From 608252e331d71e438eeb61fa68c88958ead7b061 Mon Sep 17 00:00:00 2001
From: Andre Hofmeister <9199345+HofmeisterAn@users.noreply.github.com>
Date: Thu, 19 Mar 2026 16:59:52 +0100
Subject: [PATCH 1/6] docs: Add info about copying an image while preserving
 the OCI index

---
 docs/api/resource_reaper.md                   | 24 +++++++++++++++++++
 docs/custom_configuration/index.md            |  2 +-
 .../Containers/PortForwarding.cs              |  2 +-
 3 files changed, 26 insertions(+), 2 deletions(-)

diff --git a/docs/api/resource_reaper.md b/docs/api/resource_reaper.md
index 85328d94b..7c68b64e4 100644
--- a/docs/api/resource_reaper.md
+++ b/docs/api/resource_reaper.md
@@ -8,6 +8,30 @@ Testcontainers automatically assigns a Resource Reaper session id to each Docker
 
 Moby Ryuk derives its name from the anime character [Ryuk](https://en.wikipedia.org/wiki/Ryuk_(Death_Note)) and is a fitting choice due to the intriguing narrative of the anime Death Note.
 
+## Pinned Ryuk image
+
+Testcontainers for .NET pins the Ryuk image to this manifest list (OCI index) digest:
+
+```
+testcontainers/ryuk:0.14.0@sha256:7c1a8a9a47c780ed0f983770a662f80deb115d95cce3e2daa3d12115b8cd28f0
+```
+
+If you depend on a private registry, make the image available there either through a registry proxy or by copying it from Docker Hub with a tool that preserves the manifest list and all platform variants, for example [`skopeo`](https://github.com/containers/skopeo):
+
+```
+skopeo copy --all docker://docker.io/testcontainers/ryuk@sha256:7c1a8a9a47c780ed0f983770a662f80deb115d95cce3e2daa3d12115b8cd28f0 docker://mynexus.mydomain/testcontainers/ryuk:0.14.0
+```
+
+!!! warning
+
+    Pulling, tagging, and pushing the image manually is not sufficient. That workflow creates a new manifest and only includes the platform variant pulled locally, breaking multi-architecture support.
+
+To use a different image reference, set the `TESTCONTAINERS_RYUK_CONTAINER_IMAGE` environment variable, for example to an unpinned tag:
+
+```
+TESTCONTAINERS_RYUK_CONTAINER_IMAGE=testcontainers/ryuk:0.14.0
+```
+
 <!-- ## Examples
 
 Creates a scoped Resource Reaper and assigns its session id to a container (Docker resource). The container is no longer tracked by the default Resource Reaper.
diff --git a/docs/custom_configuration/index.md b/docs/custom_configuration/index.md
index 24e2d034b..3f8f4f589 100644
--- a/docs/custom_configuration/index.md
+++ b/docs/custom_configuration/index.md
@@ -16,7 +16,7 @@ Testcontainers supports various configurations to set up your test environment.
 | `docker.socket.override`        | `TESTCONTAINERS_DOCKER_SOCKET_OVERRIDE`        | The file path to the Docker daemon socket that is used by Ryuk (resource reaper).                                         | `/var/run/docker.sock`       |
 | `ryuk.disabled`                 | `TESTCONTAINERS_RYUK_DISABLED`                 | Disables Ryuk (resource reaper).                                                                                          | `false`                      |
 | `ryuk.container.privileged`     | `TESTCONTAINERS_RYUK_CONTAINER_PRIVILEGED`     | Runs Ryuk (resource reaper) in privileged mode.                                                                           | `true`                       |
-| `ryuk.container.image`          | `TESTCONTAINERS_RYUK_CONTAINER_IMAGE`          | The Ryuk (resource reaper) Docker image.                                                                                  | `testcontainers/ryuk:0.14.0` |
+| `ryuk.container.image`          | `TESTCONTAINERS_RYUK_CONTAINER_IMAGE`          | The Ryuk (resource reaper) Docker image.                                                                                  | `testcontainers/ryuk:0.14.0@sha256:7c1a8a9a47c780ed0f983770a662f80deb115d95cce3e2daa3d12115b8cd28f0` |
 | `hub.image.name.prefix`         | `TESTCONTAINERS_HUB_IMAGE_NAME_PREFIX`         | The name to use for substituting the Docker Hub registry part of the image name.                                          | -                            |
 | `wait.strategy.retries`         | `TESTCONTAINERS_WAIT_STRATEGY_RETRIES`         | The wait strategy retry count.                                                                                            | `infinite`                   |
 | `wait.strategy.interval`        | `TESTCONTAINERS_WAIT_STRATEGY_INTERVAL`        | The wait strategy interval<sup>1</sup>.                                                                                   | `00:00:01`                   |
diff --git a/src/Testcontainers/Containers/PortForwarding.cs b/src/Testcontainers/Containers/PortForwarding.cs
index 284739485..688ee353b 100644
--- a/src/Testcontainers/Containers/PortForwarding.cs
+++ b/src/Testcontainers/Containers/PortForwarding.cs
@@ -61,7 +61,7 @@ public Task ExposeHostPortsAsync(IEnumerable<ushort> ports, CancellationToken ct
     [PublicAPI]
     private sealed class PortForwardingBuilder : ContainerBuilder<PortForwardingBuilder, PortForwardingContainer, PortForwardingConfiguration>
     {
-      public const string SshdImage = "testcontainers/sshd:1.2.0@sha256:eb168d900fc070479a5e90dfac5a55ab80ee364a1d5017a5a8dc3ad8cb4e975a";
+      public const string SshdImage = "testcontainers/sshd:1.3.0@sha256:c50c0f59554dcdb2d9e5e705112144428ae9d04ac0af6322b365a18e24213a6a";
 
