pull: allow blob sharing

.bazelrc

@@ -1,7 +1,7 @@
 # To update these lines, execute
 # `bazel run @rules_bazel_integration_test//tools:update_deleted_packages`
-build --deleted_packages=e2e/cc,e2e/cc/base,e2e/cc/custom_standard_library,e2e/cc/patches,e2e/cc/platform,e2e/generic,e2e/generic/build_settings,e2e/generic/custom_distroless_base_image,e2e/generic/existing_tar_files,e2e/generic/extend,e2e/generic/load,e2e/generic/multi_deploy,e2e/generic/platform,e2e/go,e2e/go/customization,e2e/go/image,e2e/go/multiarch,e2e/js,e2e/js/app,e2e/js/platform,e2e/python,e2e/python/platform,e2e/python/requirements,e2e/workspace,img_tool,img_tool/cmd,img_tool/cmd/bes,img_tool/cmd/compress,img_tool/cmd/deploy,img_tool/cmd/dockersave,img_tool/cmd/downloadblob,img_tool/cmd/expandtemplate,img_tool/cmd/img,img_tool/cmd/index,img_tool/cmd/layer,img_tool/cmd/layermeta,img_tool/cmd/manifest,img_tool/cmd/ocilayout,img_tool/cmd/push,img_tool/cmd/registry,img_tool/cmd/validate,img_tool/cmd/validate/layer-presence,img_tool/pkg/api,img_tool/pkg/auth/credential,img_tool/pkg/auth/grpcheaderinterceptor,img_tool/pkg/auth/protohelper,img_tool/pkg/auth/registry,img_tool/pkg/cas,img_tool/pkg/compress,img_tool/pkg/compress/util,img_tool/pkg/containerd,img_tool/pkg/contentmanifest,img_tool/pkg/deployvfs,img_tool/pkg/digestfs,img_tool/pkg/docker,img_tool/pkg/fileopener,img_tool/pkg/load,img_tool/pkg/proto/bazel,img_tool/pkg/proto/bazel/src/main/java/com/google/devtools/build/lib/buildeventstream,img_tool/pkg/proto/bazel/src/main/java/com/google/devtools/build/lib/packages/metrics,img_tool/pkg/proto/bazel/src/main/protobuf,img_tool/pkg/proto/blobcache,img_tool/pkg/proto/build_event_service,img_tool/pkg/proto/remote-apis,img_tool/pkg/proto/remote-apis/build/bazel/remote/execution/v2,img_tool/pkg/proto/remote-apis/build/bazel/semver,img_tool/pkg/push,img_tool/pkg/serve/bes,img_tool/pkg/serve/bes/syncer,img_tool/pkg/serve/blobcache,img_tool/pkg/serve/registry,img_tool/pkg/serve/registry/reapi,img_tool/pkg/serve/registry/s3,img_tool/pkg/serve/registry/upstream,img_tool/pkg/tarcas,img_tool/pkg/tree,img_tool/pkg/tree/merkle,img_tool/pkg/tree/runfiles,img_tool/pkg/tree/treeartifact,img_tool/toolchain,img_tool/tools,pull_tool,pull_tool/cmd/downloadblob,pull_tool/cmd/internal/pull,pull_tool/cmd/pull_tool,pull_tool/pkg/auth/registry,pull_tool/pull/private
-query --deleted_packages=e2e/cc,e2e/cc/base,e2e/cc/custom_standard_library,e2e/cc/patches,e2e/cc/platform,e2e/generic,e2e/generic/build_settings,e2e/generic/custom_distroless_base_image,e2e/generic/existing_tar_files,e2e/generic/extend,e2e/generic/load,e2e/generic/multi_deploy,e2e/generic/platform,e2e/go,e2e/go/customization,e2e/go/image,e2e/go/multiarch,e2e/js,e2e/js/app,e2e/js/platform,e2e/python,e2e/python/platform,e2e/python/requirements,e2e/workspace,img_tool,img_tool/cmd,img_tool/cmd/bes,img_tool/cmd/compress,img_tool/cmd/deploy,img_tool/cmd/dockersave,img_tool/cmd/downloadblob,img_tool/cmd/expandtemplate,img_tool/cmd/img,img_tool/cmd/index,img_tool/cmd/layer,img_tool/cmd/layermeta,img_tool/cmd/manifest,img_tool/cmd/ocilayout,img_tool/cmd/push