feat(ecr-ecs-lambda): wire fakecloud ECR into ECS + Lambda image pull

[vieiralucas]

Summary

Batch 1 of the ECR+ECS tightening pass — the flagship cross-service integration. Images pushed to fakecloud ECR via the OCI v2 endpoint are now pulled and run by ECS tasks and Lambda functions that reference them by AWS URI.

• ECR URI translator in fakecloud-core shared between ECS + Lambda
• ECS runtime pulls from fakecloud ECR transparently when task image is an AWS ECR URI; retags to preserve user-facing image name
• Lambda PackageType=Image now wired: Code.ImageUri flows through CreateFunction -> GetFunction -> container runtime
• Isolated DOCKER_CONFIG tempdir carries Basic auth for 127.0.0.1:<port> so pulls work without mutating the user's docker config
• E2E test proves the full loop: docker push alpine to fakecloud ECR -> RunTask with AWS URI -> captured stdout matches container output

Test plan

• cargo test -p fakecloud-core -p fakecloud-ecs -p fakecloud-lambda -p fakecloud-ecr — all unit tests pass
• cargo test -p fakecloud-e2e --test ecr_cross_service — four tests pass (Linux path skipped on macOS as designed)
• cargo test -p fakecloud-e2e --test ecs --test ecr --test ecr_oci --test lambda — no regressions
• cargo clippy --workspace --all-targets -- -D warnings — clean
• cargo fmt --all -- --check — clean
• CI (Linux) runs the docker-push path of ecr_cross_service end-to-end

---

Summary by cubic

Wired fakecloud ECR into ECS and Lambda image pulls so images pushed to the local OCI v2 registry can be referenced by AWS ECR URIs and run end to end. Tightened URI detection, digest handling, and env var rewriting for a smoother AWS-like flow.

• New Features

  • Added fakecloud_core::ecr_uri to translate <acct>.dkr.ecr.<region>.amazonaws.com/<repo>[:tag|@sha256] to 127.0.0.1:<port>/<repo>[:tag|@sha256].
  • fakecloud-ecs pulls via the local registry for ECR URIs, retags to the AWS name, and uses an isolated DOCKER_CONFIG with Basic auth.
  • fakecloud-lambda supports PackageType=Image: stores Code.ImageUri, returns it in GetFunction, pulls via the same translator, and rejects Image without ImageUri.
  • fakecloud-server passes the bound port to both runtimes; new E2E test verifies push-to-ECR → ECS RunTask; ECS docs updated.

• Bug Fixes

  • Restored env-var rewriting for localhost → host.docker.internal in the ECS runtime.
  • Digest-pinned refs (@sha256) skip retagging; ECS and Lambda run under the local 127.0.0.1 URI.
  • Code.ImageUri is parsed only for PackageType=Image; Zip functions ignore it.
  • ECR URI detection is host-anchored to avoid false positives.

^{Written for commit 26cf0fd. Summary will update on new commits.}

[codecov]

Codecov Report

❌ Patch coverage is 30.17544% with 199 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
crates/fakecloud-lambda/src/runtime.rs	0.00%	143 Missing ⚠️
crates/fakecloud-ecs/src/runtime.rs	17.02%	39 Missing ⚠️
crates/fakecloud-lambda/src/service.rs	57.57%	14 Missing ⚠️
crates/fakecloud-server/src/main.rs	0.00%	3 Missing ⚠️

📢 Thoughts on this report? Let us know!

[cubic-dev-ai]

5 issues found across 12 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="crates/fakecloud-lambda/src/service.rs">

<violation number="1" location="crates/fakecloud-lambda/src/service.rs:98">
P2: `Code.ImageUri` is accepted for non-image functions, which can make `GetFunction` return ECR code metadata for `PackageType=Zip` functions.</violation>
</file>

<file name="crates/fakecloud-ecs/src/runtime.rs">

<violation number="1" location="crates/fakecloud-ecs/src/runtime.rs:210">
P1: `localhost` URL rewriting was accidentally removed and replaced with duplicate `127.0.0.1` replacements, so container env vars using `localhost` will not be translated to `host.docker.internal`.</violation>
</file>

<file name="crates/fakecloud-core/src/ecr_uri.rs">

<violation number="1" location="crates/fakecloud-core/src/ecr_uri.rs:15">
P2: Validate the registry host before classifying an image as private ECR; the current substring check can misroute non-ECR images that contain those tokens in the repository path.</violation>

<violation number="2" location="crates/fakecloud-core/src/ecr_uri.rs:33">
P1: Preserving digest refs here breaks downstream retagging; the ECS/Lambda runtimes use `docker tag ... <aws-uri>`, which cannot target `@sha256` references.</violation>
</file>

<file name="website/content/docs/services/ecs.md">

<violation number="1" location="website/content/docs/services/ecs.md:55">
P3: Clarify the platform caveat here: the ECR pull is not daemon-config-free on every Docker setup (macOS Docker Desktop still needs insecure-registry support).</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}