       public const ushort SshdPort = 22;
 

From df32e7ffe843e6ac09eb2c9adee2da36ed0f7c97 Mon Sep 17 00:00:00 2001
From: Andre Hofmeister <9199345+HofmeisterAn@users.noreply.github.com>
Date: Thu, 19 Mar 2026 17:34:49 +0100
Subject: [PATCH 2/6] chore: Set code block language identifiers consistent

---
 docs/api/create_docker_image.md    |  6 +++---
 docs/api/resource_reaper.md        |  8 ++++----
 docs/api/wait_strategies.md        |  2 +-
 docs/cicd/index.md                 |  4 ++--
 docs/custom_configuration/index.md | 18 +++++++++---------
 docs/test_frameworks/xunit_net.md  |  4 ++--
 6 files changed, 21 insertions(+), 21 deletions(-)

diff --git a/docs/api/create_docker_image.md b/docs/api/create_docker_image.md
index d67509f88..e5fa58d60 100644
--- a/docs/api/create_docker_image.md
+++ b/docs/api/create_docker_image.md
@@ -60,7 +60,7 @@ As the tarball's content is based on `/Users/testcontainers/WeatherForecast/`, a
 
     To improve the build time and to reduce the size of the image, it is recommended to include only necessary files. Exclude unnecessary files or directories such as `bin/`, `obj/` and `tests/` with the `.dockerignore` file.
 
-```Dockerfile
+```dockerfile
 FROM mcr.microsoft.com/dotnet/sdk:6.0
 ARG SLN_FILE_PATH="WeatherForecast.sln"
 COPY . .
@@ -86,7 +86,7 @@ A multi-stage Docker image build generates intermediate layers that serve as cac
 
 The following Dockerfile assigns the `org.testcontainers.resource-reaper-session` label to each stage.
 
-```Dockerfile
+```dockerfile
 FROM mcr.microsoft.com/dotnet/sdk:6.0 AS build-env-1
 ARG RESOURCE_REAPER_SESSION_ID="00000000-0000-0000-0000-000000000000"
 LABEL "org.testcontainers.resource-reaper-session"=$RESOURCE_REAPER_SESSION_ID
@@ -127,7 +127,7 @@ _ = new ImageFromDockerfileBuilder()
 
 - When building an image using Testcontainers for .NET and switching the user's context (`USER` statement) in a Dockerfile, the user won't automatically become the [owner](https://github.com/testcontainers/testcontainers-dotnet/issues/1171#issuecomment-2099197840) of the working directory, which seems to be the case when building the image from the CLI. If the running process requires write access to the working directory, it is necessary to set the permissions explicitly (the base image in this example already contains the user `app`):
 
-   ```Dockerfile
+   ```dockerfile
    FROM mcr.microsoft.com/dotnet/sdk:8.0
    WORKDIR /app
    RUN chown app:app .
diff --git a/docs/api/resource_reaper.md b/docs/api/resource_reaper.md
index 7c68b64e4..9f3f494d1 100644
--- a/docs/api/resource_reaper.md
+++ b/docs/api/resource_reaper.md
@@ -12,13 +12,13 @@ Moby Ryuk derives its name from the anime character [Ryuk](https://en.wikipedia.
 