,img_tool/cmd/registry,img_tool/cmd/validate,img_tool/cmd/validate/layer-presence,img_tool/pkg/api,img_tool/pkg/auth/credential,img_tool/pkg/auth/grpcheaderinterceptor,img_tool/pkg/auth/protohelper,img_tool/pkg/auth/registry,img_tool/pkg/cas,img_tool/pkg/compress,img_tool/pkg/compress/util,img_tool/pkg/containerd,img_tool/pkg/contentmanifest,img_tool/pkg/deployvfs,img_tool/pkg/digestfs,img_tool/pkg/docker,img_tool/pkg/fileopener,img_tool/pkg/load,img_tool/pkg/proto/bazel,img_tool/pkg/proto/bazel/src/main/java/com/google/devtools/build/lib/buildeventstream,img_tool/pkg/proto/bazel/src/main/java/com/google/devtools/build/lib/packages/metrics,img_tool/pkg/proto/bazel/src/main/protobuf,img_tool/pkg/proto/blobcache,img_tool/pkg/proto/build_event_service,img_tool/pkg/proto/remote-apis,img_tool/pkg/proto/remote-apis/build/bazel/remote/execution/v2,img_tool/pkg/proto/remote-apis/build/bazel/semver,img_tool/pkg/push,img_tool/pkg/serve/bes,img_tool/pkg/serve/bes/syncer,img_tool/pkg/serve/blobcache,img_tool/pkg/serve/registry,img_tool/pkg/serve/registry/reapi,img_tool/pkg/serve/registry/s3,img_tool/pkg/serve/registry/upstream,img_tool/pkg/tarcas,img_tool/pkg/tree,img_tool/pkg/tree/merkle,img_tool/pkg/tree/runfiles,img_tool/pkg/tree/treeartifact,img_tool/toolchain,img_tool/tools,pull_tool,pull_tool/cmd/downloadblob,pull_tool/cmd/internal/pull,pull_tool/cmd/pull_tool,pull_tool/pkg/auth/registry,pull_tool/pull/private
+build --deleted_packages=e2e/cc,e2e/cc/base,e2e/cc/custom_standard_library,e2e/cc/patches,e2e/cc/platform,e2e/generic,e2e/generic/build_settings,e2e/generic/custom_distroless_base_image,e2e/generic/existing_tar_files,e2e/generic/extend,e2e/generic/load,e2e/generic/multi_deploy,e2e/generic/platform,e2e/go,e2e/go/customization,e2e/go/image,e2e/go/multiarch,e2e/js,e2e/js/app,e2e/js/platform,e2e/python,e2e/python/platform,e2e/python/requirements,e2e/workspace,img_tool,img_tool/cmd,img_tool/cmd/bes,img_tool/cmd/compress,img_tool/cmd/deploy,img_tool/cmd/dockersave,img_tool/cmd/downloadblob,img_tool/cmd/expandtemplate,img_tool/cmd/img,img_tool/cmd/index,img_tool/cmd/layer,img_tool/cmd/layermeta,img_tool/cmd/manifest,img_tool/cmd/ocilayout,img_tool/cmd/push,img_tool/cmd/registry,img_tool/cmd/validate,img_tool/cmd/validate/layer-presence,img_tool/pkg/api,img_tool/pkg/auth/credential,img_tool/pkg/auth/grpcheaderinterceptor,img_tool/pkg/auth/protohelper,img_tool/pkg/auth/registry,img_tool/pkg/cas,img_tool/pkg/compress,img_tool/pkg/compress/util,img_tool/pkg/containerd,img_tool/pkg/contentmanifest,img_tool/pkg/deployvfs,img_tool/pkg/digestfs,img_tool/pkg/docker,img_tool/pkg/fileopener,img_tool/pkg/load,img_tool/pkg/proto/bazel,img_tool/pkg/proto/bazel/src/main/java/com/google/devtools/build/lib/buildeventstream,img_tool/pkg/proto/bazel/src/main/java/com/google/devtools/build/lib/packages/metrics,img_tool/pkg/proto/bazel/src/main/protobuf,img_tool/pkg/proto/blobcache,img_tool/pkg/proto/build_event_service,img_tool/pkg/proto/remote-apis,img_tool/pkg/proto/remote-apis/build/bazel/remote/execution/v2,img_tool/pkg/proto/remote-apis/build/bazel/semver,img_tool/pkg/push