docs: Add info about copying image while preserving image digest

docs/api/create_docker_image.md

@@ -60,7 +60,7 @@ As the tarball's content is based on `/Users/testcontainers/WeatherForecast/`, a
 
     To improve the build time and to reduce the size of the image, it is recommended to include only necessary files. Exclude unnecessary files or directories such as `bin/`, `obj/` and `tests/` with the `.dockerignore` file.
 
-```Dockerfile
+```dockerfile
 FROM mcr.microsoft.com/dotnet/sdk:6.0
 ARG SLN_FILE_PATH="WeatherForecast.sln"
 COPY . .
@@ -86,7 +86,7 @@ A multi-stage Docker image build generates intermediate layers that serve as cac
 
 The following Dockerfile assigns the `org.testcontainers.resource-reaper-session` label to each stage.
 
-```Dockerfile
+```dockerfile
 FROM mcr.microsoft.com/dotnet/sdk:6.0 AS build-env-1
 ARG RESOURCE_REAPER_SESSION_ID="00000000-0000-0000-0000-000000000000"
 LABEL "org.testcontainers.resource-reaper-session"=$RESOURCE_REAPER_SESSION_ID
@@ -127,7 +127,7 @@ _ = new ImageFromDockerfileBuilder()
 
 - When building an image using Testcontainers for .NET and switching the user's context (`USER` statement) in a Dockerfile, the user won't automatically become the [owner](https://github.com/testcontainers/testcontainers-dotnet/issues/1171#issuecomment-2099197840) of the working directory, which seems to be the case when building the image from the CLI. If the running process requires write access to the working directory, it is necessary to set the permissions explicitly (the base image in this example already contains the user `app`):
 
-   ```Dockerfile
+   ```dockerfile
    FROM mcr.microsoft.com/dotnet/sdk:8.0
    WORKDIR /app
    RUN chown app:app .

docs/api/resource_reaper.md

@@ -8,6 +8,49 @@ Testcontainers automatically assigns a Resource Reaper session id to each Docker
 
 Moby Ryuk derives its name from the anime character [Ryuk](https://en.wikipedia.org/wiki/Ryuk_(Death_Note)) and is a fitting choice due to the intriguing narrative of the anime Death Note.
 
+## Copy image to a private registry
+
+Testcontainers for .NET pins the Ryuk image to this manifest list (image index) digest:
+
+```text
+testcontainers/ryuk:0.14.0@sha256:7c1a8a9a47c780ed0f983770a662f80deb115d95cce3e2daa3d12115b8cd28f0
+```
+
+If you depend on a private registry, make the image available there either through a registry proxy (pull-through cache) or by copying it from Docker Hub with a tool that preserves the manifest list and all platform variants, for example [`skopeo`](https://github.com/containers/skopeo):
+
+=== "Linux/macOS"
+    ```shell
+    skopeo \
+      copy \
+      --all \
+      --preserve-digests \
+      docker://docker.io/testcontainers/ryuk@sha256:7c1a8a9a47c780ed0f983770a662f80deb115d95cce3e2daa3d12115b8cd28f0 \
+      docker://registry.mycompany.com/testcontainers/ryuk:0.14.0
+    ```
+
+=== "Windows"
+    ```powershell
+    # There's no Skopeo package for Windows.
+    docker run `
+      --rm `
+      quay.io/skopeo/stable:v1.22.0 `
+      copy `
+      --all `
+      --preserve-digests `
+      docker://docker.io/testcontainers/ryuk@sha256:7c1a8a9a47c780ed0f983770a662f80deb115d95cce3e2daa3d12115b8cd28f0 `
+      docker://registry.mycompany.com/testcontainers/ryuk:0.14.0
+    ```
+
+!!! warning
+
+    Pulling, tagging, and pushing the image manually is not sufficient. That workflow creates a new manifest and only includes the platform variant pulled locally, breaking multi-architecture support.
+
+If your registry cannot preserve the digest or you want to use a different image reference, set the `TESTCONTAINERS_RYUK_CONTAINER_IMAGE` environment variable:
+
+```shell
+TESTCONTAINERS_RYUK_CONTAINER_IMAGE=registry.mycompany.com/testcontainers/ryuk:0.14.0
+```
+
 <!-- ## Examples
 