 Testcontainers for .NET pins the Ryuk image to this manifest list (OCI index) digest:
 
-```
+```text
 testcontainers/ryuk:0.14.0@sha256:7c1a8a9a47c780ed0f983770a662f80deb115d95cce3e2daa3d12115b8cd28f0
 ```
 
-If you depend on a private registry, make the image available there either through a registry proxy or by copying it from Docker Hub with a tool that preserves the manifest list and all platform variants, for example [`skopeo`](https://github.com/containers/skopeo):
+If you depend on a private registry, make the image available there either through a registry proxy (pull-through cache) or by copying it from Docker Hub with a tool that preserves the manifest list and all platform variants, for example [`skopeo`](https://github.com/containers/skopeo):
 
-```
+```shell
 skopeo copy --all docker://docker.io/testcontainers/ryuk@sha256:7c1a8a9a47c780ed0f983770a662f80deb115d95cce3e2daa3d12115b8cd28f0 docker://mynexus.mydomain/testcontainers/ryuk:0.14.0
 ```
 
@@ -28,7 +28,7 @@ skopeo copy --all docker://docker.io/testcontainers/ryuk@sha256:7c1a8a9a47c780ed
 
 To use a different image reference, set the `TESTCONTAINERS_RYUK_CONTAINER_IMAGE` environment variable, for example to an unpinned tag:
 
-```
+```shell
 TESTCONTAINERS_RYUK_CONTAINER_IMAGE=testcontainers/ryuk:0.14.0
 ```
 
diff --git a/docs/api/wait_strategies.md b/docs/api/wait_strategies.md
index dfb5b5158..7219b6af7 100644
--- a/docs/api/wait_strategies.md
+++ b/docs/api/wait_strategies.md
@@ -95,7 +95,7 @@ _ = Wait.ForUnixContainer()
 
 If the Docker image supports Dockers's [HEALTHCHECK][docker-docs-healthcheck] feature, like the following configuration:
 
-```Dockerfile
+```dockerfile
 FROM alpine
 HEALTHCHECK --interval=1s CMD test -e /healthcheck
 ```
diff --git a/docs/cicd/index.md b/docs/cicd/index.md
index c7b963086..d2a564ff1 100644
--- a/docs/cicd/index.md
+++ b/docs/cicd/index.md
@@ -14,7 +14,7 @@ GitHub-hosted runners have the same configuration as Microsoft-hosted agents. Th
 
 To configure the Docker service in GitLab CI ([Docker-in-Docker](https://docs.gitlab.com/ee/ci/docker/using_docker_build.html#use-docker-in-docker)), you need to define the service in your `.gitlab-ci.yml` file and expose the Docker host address `docker:2375` by setting the `DOCKER_HOST` environment variable.
 
-```yml title=".gitlab-ci.yml file"
+```yaml title=".gitlab-ci.yml file"
 services:
   - docker:dind
 variables:
@@ -25,7 +25,7 @@ variables:
 
 Enable Bitbucket Pipelines as usual on the **Repository settings → Pipelines → Settings** page. After enabling your pipeline, replace the contents of the `bitbucket-pipelines.yml` file, located at the root of your repository, with the following:
 
-```yml title="bitbucket-pipelines.yml file"
+```yaml title="bitbucket-pipelines.yml file"
 image: mcr.microsoft.com/dotnet/sdk:8.0
 options:
   docker: true
diff --git a/docs/custom_configuration/index.md b/docs/custom_configuration/index.md
index 3f8f4f589..bf460f203 100644
--- a/docs/custom_configuration/index.md
+++ b/docs/custom_configuration/index.md
@@ -30,12 +30,12 @@ Testcontainers supports various configurations to set up your test environment.
 To configure a remote container runtime, Testcontainers provides support for Docker's environment variables in addition to the properties file. During initialization, Testcontainers' auto-discovery feature detect and apply custom configurations including container runtimes. If you are running Docker on a remote host, you can configure it using either of the following methods:
 
 === "Environment Variable"
-    ```
+    ```shell
     DOCKER_HOST=tcp://docker:2375
     ```
 
 === "Properties File"
-    ```
+    ```text
     docker.host=tcp://docker:2375
     ```
 
@@ -43,7 +43,7 @@ To configure a remote container runtime, Testcontainers provides support for Doc
 
 You can switch between contexts using the properties file or an environment variable. Once the context is set, Testcontainers will connect to the specified endpoint based on the given value.
 