,img_tool/pkg/serve/bes,img_tool/pkg/serve/bes/syncer,img_tool/pkg/serve/blobcache,img_tool/pkg/serve/registry,img_tool/pkg/serve/registry/reapi,img_tool/pkg/serve/registry/s3,img_tool/pkg/serve/registry/upstream,img_tool/pkg/tarcas,img_tool/pkg/tree,img_tool/pkg/tree/merkle,img_tool/pkg/tree/runfiles,img_tool/pkg/tree/treeartifact,img_tool/toolchain,img_tool/tools,pull_tool,pull_tool/cmd/downloadblob,pull_tool/cmd/internal/pull,pull_tool/cmd/pull_tool,pull_tool/pkg/auth/registry,pull_tool/pkg/blobstore,pull_tool/pkg/transport/cachedblob,pull_tool/pkg/transport/integration_test,pull_tool/pull/private
+query --deleted_packages=e2e/cc,e2e/cc/base,e2e/cc/custom_standard_library,e2e/cc/patches,e2e/cc/platform,e2e/generic,e2e/generic/build_settings,e2e/generic/custom_distroless_base_image,e2e/generic/existing_tar_files,e2e/generic/extend,e2e/generic/load,e2e/generic/multi_deploy,e2e/generic/platform,e2e/go,e2e/go/customization,e2e/go/image,e2e/go/multiarch,e2e/js,e2e/js/app,e2e/js/platform,e2e/python,e2e/python/platform,e2e/python/requirements,e2e/workspace,img_tool,img_tool/cmd,img_tool/cmd/bes,img_tool/cmd/compress,img_tool/cmd/deploy,img_tool/cmd/dockersave,img_tool/cmd/downloadblob,img_tool/cmd/expandtemplate,img_tool/cmd/img,img_tool/cmd/index,img_tool/cmd/layer,img_tool/cmd/layermeta,img_tool/cmd/manifest,img_tool/cmd/ocilayout,img_tool/cmd/push,img_tool/cmd/registry,img_tool/cmd/validate,img_tool/cmd/validate/layer-presence,img_tool/pkg/api,img_tool/pkg/auth/credential,img_tool/pkg/auth/grpcheaderinterceptor,img_tool/pkg/auth/protohelper,img_tool/pkg/auth/registry,img_tool/pkg/cas,img_tool/pkg/compress,img_tool/pkg/compress/util,img_tool/pkg/containerd,img_tool/pkg/contentmanifest,img_tool/pkg/deployvfs,img_tool/pkg/digestfs,img_tool/pkg/docker,img_tool/pkg/fileopener,img_tool/pkg/load,img_tool/pkg/proto/bazel,img_tool/pkg/proto/bazel/src/main/java/com/google/devtools/build/lib/buildeventstream,img_tool/pkg/proto/bazel/src/main/java/com/google/devtools/build/lib/packages/metrics,img_tool/pkg/proto/bazel/src/main/protobuf,img_tool/pkg/proto/blobcache,img_tool/pkg/proto/build_event_service,img_tool/pkg/proto/remote-apis,img_tool/pkg/proto/remote-apis/build/bazel/remote/execution/v2,img_tool/pkg/proto/remote-apis/build/bazel/semver,img_tool/pkg/push,img_tool/pkg/serve/bes,img_tool/pkg/serve/bes/syncer,img_tool/pkg/serve/blobcache,img_tool/pkg/serve/registry,img_tool/pkg/serve/registry/reapi,img_tool/pkg/serve/registry/s3,img_tool/pkg/serve/registry/upstream,img_tool/pkg/tarcas,img_tool/pkg/tree,img_tool/pkg/tree/merkle,img_tool/pkg/tree/runfiles,img_tool/pkg/tree/treeartifact,img_tool/toolchain,img_tool/tools,pull_tool,pull_tool/cmd/downloadblob,pull_tool/cmd/internal/pull,pull_tool/cmd/pull_tool,pull_tool/pkg/auth/registry,pull_tool/pkg/blobstore,pull_tool/pkg/transport/cachedblob,pull_tool/pkg/transport/integration_test,pull_tool/pull/private
 
 common --override_module=rules_img_tool=%workspace%/img_tool
 common --override_module=rules_img_pull_tool=%workspace%/pull_tool

docs/pull.md

@@ -9,7 +9,8 @@ Public API for pulling base container images.
