fix: preserve shared local image identity

[alongubkin]

Resolve actual immutable Docker image IDs before container creation and record them in resource/build labels. The lock map keeps weak entries and prunes completed imports under its map lock, while owners and waiters retain strong mutex references. Archive imports lock only shared content or affected references, with archive parsing outside the lock; unrelated images can load concurrently. Preserve registry content bytes through the updated image loader.

Validation: both real Docker integration tests passed twice. Each archive run starts with unique cold content, concurrently imports shared content, verifies both running containers and immutable identity, removes the owned containers/image, and checks the image is absent afterward. The registry test verifies container creation and labels use the inspected immutable ID. Image-loader library tests (38) and registry byte-preservation integration passed. Lock-retention regression passed, including a blocked shared waiter and 100 unrelated imports with bounded map size. Latest required CI is green on head 1ff668e. Combined CLI all-features build passed.

Combined CLI application validation passed all 11 conformance suites (113 checks), including native workers, uploads, nested projection, authentication and build tokens.

[enclave-ai]

Enclave skipped this draft pull request. It will run automatically when you mark the PR as Ready for review.

[greptile-apps]

Confidence Score: 5/5

[High risk] Updates a container image dependency and adds synchronization logic.

The PR appears safe to merge based on the reviewed changes.

Summary

The PR resolves immutable Docker image IDs for container creation and labels, narrows archive-import locking to shared content or references, and adds image-identity and lock-retention tests.

• Since the previous review, the lock map now holds weak references and prunes entries after imports finish.
• All four previous Greptile threads are resolved; none is outstanding for scoring.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[Read archive identity] --> B[Prune and acquire keyed locks]
  B --> C{Image already present?}
  C -->|Yes| D[Use immutable image ID]
  C -->|No| E[Docker load]
  E --> D
  D --> F[Create container and record labels]

Loading

_{Reviews (3) · Last reviewed commit: "fix: reclaim inactive image import locks"}