-```title="List available contexts"
+```text title="List available contexts"
 PS C:\Sources\dotnet\testcontainers-dotnet> docker context ls
 NAME   DESCRIPTION   DOCKER ENDPOINT           ERROR
 tcc                  tcp://127.0.0.1:60706/0
@@ -52,12 +52,12 @@ tcc                  tcp://127.0.0.1:60706/0
 Setting the context to `tcc` in this example will use the Docker host running at `127.0.0.1:60706` to create and run the test resources.
 
 === "Environment Variable"
-    ```
+    ```shell
     DOCKER_CONTEXT=tcc
     ```
 
 === "Properties File"
-    ```
+    ```text
     docker.context=tcc
     ```
 
@@ -68,12 +68,12 @@ Testcontainers can automatically add a registry prefix to Docker Hub image names
 You can set this up in two ways:
 
 === "Environment Variable"
-    ```
+    ```shell
     TESTCONTAINERS_HUB_IMAGE_NAME_PREFIX=registry.mycompany.com/mirror/
     ```
 
 === "Properties File"
-    ```
+    ```text
     hub.image.name.prefix=registry.mycompany.com/mirror/
     ```
 
@@ -81,13 +81,13 @@ Once configured, Testcontainers will rewrite Docker Hub image names by adding th
 
 For example, the image:
 
-```
+```text
 testcontainers/helloworld:1.3.0
 ```
 
 will automatically become:
 
-```
+```text
 registry.mycompany.com/mirror/testcontainers/helloworld:1.3.0
 ```
 
diff --git a/docs/test_frameworks/xunit_net.md b/docs/test_frameworks/xunit_net.md
index 1046d2d15..1e083de8d 100644
--- a/docs/test_frameworks/xunit_net.md
+++ b/docs/test_frameworks/xunit_net.md
@@ -39,7 +39,7 @@ Considering that xUnit.net runs tests in a deterministic natural sort order (lik
 
 If you check the output of `docker ps`, you will notice that three container instances in total are run, with two of them being Redis instances.
 
-```title="List running containers"
+```text title="List running containers"
 PS C:\Sources\dotnet\testcontainers-dotnet> docker ps
 CONTAINER ID   IMAGE                       COMMAND                  CREATED
 be115f3df138   redis:7.0                   "docker-entrypoint.s…"   3 seconds ago
@@ -74,7 +74,7 @@ In this case, retrieving the Redis (string) value in the second test will no lon
 
 The output of `docker ps` shows that, instead of two Redis containers, only one runs.
 
-```title="List running containers"
+```text title="List running containers"
 PS C:\Sources\dotnet\testcontainers-dotnet> docker ps
 CONTAINER ID   IMAGE                       COMMAND                  CREATED
 d29a393816ce   redis:7.0                   "docker-entrypoint.s…"   3 seconds ago

From d1107be9b2ed82ef5d85662697e99ffe6386b96c Mon Sep 17 00:00:00 2001
From: Andre Hofmeister <9199345+HofmeisterAn@users.noreply.github.com>
Date: Thu, 19 Mar 2026 19:56:44 +0100
Subject: [PATCH 3/6] fix: Add --preserve-digests flag

---
 docs/api/resource_reaper.md | 25 ++++++++++++++++++++++---
 1 file changed, 22 insertions(+), 3 deletions(-)

diff --git a/docs/api/resource_reaper.md b/docs/api/resource_reaper.md
index 9f3f494d1..c656f9698 100644
--- a/docs/api/resource_reaper.md
+++ b/docs/api/resource_reaper.md
@@ -18,9 +18,28 @@ testcontainers/ryuk:0.14.0@sha256:7c1a8a9a47c780ed0f983770a662f80deb115d95cce3e2
 
 If you depend on a private registry, make the image available there either through a registry proxy (pull-through cache) or by copying it from Docker Hub with a tool that preserves the manifest list and all platform variants, for example [`skopeo`](https://github.com/containers/skopeo):
 