 <pre>
 load("@rules_img//img:pull.bzl", "pull")
 
-pull(<a href="#pull-name">name</a>, <a href="#pull-digest">digest</a>, <a href="#pull-downloader">downloader</a>, <a href="#pull-layer_handling">layer_handling</a>, <a href="#pull-registries">registries</a>, <a href="#pull-registry">registry</a>, <a href="#pull-repo_mapping">repo_mapping</a>, <a href="#pull-repository">repository</a>, <a href="#pull-tag">tag</a>)
+pull(<a href="#pull-name">name</a>, <a href="#pull-airgapped">airgapped</a>, <a href="#pull-blob_files">blob_files</a>, <a href="#pull-digest">digest</a>, <a href="#pull-downloader">downloader</a>, <a href="#pull-layer_handling">layer_handling</a>, <a href="#pull-registries">registries</a>, <a href="#pull-registry">registry</a>,
+     <a href="#pull-repo_mapping">repo_mapping</a>, <a href="#pull-repository">repository</a>, <a href="#pull-tag">tag</a>)
 </pre>
 
 Pulls a container image from a registry using shallow pulling.
@@ -41,6 +42,8 @@ will resolve the tag to a digest at fetch time and print a warning.
 | Name  | Description | Type | Mandatory | Default |
 | :------------- | :------------- | :------------- | :------------- | :------------- |
 | <a id="pull-name"></a>name |  A unique name for this repository.   | <a href="https://bazel.build/concepts/labels#target-names">Name</a> | required |  |
+| <a id="pull-airgapped"></a>airgapped |  Enable airgapped mode.<br><br>When enabled, the pull tool will only use locally cached blobs and will not attempt any network requests. This is useful for completely offline/air-gapped environments where all required blobs must be provided via blob_files.<br><br>If a required blob is not available locally, the pull will fail rather than attempting to download it.   | Boolean | optional |  `False`  |
+| <a id="pull-blob_files"></a>blob_files |  Pre-downloaded blob files to use.<br><br>A dictionary mapping blob digests (e.g., "sha256:abc123...") to file labels. These blobs will be verified and used instead of downloading from the registry when available. This is useful for air-gapped environments or to avoid redundant downloads of common base layers.   | Dictionary: String -> Label | optional |  `{}`  |
 | <a id="pull-digest"></a>digest |  The image digest for reproducible pulls (e.g., "sha256:abc123...").<br><br>When specified, the image is pulled by digest instead of tag, ensuring reproducible builds. The digest must be a full SHA256 digest starting with "sha256:".   | String | optional |  `""`  |
 | <a id="pull-downloader"></a>downloader |  The tool to use for downloading manifests and blobs.<br><br>**Available options:**<br><br>* **`img_tool`** (default): Uses the `img` tool for all downloads.<br><br>* **`bazel`**: Uses Bazel's native HTTP capabilities for downloading manifests and blobs.   | String | optional |  `"img_tool"`  |
