containers: Do not force pull a specific proxy-everything image (#14358)

gabivlj · web-flow · commit 4ef872fe5302 · 2026-06-23T09:22:24.000-05:00
diff --git a/.changeset/fix-container-egress-platform.md b/.changeset/fix-container-egress-platform.md
@@ -0,0 +1,8 @@
+---
+"wrangler": patch
+"@cloudflare/vite-plugin": patch
+---
+
+Fix container egress interception on arm64 Docker runtimes
+
+Both `wrangler dev` and the Cloudflare Vite plugin no longer force the `proxy-everything` sidecar image to pull as `linux/amd64`, allowing Docker to select the native image from the multi-platform manifest. Set `MINIFLARE_CONTAINER_EGRESS_IMAGE_PLATFORM` to force a specific platform when needed.
diff --git a/packages/containers-shared/src/images.ts b/packages/containers-shared/src/images.ts
@@ -20,6 +20,10 @@ import type {
 export const DEFAULT_CONTAINER_EGRESS_INTERCEPTOR_IMAGE =
 	"cloudflare/proxy-everything:3cb1195@sha256:0ef6716c52430096900b150d84a3302057d6cd2319dae7987128c85d0733e3c8";
 
+export function getEgressInterceptorPlatform(): string | undefined {
+	return process.env.MINIFLARE_CONTAINER_EGRESS_IMAGE_PLATFORM;
+}
+
 export function getEgressInterceptorImage(): string {
 	return (
 		process.env.MINIFLARE_CONTAINER_EGRESS_IMAGE ??
@@ -31,7 +35,12 @@ export async function pullEgressInterceptorImage(
 	dockerPath: string
 ): Promise<void> {
 	const image = getEgressInterceptorImage();
-	await runDockerCmd(dockerPath, ["pull", image, "--platform", "linux/amd64"]);
+	const platform = getEgressInterceptorPlatform();
+	const args = ["pull", image];
+	if (platform !== undefined) {
+		args.push("--platform", platform);
+	}
+	await runDockerCmd(dockerPath, args);
 }
 
 export async function pullImage(
diff --git a/packages/containers-shared/tests/images.test.ts b/packages/containers-shared/tests/images.test.ts
@@ -0,0 +1,68 @@
+import { beforeEach, describe, it, vi } from "vitest";
+import {
+	getEgressInterceptorPlatform,
+	pullEgressInterceptorImage,
+} from "../src/images";
+import { runDockerCmd } from "../src/utils";
+
+vi.mock("../src/utils", () => ({
+	runDockerCmd: vi.fn(() => ({
+		abort: vi.fn(),
+		ready: Promise.resolve({ aborted: false }),
+		then: (resolve: () => void) => {
+			resolve();
+		},
+	})),
+}));
+
+describe("getEgressInterceptorPlatform", () => {
+	beforeEach(() => {
+		vi.unstubAllEnvs();
+	});
+
+	it("does not force a platform by default", ({ expect }) => {
+		expect(getEgressInterceptorPlatform()).toBeUndefined();
+	});
+
+	it("allows overriding the platform", ({ expect }) => {
+		vi.stubEnv("MINIFLARE_CONTAINER_EGRESS_IMAGE_PLATFORM", "linux/s390x");
+
+		expect(getEgressInterceptorPlatform()).toBe("linux/s390x");
+	});
+});
+
+describe("pullEgressInterceptorImage", () => {
+	beforeEach(() => {
+		vi.unstubAllEnvs();
+		vi.mocked(runDockerCmd).mockClear();
+	});
+
+	it("pulls the egress interceptor image without forcing a platform by default", async ({
+		expect,
+	}) => {
+		vi.stubEnv("MINIFLARE_CONTAINER_EGRESS_IMAGE", "proxy-everything:test");
+
+		await pullEgressInterceptorImage("docker");
+
+		expect(runDockerCmd).toHaveBeenCalledWith("docker", [
+			"pull",
+			"proxy-everything:test",
+		]);
+	});
+
+	it("pulls the egress interceptor image for the configured platform", async ({
+		expect,
+	}) => {
+		vi.stubEnv("MINIFLARE_CONTAINER_EGRESS_IMAGE", "proxy-everything:test");
+		vi.stubEnv("MINIFLARE_CONTAINER_EGRESS_IMAGE_PLATFORM", "linux/arm64");
+
+		await pullEgressInterceptorImage("docker");
+
+		expect(runDockerCmd).toHaveBeenCalledWith("docker", [
+			"pull",
+			"proxy-everything:test",
+			"--platform",
+			"linux/arm64",
+		]);
+	});
+});
diff --git a/turbo.json b/turbo.json
@@ -20,6 +20,7 @@
 		"WRANGLER_CACHE_DIR",
 		"CLOUDFLARED_PATH",
 		"MINIFLARE_CONTAINER_EGRESS_IMAGE",
+		"MINIFLARE_CONTAINER_EGRESS_IMAGE_PLATFORM",
 		"WRANGLER_DOCKER_HOST",
 		"WRANGLER_LOG_PATH",
 		"WRANGLER_LOG",
