Mirror public images to internal registry

[pawelchcki]

Pull all public Docker images from registry.ddbuild.io mirrors. Adds bin/mirror_images.py to manage the list, lock digests, lint, and sync. Removes CircleCI.

• example/ keeps public refs (works outside DD infra)
• MIRROR_REGISTRY="" in GHA for public pulls
• Auto-cancel pipelines on new push

[Copilot]

Pull request overview

This PR migrates all public Docker image references (Docker Hub, ghcr.io, registry.k8s.io) in CI configs, Dockerfiles, and compose files to use an internal registry.ddbuild.io/ci/nginx-datadog/mirror/ registry. It also introduces tooling to manage the mirror lifecycle and adds CI automation for linting and mirroring.

Changes:

• Adds bin/mirror_images.py CLI tool with lint, add, lock, relock, and mirror subcommands; mirror_images.yaml source config; and mirror_images.lock.yaml lock file with digests for 101 images.
• Replaces all public image references across CI configs (.gitlab/build-and-test-*.yml, .gitlab/common.yml), Dockerfiles (build_env/, test/, example/, injection/), and compose files with mirror-prefixed equivalents.
• Adds GitLab CI mirror-images stage with lint and mirror jobs, auto-cancellation on new commits, and an AGENTS.md codebase overview.

Reviewed changes

Copilot reviewed 20 out of 21 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
bin/mirror_images.py	New CLI tool for managing mirrored image lifecycle
mirror_images.yaml	Source-of-truth list of all images to mirror
mirror_images.lock.yaml	Auto-generated lock file with resolved digests (missing alpine:3.20.3)
.gitlab/mirror.yml	New CI stage with lint and mirror jobs
.gitlab-ci.yml	Adds mirror-images stage, auto-cancel, and interruptible default
.gitlab/build-and-test-fast.yml	Replaces all public image refs with mirror refs
.gitlab/build-and-test-all.yml	Replaces all public image refs with mirror refs
.gitlab/common.yml	Replaces ingress-nginx and openresty image refs
build_env/Dockerfile	Introduces MIRROR_REGISTRY ARG; uses mirrored uv and alpine
Makefile	Passes MIRROR_REGISTRY build-arg conditionally
.github/workflows/system-tests.yml	Sets MIRROR_REGISTRY="" for GHA to use public images
test/Dockerfile	Replaces Python and uv image refs with mirrors
test/services/client/Dockerfile	Replaces alpine/curl-http3 with mirror ref
injection/ingress-nginx/docker-compose.yaml	Replaces testagent and nginx refs with mirrors
example/tracing/docker-compose.yml	Replaces datadog/agent with mirror ref
example/openresty/docker-compose.yml	Replaces datadog/agent with mirror ref
example/tracing/services/client/Dockerfile	Replaces alpine:3.19 with mirror ref
example/openresty/services/client/Dockerfile	Replaces alpine:3.19 with mirror ref
example/ingress-nginx/test-application.yaml	Replaces ealen/echo-server with mirror ref
example/ingress-nginx/helm/values.yaml	Updates image path but leaves conflicting registry: docker.io
AGENTS.md	New file with codebase overview for AI agents

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[cataphract]

Wouldn't it be simpler to use our internal mirror that automatically proxies and caches the images? (486234852809.dkr.ecr.us-east-1.amazonaws.com 669783387624.dkr.ecr.us-east-1.amazonaws.com I believe) It's disadvantage is that you have no control of cache invalidation, but since you want to resolve to individual digests through locking, it doesn't really matter. This would avoid all the boilerplate to mirror manually.

[pawelchcki]

Wouldn't it be simpler to use our internal mirror that automatically proxies and caches the images (486234852809.dkr.ecr.us-east-1.amazonaws.com 669783387624.dkr.ecr.us-east-1.amazonaws.com I believe)

Having explicit mirrors also helps us to be a little bit more resilent in case image is pulled form upstream repository. than a pull-through cache Also its better to use the official registry.ddbuild.io rather than one of the rand ecs repositories

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 68.85%. Comparing base (b9e382b) to head (b176db1).

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #313   +/-   ##
=======================================
  Coverage   68.85%   68.85%           
=======================================
  Files          56       56           
  Lines        7471     7471           
  Branches     1058     1058           
=======================================
  Hits         5144     5144           
  Misses       1820     1820           
  Partials      507      507           

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.