 | <a id="pull-layer_handling"></a>layer_handling |  Strategy for handling image layers.<br><br>This attribute controls when and how layer data is fetched from the registry.<br><br>**Available strategies:**<br><br>* **`shallow`** (default): Layer data is fetched only if needed during push operations,   but is not available during the build. This is the most efficient option for images   that are only used as base images for pushing.<br><br>* **`eager`**: Layer data is fetched in the repository rule and is always available.   This ensures layers are accessible in build actions but is inefficient as all layers   are downloaded regardless of whether they're needed. Use this for base images that   need to be read or inspected during the build.<br><br>* **`lazy`**: Layer data is downloaded in a build action when requested. This provides   access to layers during builds while avoiding unnecessary downloads, but requires   network access during the build phase. **EXPERIMENTAL:** Use at your own risk.   | String | optional |  `"shallow"`  |

e2e/generic/MODULE.bazel

@@ -52,6 +52,99 @@ pull = use_repo_rule("@rules_img//img:pull.bzl", "pull")
 pull(
     name = "alpine",
     digest = "sha256:4b7ce07002c69e8f3d704a9c5d6fd3053be500b7f1c69fc0d80990c2ad8dd412",
+    layer_handling = "eager",
+    registries = [
+        "mirror.gcr.io",
+        "index.docker.io",
+    ],
+    repository = "library/alpine",
+    tag = "3.22",
+)
+
+alpine_blobs = [
+    "sha256:0274e060a04b4de0452d143527cf9c2776ecf1e75353b6a4e65d96ff31300a0b",
+    "sha256:050d2042e170096c4df38f07c2273bbe9ea58c60f8472f9f1b2afaf6da346950",
+    "sha256:092cf4c3899032cdf45f3159ec6959b7ad1039335b892f4e0737f07f36eadd8d",
+    "sha256:0a23e5e40e97dbde2e957d31dce1e97135d77639f92600cd8176e30dea70c24f",
+    "sha256:0de8d0f587c8bf25bf1381e379cdccf985e878ac949743f45365b4872344ba17",
+    "sha256:0df9f945c965a46cc0bb181d38850468d44fca9a1244eb3dbf611dad49eec2a2",
+    "sha256:0f76808945528344ab8aac9fe6f5f6e262fbe3272653aebd437656a151313d08",
+    "sha256:139bee3c50b89b56dcbc72522ce83097d9beb59d9d3a5c19072ccd1ad54b11c8",
+    "sha256:13c6e95c06ae06f126f5e940d6d88c2fec0da715c80878ad225c76ad48d0a31e",
+    "sha256:171e65262c8018f8f09a360006af2acbb2c0c494cb2be933025b466ea3d672dc",
+    "sha256:1ca2771610fc6d5b38d478d41ddd531d6335c5e60afbdb05bd4d8286aaa5276b",
+    "sha256:1d62db0f76abe77b24ea3b44b8a8163ae9c7b677df7da02e06c56401c952fda2",
+    "sha256:1e5420b375eeab126bf1b2242f8fcf4bc7dae869b58e966dc10bc0c6b22bc0a2",
+    "sha256:24bb3511a0db7b5114a4aee033c65a8a4148f39b7b80a398e548546db967a36f",
+    "sha256:2763c7fc79b66030222442365f4a0f69d9dbaa11f7fd47a918d29d732d52996c",
+    "sha256:291c2310bc71c4729898622ebcac75b761af88817542024404788b3681e92dc9",
+    "sha256:2ab5df78ee2e1734968f9d098a965a5119c4e66c2f9afe5cedcc1f43a6bfa956",
+    "sha256:2acaf080abe6a7e9f0f9a5420a21dca46fa437713f9743a33942040e07b8c576",
+    "sha256:2d35ebdb57d9971fea0cac1582aa78935adf8058b2cc32db163c98822e5dfa1b",
+    "sha256:40ad67084d10a89012157e0e89a71b883fc9b0fe0b4a944b8f7d39b92d1bc410",
+    "sha256:4307a5f03cc7599e0d9e070352673c129b5db19a81c440c8d9c62fe87cdb5d77",
+    "sha256:458183e7c96429f0bdac206f68a19394640f69d97639921519d9890f5b49b30b",
+    "sha256:4b7ce07002c69e8f3d704a9c5d6fd3053be500b7f1c69fc0d80990c2ad8dd412",
+    "sha256:5a7083e09b82b64137036dbd0e005d86eada32fb67816995c69786552f0c4531",
+    "sha256:610eaa71e733bffea8d63705b48f33eb0c992d5304c608a5dcfffcc9c3cbcf2e",
+    "sha256:650f1ffc1e4d7d849901532a5876cfdbcd08978b7e7ae85617d3cee0cd575e2b",