-```shell
-skopeo copy --all docker://docker.io/testcontainers/ryuk@sha256:7c1a8a9a47c780ed0f983770a662f80deb115d95cce3e2daa3d12115b8cd28f0 docker://mynexus.mydomain/testcontainers/ryuk:0.14.0
-```
+=== "Linux/macOS"
+    ```shell
+    skopeo \
+      copy \
+      --all \
+      --preserve-digests \
+      docker://docker.io/testcontainers/ryuk@sha256:7c1a8a9a47c780ed0f983770a662f80deb115d95cce3e2daa3d12115b8cd28f0 \
+      docker://registry.mycompany.com/testcontainers/ryuk:0.14.0
+    ```
+
+=== "Windows"
+    ```powershell
+    # There's no Skopeo package for Windows.
+    docker run `
+      --rm `
+      quay.io/skopeo/stable:v1.22.0 `
+      copy `
+      --all `
+      --preserve-digests `
+      docker://docker.io/testcontainers/ryuk@sha256:7c1a8a9a47c780ed0f983770a662f80deb115d95cce3e2daa3d12115b8cd28f0 `
+      docker://registry.mycompany.com/testcontainers/ryuk:0.14.0
+    ```
 
 !!! warning
 

From 12b0e0a063b251ea4a4084d178b710e2d7893940 Mon Sep 17 00:00:00 2001
From: Andre Hofmeister <9199345+HofmeisterAn@users.noreply.github.com>
Date: Thu, 19 Mar 2026 20:30:50 +0100
Subject: [PATCH 4/6] chore: Add registry to
 TESTCONTAINERS_RYUK_CONTAINER_IMAGE example

---
 docs/api/resource_reaper.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/api/resource_reaper.md b/docs/api/resource_reaper.md
index c656f9698..2012e1e44 100644
--- a/docs/api/resource_reaper.md
+++ b/docs/api/resource_reaper.md
@@ -45,10 +45,10 @@ If you depend on a private registry, make the image available there either throu
 
     Pulling, tagging, and pushing the image manually is not sufficient. That workflow creates a new manifest and only includes the platform variant pulled locally, breaking multi-architecture support.
 
-To use a different image reference, set the `TESTCONTAINERS_RYUK_CONTAINER_IMAGE` environment variable, for example to an unpinned tag:
+If your registry cannot preserve the digest or you want to use a different image reference, set the `TESTCONTAINERS_RYUK_CONTAINER_IMAGE` environment variable:
 
 ```shell
-TESTCONTAINERS_RYUK_CONTAINER_IMAGE=testcontainers/ryuk:0.14.0
+TESTCONTAINERS_RYUK_CONTAINER_IMAGE=registry.mycompany.com/testcontainers/ryuk:0.14.0
 ```
 
 <!-- ## Examples

From c43909e6191ce05a58030250f892556dd3f55695 Mon Sep 17 00:00:00 2001
From: Andre Hofmeister <9199345+HofmeisterAn@users.noreply.github.com>
Date: Thu, 19 Mar 2026 21:05:59 +0100
Subject: [PATCH 5/6] Update docs/api/resource_reaper.md

---
 docs/api/resource_reaper.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/api/resource_reaper.md b/docs/api/resource_reaper.md
index 2012e1e44..1ee46c504 100644
--- a/docs/api/resource_reaper.md
+++ b/docs/api/resource_reaper.md
@@ -10,7 +10,7 @@ Moby Ryuk derives its name from the anime character [Ryuk](https://en.wikipedia.
 
 ## Pinned Ryuk image
 
-Testcontainers for .NET pins the Ryuk image to this manifest list (OCI index) digest:
+Testcontainers for .NET pins the Ryuk image to this manifest list (image index) digest:
 
 ```text
 testcontainers/ryuk:0.14.0@sha256:7c1a8a9a47c780ed0f983770a662f80deb115d95cce3e2daa3d12115b8cd28f0

From ab914ac4f5b609349b986b0f406745f229226527 Mon Sep 17 00:00:00 2001
From: Andre Hofmeister <9199345+HofmeisterAn@users.noreply.github.com>
Date: Fri, 20 Mar 2026 07:14:54 +0100
Subject: [PATCH 6/6] Update docs/api/resource_reaper.md

---
 docs/api/resource_reaper.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/api/resource_reaper.md b/docs/api/resource_reaper.md
index 1ee46c504..5e9c8aea4 100644
--- a/docs/api/resource_reaper.md
+++ b/docs/api/resource_reaper.md
@@ -8,7 +8,7 @@ Testcontainers automatically assigns a Resource Reaper session id to each Docker
 
 Moby Ryuk derives its name from the anime character [Ryuk](https://en.wikipedia.org/wiki/Ryuk_(Death_Note)) and is a fitting choice due to the intriguing narrative of the anime Death Note.
 
-## Pinned Ryuk image
+## Copy image to a private registry
 
 Testcontainers for .NET pins the Ryuk image to this manifest list (image index) digest: