + return + } dm.imageUpdatesMutex.Lock() defer dm.imageUpdatesMutex.Unlock() if dm.imageUpdatesRunning { diff --git a/agent/docker_image_updates_test.go b/agent/docker_image_updates_test.go index a162a13c..733db6b1 100644 --- a/agent/docker_image_updates_test.go +++ b/agent/docker_image_updates_test.go @@ -27,6 +27,29 @@ func waitForImageUpdates(t *testing.T, dm *dockerManager) { }, time.Second*3, time.Millisecond) } +func TestDisableDockerImageUpdateCheck(t *testing.T) { + t.Setenv("BESZEL_AGENT_DOCKER_IMAGE_CHECK", "false") + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + if r.URL.Path == "/version" { + fmt.Fprint(w, `{"Version":"25.0.0"}`) + return + } + http.NotFound(w, r) + })) + defer server.Close() + t.Setenv("BESZEL_AGENT_DOCKER_HOST", server.URL) + + dm := newDockerManager(nil) + require.True(t, dm.imageUpdatesDisabled) + dm.registryClient = &http.Client{Transport: roundTripFunc(func(*http.Request) (*http.Response, error) { + t.Fatal("disabled image update check made a registry request") + return nil, nil + })} + dm.refreshImageUpdates([]*container.ApiInfo{{Image: "nginx", Names: []string{"/nginx"}}}, time.Now()) + require.False(t, dm.imageUpdatesRunning) + require.Nil(t, dm.imageUpdates) +} + func TestImageUpdateCacheAndStats(t *testing.T) { local := "sha256:" + strings.Repeat("a", 64) remote := "sha256:" + strings.Repeat("b", 64)