[Bug]: Ryuk fails when using internal repo

[tisonv]

Testcontainers version

4.11

Using the latest Testcontainers version?

Yes

Host OS

Linux

Host arch

x64

.NET version

10

Docker version

Client: Docker Engine - Community
 Version:           29.3.0
 API version:       1.54
 Go version:        go1.25.7
 Git commit:        5927d80
 Built:             Thu Mar  5 14:30:26 2026
 OS/Arch:           linux/amd64
 Context:           default

Server: Docker Engine - Community
 Engine:
  Version:          29.3.0
  API version:      1.54 (minimum version 1.40)
  Go version:       go1.25.7
  Git commit:       83bca51
  Built:            Thu Mar  5 14:26:34 2026
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          v2.2.2
  GitCommit:        301b2dac98f15c27117da5c8af12118a041a31d9
 runc:
  Version:          1.3.4
  GitCommit:        v1.3.4-0-gd6d73eb8
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

Docker info

Client: Docker Engine - Community
 Version:    29.3.0
 Context:    default
 Debug Mode: false
 Plugins:
  buildx: Docker Buildx (Docker Inc.)
    Version:  v0.31.1
    Path:     /usr/libexec/docker/cli-plugins/docker-buildx
  compose: Docker Compose (Docker Inc.)
    Version:  v5.1.0
    Path:     /usr/libexec/docker/cli-plugins/docker-compose

Server:
 Containers: 1
  Running: 0
  Paused: 0
  Stopped: 1
 Images: 7
 Server Version: 29.3.0
 Storage Driver: overlay2
  Backing Filesystem: xfs
  Supports d_type: true
  Using metacopy: false
  Native Overlay Diff: true
  userxattr: false
 Logging Driver: json-file
 Cgroup Driver: systemd
 Cgroup Version: 2
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
 CDI spec directories:
  /etc/cdi
  /var/run/cdi
 Swarm: inactive
 Runtimes: io.containerd.runc.v2 runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: 301b2dac98f15c27117da5c8af12118a041a31d9
 runc version: v1.3.4-0-gd6d73eb8
 init version: de40ad0
 Security Options:
  seccomp
   Profile: builtin
  cgroupns
 Kernel Version: 5.14.0-503.23.2.el9_5.x86_64
 Operating System: AlmaLinux 9.7 (Moss Jungle Cat)
 OSType: linux
 Architecture: x86_64
 CPUs: 4
 Total Memory: 7.503GiB
 Name: SRVARRCON1R.cg62.int
 ID: d2c9c732-b007-4f48-b257-9c249009801e
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 Experimental: false
 Insecure Registries:
  127.0.0.0/8
  ::1/128
 Live Restore Enabled: false
 Firewall Backend: iptables

What happened?

Since last version I'm unable to get the ryuk image from my nexus repository.
The PR #1658 forces a SHA256 on the ryuk image but it is not the same in my repo.

If I disable ryuk, it works nicely.
If I downgrade to 4.10, it works nicely.
If I specify <TESTCONTAINERS_RYUK_CONTAINER_IMAGE>testcontainers/ryuk:0.14.0</TESTCONTAINERS_RYUK_CONTAINER_IMAGE> it works but it feels counter intuitive / lacks documentation since we set it to the default value, as specified in https://dotnet.testcontainers.org/custom_configuration/

Relevant log output

Additional information

No response

[coderabbitai]

🔗 Related PRs

#1604 - fix(Kafka): Bump image version to prevent container crash on startup [merged]
#1605 - docs: Pin the image version explicitly [merged]
#1606 - chore: Set remaining container image explicit [merged]
#1616 - chore: Update examples to use TC for .NET 4.10.0 [merged]
#1665 - chore(deps): Bump Docker.DotNet from 3.131.1 to 4.0.2 [closed]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[HofmeisterAn]

Since last version I'm unable to get the ryuk image from my nexus repository.

I guess you're using Nexus as a proxy. Did you re-tag the image and push it manually? Are you sure Nexus has the correct image? What digest do you see (docker images --digests)? AFAIK we've never overwritten the 0.14.0 tag. Could you try pulling the image again through Nexus?

[tisonv]

Manual proxy yes

I do the following to add to the nexus:

docker pull testcontainers/ryuk:0.14.0
docker tag testcontainers/ryuk:0.14.0 mynexus.mydomain/testcontainers/ryuk:0.14.0
docker push mynexus.mydomain/testcontainers/ryuk:0.14.0

Terminal:

In Nexus:

[HofmeisterAn]

Manual proxy yes

Can you please try to pull the image via Nexus (docker push creates a new manifest):

docker pull mynexus.mydomain/testcontainers/ryuk@sha256:7c1a8a9a47c780ed0f983770a662f80deb115d95cce3e2daa3d12115b8cd28f0

Or you can copy the image using (https://github.com/containers/skopeo):

skopeo copy --all --preserve-digests docker://docker.io/testcontainers/ryuk@sha256:7c1a8a9a47c780ed0f983770a662f80deb115d95cce3e2daa3d12115b8cd28f0 docker://mynexus.mydomain/testcontainers/ryuk:0.14.0

Edit 1: Looks like skopeo does not work with Nexus.

Edit 2: Pulling the image through the Docker Hub proxy works.

Edit 3: --preserve-digests seems to work with skopeo, see: #1668 (comment).

I will update the docs.

[tisonv]

Confirmed ok with Skopeo !
Thank you !!

May the images in abcf147 be concerned by the same problem ?

[HofmeisterAn]

Confirmed ok with Skopeo ! Thank you !!

May the images in abcf147 be concerned by the same problem ?

Most of them are just for our tests. Only ryuk and sshd are included in the library. I believe the way it's documented in the PR is fine. By default, we follow best practices and the most secure approach, and provide a way to configure it for developers who don't want to or can't use that default.