{"record":{"id":"06331e4566cd1834","repo":"paperclipai/paperclip","slug":"image-override-target-imageoverride-is-not-in","errorCode":null,"errorMessage":"Image override \"${target.imageOverride}\" is not in allowlist","messagePattern":"Image override \"(.+?)\" is not in allowlist","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/plugins/sandbox-providers/kubernetes/src/image-allowlist.ts","lineNumber":38,"sourceCode":"}\n\nexport interface ResolveImageDefaults {\n  runtimeImage: string;\n}\n\nexport interface ResolveImageConfig {\n  imageAllowList: string[];\n  imageRegistry?: string;\n}\n\nexport function resolveImage(\n  target: ResolveImageInput,\n  defaults: ResolveImageDefaults,\n  config: ResolveImageConfig,\n): string {\n  if (target.imageOverride) {\n    if (!config.imageAllowList.some((p) => globMatch(p, target.imageOverride!))) {\n      throw new Error(`Image override \"${target.imageOverride}\" is not in allowlist`);\n    }\n    return target.imageOverride;\n  }\n  if (config.imageRegistry) {\n    return rewriteRegistry(defaults.runtimeImage, config.imageRegistry);\n  }\n  return defaults.runtimeImage;\n}\n\nfunction rewriteRegistry(image: string, registry: string): string {\n  // image is like \"ghcr.io/paperclipai/agent-runtime-claude:v1\"\n  // we want to replace the first two path segments (host + org) with `registry`\n  const cleanRegistry = registry.replace(/\\/+$/, \"\");\n  const colonIdx = image.lastIndexOf(\":\");\n  const tag = colonIdx >= 0 ? image.slice(colonIdx) : \"\";\n  const path = colonIdx >= 0 ? image.slice(0, colonIdx) : image;\n  const segments = path.split(\"/\");\n  // Strip the host+org (first two segments), keep the image name","sourceCodeStart":20,"sourceCodeEnd":56,"githubUrl":"https://github.com/paperclipai/paperclip/blob/120ae5428fa29bee300bcf806491cd4d965fbb7c/packages/plugins/sandbox-providers/kubernetes/src/image-allowlist.ts#L20-L56","documentation":"Error \"Image override \"${target.imageOverride}\" is not in allowlist\" thrown in paperclipai/paperclip.","triggerScenarios":"Thrown at packages/plugins/sandbox-providers/kubernetes/src/image-allowlist.ts:38 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Add the image to the allowlist or use an allowlisted image."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"120ae5428fa29bee300bcf806491cd4d965fbb7c","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}