 Creates a scoped Resource Reaper and assigns its session id to a container (Docker resource). The container is no longer tracked by the default Resource Reaper.

docs/api/wait_strategies.md

@@ -95,7 +95,7 @@ _ = Wait.ForUnixContainer()
 
 If the Docker image supports Dockers's [HEALTHCHECK][docker-docs-healthcheck] feature, like the following configuration:
 
-```Dockerfile
+```dockerfile
 FROM alpine
 HEALTHCHECK --interval=1s CMD test -e /healthcheck
 ```

docs/cicd/index.md

@@ -14,7 +14,7 @@ GitHub-hosted runners have the same configuration as Microsoft-hosted agents. Th
 
 To configure the Docker service in GitLab CI ([Docker-in-Docker](https://docs.gitlab.com/ee/ci/docker/using_docker_build.html#use-docker-in-docker)), you need to define the service in your `.gitlab-ci.yml` file and expose the Docker host address `docker:2375` by setting the `DOCKER_HOST` environment variable.
 
-```yml title=".gitlab-ci.yml file"
+```yaml title=".gitlab-ci.yml file"
 services:
   - docker:dind
 variables:
@@ -25,7 +25,7 @@ variables:
 
 Enable Bitbucket Pipelines as usual on the **Repository settings → Pipelines → Settings** page. After enabling your pipeline, replace the contents of the `bitbucket-pipelines.yml` file, located at the root of your repository, with the following:
 
-```yml title="bitbucket-pipelines.yml file"
+```yaml title="bitbucket-pipelines.yml file"
 image: mcr.microsoft.com/dotnet/sdk:8.0
 options:
   docker: true

docs/custom_configuration/index.md

@@ -16,7 +16,7 @@ Testcontainers supports various configurations to set up your test environment.
 | `docker.socket.override`        | `TESTCONTAINERS_DOCKER_SOCKET_OVERRIDE`        | The file path to the Docker daemon socket that is used by Ryuk (resource reaper).                                         | `/var/run/docker.sock`       |
 | `ryuk.disabled`                 | `TESTCONTAINERS_RYUK_DISABLED`                 | Disables Ryuk (resource reaper).                                                                                          | `false`                      |
 | `ryuk.container.privileged`     | `TESTCONTAINERS_RYUK_CONTAINER_PRIVILEGED`     | Runs Ryuk (resource reaper) in privileged mode.                                                                           | `true`                       |
-| `ryuk.container.image`          | `TESTCONTAINERS_RYUK_CONTAINER_IMAGE`          | The Ryuk (resource reaper) Docker image.                                                                                  | `testcontainers/ryuk:0.14.0` |
+| `ryuk.container.image`          | `TESTCONTAINERS_RYUK_CONTAINER_IMAGE`          | The Ryuk (resource reaper) Docker image.                                                                                  | `testcontainers/ryuk:0.14.0@sha256:7c1a8a9a47c780ed0f983770a662f80deb115d95cce3e2daa3d12115b8cd28f0` |
 | `hub.image.name.prefix`         | `TESTCONTAINERS_HUB_IMAGE_NAME_PREFIX`         | The name to use for substituting the Docker Hub registry part of the image name.                                          | -                            |
 | `wait.strategy.retries`         | `TESTCONTAINERS_WAIT_STRATEGY_RETRIES`         | The wait strategy retry count.                                                                                            | `infinite`                   |
 | `wait.strategy.interval`        | `TESTCONTAINERS_WAIT_STRATEGY_INTERVAL`        | The wait strategy interval<sup>1</sup>.                                                                                   | `00:00:01`                   |
@@ -30,20 +30,20 @@ Testcontainers supports various configurations to set up your test environment.
 To configure a remote container runtime, Testcontainers provides support for Docker's environment variables in addition to the properties file. During initialization, Testcontainers' auto-discovery feature detect and apply custom configurations including container runtimes. If you are running Docker on a remote host, you can configure it using either of the following methods:
 
 === "Environment Variable"
-    ```
+    ```shell
     DOCKER_HOST=tcp://docker:2375
     ```
 
 === "Properties File"
-    ```
+    ```text
     docker.host=tcp://docker:2375
     ```
 
 ## Use a different context
 
 You can switch between contexts using the properties file or an environment variable. Once the context is set, Testcontainers will connect to the specified endpoint based on the given value.
 
-```title="List available contexts"
+```text title="List available contexts"
 PS C:\Sources\dotnet\testcontainers-dotnet> docker context ls
 NAME   DESCRIPTION   DOCKER ENDPOINT           ERROR
 tcc                  tcp://127.0.0.1:60706/0
@@ -52,12 +52,12 @@ tcc                  tcp://127.0.0.1:60706/0
 Setting the context to `tcc` in this example will use the Docker host running at `127.0.0.1:60706` to create and run the test resources.
 
 === "Environment Variable"
-    ```
+    ```shell
     DOCKER_CONTEXT=tcc
     ```
 
 === "Properties File"
-    ```
+    ```text
     docker.context=tcc
     ```
 
@@ -68,26 +68,26 @@ Testcontainers can automatically add a registry prefix to Docker Hub image names
 You can set this up in two ways:
 
 === "Environment Variable"
-    ```
+    ```shell
     TESTCONTAINERS_HUB_IMAGE_NAME_PREFIX=registry.mycompany.com/mirror/
     ```
 
 === "Properties File"
-    ```
+    ```text
     hub.image.name.prefix=registry.mycompany.com/mirror/
     ```
 
 Once configured, Testcontainers will rewrite Docker Hub image names by adding the prefix.
 
 For example, the image:
 
-```
+```text
 testcontainers/helloworld:1.3.0
 ```
 
