feature: disable the ability for wave to "pull" images directly

Add a `wave.container.pull.enabled` setting (default true) that, when set
to false, disables the container pull/augmentation path so that Wave no
longer acts as an on-the-fly augmenting or pass-through proxy. In that
mode plain container image requests are rejected and callers must use
"freeze" mode to provision the container via an actual image build.

The guard is applied in ContainerController.makeRequestData in the branch
that resolves to ContainerRequest.Type.Container - the only path that
produces an augmented/pulled container. It sits after the freeze rewrite,
so freeze, build and mirror requests are unaffected.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: gavinelder

docs/configuration.md

@@ -30,6 +30,10 @@ Configure general Wave application settings, such as application name, port, ano
 : When `true`, anonymous users can access the Wave server (default: `false`).
   Modify this option based on your security requirements.
 
+`wave.container.pull.enabled` *(optional)*
+: When `true`, Wave can provision a container by pulling an existing image directly, applying any container configuration on the fly (the augmentation path) (default: `true`).
+  Set to `false` to disable the pull path in locked-down deployments where Wave must not act as an augmenting or pass-through proxy; such requests are rejected and must instead use `freeze` mode to provision the container via an actual image build.
+
 `wave.denyHosts` *(optional)*
 : Hostname patterns to deny. Requests targeting these hosts are rejected.
   Example patterns: `ngrok.app`, `ngrok-free.app`, `//localhost`.

src/main/groovy/io/seqera/wave/controller/ContainerController.groovy

@@ -127,6 +127,16 @@ class ContainerController {
     @Value('${wave.allowAnonymous}')
     private Boolean allowAnonymous
 
+    /**
+     * When {@code false} the container pull path (on-the-fly augmentation and pass-through proxying
+     * of an existing image) is disabled, and requests must use "freeze" mode to provision a container
+     * via an actual image build. Useful for locked-down deployments where Wave must not act as an
+     * augmenting/pass-through pull proxy.
+     */
+    @Inject
+    @Value('${wave.container.pull.enabled:true}')
+    private Boolean allowPull
+
     @Inject
     @Value('${wave.server.url}')
     private String serverUrl
@@ -559,6 +569,12 @@ class ContainerController {
             type = ContainerRequest.Type.Mirror
         }
         else if( req.containerImage ) {
+            // the container pull path (augmentation / pass-through) may be disabled in locked-down
+            // deployments; such requests must instead use "freeze" mode to build the container.
+            // note: a freeze request never reaches this branch because it has already been rewritten
+            // into a container build request by freezeService.freezeBuildRequest(..) above
+            if( allowPull == Boolean.FALSE )
+                throw new BadRequestException("Container pull is not allowed in this Wave deployment - use 'freeze' mode to provision this container")
             // normalize container image
             final coords = ContainerCoordinates.parse(req.containerImage)
             targetImage = coords.getTargetContainer()

src/main/resources/application.yml

@@ -56,6 +56,10 @@ micronaut:
 ---
 wave:
   allowAnonymous: true
+  container:
+    pull:
+      # when false, disable the container pull/augmentation path; requests must use "freeze" mode
+      enabled: true
   server:
       url: "${WAVE_SERVER_URL:`http://localhost:9090`}"
   security:

src/test/groovy/io/seqera/wave/controller/ContainerControllerTest.groovy

@@ -60,6 +60,7 @@ import io.seqera.service.pairing.PairingService
 import io.seqera.service.pairing.socket.PairingChannel
 import io.seqera.wave.service.persistence.PersistenceService
 import io.seqera.wave.service.persistence.WaveContainerRecord
+import io.seqera.wave.service.request.ContainerRequest
 import io.seqera.wave.service.request.ContainerRequestService
 import io.seqera.wave.service.request.TokenData
 import io.seqera.wave.service.validation.ValidationService
@@ -147,6 +148,30 @@ class ContainerControllerTest extends Specification {
 
     }
 
+    def 'should reject pull request when container pull is disabled' () {
+        given:
+        def controller = new ContainerController(inclusionService: Mock(ContainerInclusionService), registryProxyService: proxyRegistry, allowPull: false)
+
+        when: 'a plain container image (pull/augment) request is rejected'
+        def req = new SubmitContainerTokenRequest(containerImage: 'ubuntu:latest', containerPlatform: 'linux/amd64')
+        controller.makeRequestData(req, PlatformId.NULL, "")
+        then:
+        def e = thrown(BadRequestException)
+        e.message == "Container pull is not allowed in this Wave deployment - use 'freeze' mode to provision this container"
+    }
+
+    def 'should allow pull request when container pull is enabled' () {
+        given:
+        def controller = new ContainerController(inclusionService: Mock(ContainerInclusionService), registryProxyService: proxyRegistry, allowPull: true)
+
+        when:
+        def req = new SubmitContainerTokenRequest(containerImage: 'ubuntu:latest', containerPlatform: 'linux/amd64')
+        def data = controller.makeRequestData(req, PlatformId.NULL, "")
+        then:
+        data.containerImage == 'docker.io/library/ubuntu:latest'
+        data.type == ContainerRequest.Type.Container
+    }
+
     def 'should create request data with freeze mode' () {
         given:
         def freeze = Mock(FreezeService)