+    "sha256:6a727dc5c3dda69f82585c46d8210e343154e68211cd6c97374a5ff7d75245ef",
+    "sha256:6ae11c41c28774b9a91cd9b478a7347b8dad420383bbd4249d446363262947f5",
+    "sha256:6b59a28fa20117e6048ad0616b8d8c901877ef15ff4c7f18db04e4f01f43bc39",
+    "sha256:6fd04f935dd08704b13b1f3634c4997ee1d60a26d601e85d263c2f15df64d320",
+    "sha256:706db57fb2063f39f69632c5b5c9c439633fda35110e65587c5d85553fd1cc38",
+    "sha256:7209d55fc81fa572dae1ee6c83078b80850f9a0d8c12877527f93ff752277786",
+    "sha256:7df60ce11659f4564027c96fe18007a61e18de8039e696fec5b48eefd9eb84a7",
+    "sha256:7f435efbcf59f7527c7dbc2117353d103b10c0b9a1ba315b828a42bb3474fb6a",
+    "sha256:85a0f69f026b4a01420490809bed190217e05518f7b718c0bbc1ad4871e0dedf",
+    "sha256:85f2b723e106c34644cd5851d7e81ee87da98ac54672b29947c052a45d31dc2f",
+    "sha256:8c5706b427ad26d9b8fea9d022679a71bea070381754866e99b479f9e2465719",
+    "sha256:916d490b7e69f787674396546a1fb03b562e336d19b9e76f804a03490fa4b4e4",
+    "sha256:9bfbcacb65cf66c8b5ee52caafc060575589bac45af4a49499d9aa15b057ea71",
+    "sha256:9eec16c5eada75150a82666ba0ad6df76b164a6f8582ba5cb964c0813fa56625",
+    "sha256:a340bd06c407709c5ce3265453a4a03bac1dbeaf9a20406d89462361d85f0b28",
+    "sha256:acf9bc9d7b6017b5062a78ea1f7634a1310e37c1f1f03fd4e27afea1bc437837",
+    "sha256:bb1da3d879939be7df9f182950d2fb201d4fc2e1043677da2037cd6afb084ce0",
+    "sha256:c1504a200153a9b08998d4bd1c0556a2d286bbed359769959ed1bf29b1408fe6",
+    "sha256:c4c83af86e7f856d88d942c8332767cdd611265d48989708d7c28f25e5cfa939",
+    "sha256:d41927f8467212298a30ba277e6a749032ec0d8e921046f3280496a96a300f8d",
+    "sha256:d7fac945962d2f3ac575f75e1a7ae5fae66112a837c2b2142065e9ff11d0c66e",
+    "sha256:de2c58cc2a1ecdc061938bd6efbfb70b1b749c247e89a055dd92375120e3ba3d",
+    "sha256:e0c8572a50bada879c50f73ba2e3d36f21edfad177f06ae84aafa1a54a1faa93",
+    "sha256:e1186ba8d87ee119ae57765ad063c6f887ac49fa58828daeac8f5c397188a6af",
+    "sha256:e6b06613ca2e7cdf3e8ebbe71ca45137242628a4a3a4bfcb7a9f76d0d5b0e653",
+    "sha256:ebbebd44c17fcfc36f52ae1aef89bc9d1eaec8a2d865362f62bcce19e2fcaaca",
+    "sha256:edb0999a146533529ece3bc051fd424d3cb7c395f5a6e8a27442fcd0509ed73d",
+    "sha256:f6b2f75fca5a2c6c2cbb27cc286e778f1c0ba732e46ed33a440d7ce9926c1c29",
+    "sha256:f75496497526adcf2cbb76a7252b1953535592235a0d25f39a3626bed621cd91",
+    "sha256:f7c453b4ef3c0889d67578b1a285304ec5728078638c55cb64bcca996c7ae2b1",
+]
+
+blob_files = {
+    digest: "@alpine//:blobs/sha256/" + digest.removeprefix("sha256:")
+    for digest in alpine_blobs
+}
+
+pull(
+    name = "alpine_airgapped_img_tool",
+    airgapped = True,
+    blob_files = blob_files,
+    digest = "sha256:4b7ce07002c69e8f3d704a9c5d6fd3053be500b7f1c69fc0d80990c2ad8dd412",
+    downloader = "img_tool",
+    registries = [
+        "mirror.gcr.io",
+        "index.docker.io",
+    ],
+    repository = "library/alpine",
+    tag = "3.22",
+)
+
+pull(
+    name = "alpine_airgapped_bazel_downloader",
+    airgapped = True,
+    blob_files = blob_files,
+    digest = "sha256:4b7ce07002c69e8f3d704a9c5d6fd3053be500b7f1c69fc0d80990c2ad8dd412",
+    downloader = "bazel",
     registries = [
         "mirror.gcr.io",
         "index.docker.io",