 will automatically become:
 
-```
+```text
 registry.mycompany.com/mirror/testcontainers/helloworld:1.3.0
 ```
 

docs/test_frameworks/xunit_net.md

@@ -39,7 +39,7 @@ Considering that xUnit.net runs tests in a deterministic natural sort order (lik
 
 If you check the output of `docker ps`, you will notice that three container instances in total are run, with two of them being Redis instances.
 
-```title="List running containers"
+```text title="List running containers"
 PS C:\Sources\dotnet\testcontainers-dotnet> docker ps
 CONTAINER ID   IMAGE                       COMMAND                  CREATED
 be115f3df138   redis:7.0                   "docker-entrypoint.s…"   3 seconds ago
@@ -74,7 +74,7 @@ In this case, retrieving the Redis (string) value in the second test will no lon
 
 The output of `docker ps` shows that, instead of two Redis containers, only one runs.
 
-```title="List running containers"
+```text title="List running containers"
 PS C:\Sources\dotnet\testcontainers-dotnet> docker ps
 CONTAINER ID   IMAGE                       COMMAND                  CREATED
 d29a393816ce   redis:7.0                   "docker-entrypoint.s…"   3 seconds ago

src/Testcontainers/Containers/PortForwarding.cs

@@ -61,7 +61,7 @@ public Task ExposeHostPortsAsync(IEnumerable<ushort> ports, CancellationToken ct
     [PublicAPI]
     private sealed class PortForwardingBuilder : ContainerBuilder<PortForwardingBuilder, PortForwardingContainer, PortForwardingConfiguration>
     {
-      public const string SshdImage = "testcontainers/sshd:1.2.0@sha256:eb168d900fc070479a5e90dfac5a55ab80ee364a1d5017a5a8dc3ad8cb4e975a";
+      public const string SshdImage = "testcontainers/sshd:1.3.0@sha256:c50c0f59554dcdb2d9e5e705112144428ae9d04ac0af6322b365a18e24213a6a";
 
       public const ushort SshdPort = 22;