Problem
The mcp-gateway-config JSON schema's container field regex only allows a single colon (reserved for :tag), so valid Docker image refs like registry.example.com:5000/team/service-image:latest fail schema validation at MCP Gateway (gh-aw-mcpg) startup, causing the entire gateway process to exit before any MCP server starts — even unrelated, correctly-configured servers.
Context
Reported upstream: github/gh-aw#61678. Affects gh-aw-mcpg v0.4.9; gh aw compile does not catch this since the compiler doesn't validate the pattern.
Root Cause
Current pattern ^[a-zA-Z0-9][a-zA-Z0-9./_-]*(:([a-zA-Z0-9._-]+|latest))?$ cannot distinguish a registry_host:port prefix from a trailing :tag, so any second colon fails.
Proposed Solution
Update the schema's container pattern (likely in AWF's enclave/mcp-gateway config schema or wherever this JSON schema is owned/vendored) to allow an optional :<port> immediately after the registry host, before path segments, following Docker's reference grammar, e.g. ^[a-zA-Z0-9][a-zA-Z0-9.-]*(:[0-9]+)?(/[a-zA-Z0-9._-]+)*(:[a-zA-Z0-9._-]+)?$. Add a schema unit test covering host:port/path:tag, host/path:tag, and bare path forms.
Generated by Firewall Issue Dispatcher · copilot · auto · 26 AIC · ⊞ 9.2K · ◷
Problem
The
mcp-gateway-configJSON schema'scontainerfield regex only allows a single colon (reserved for:tag), so valid Docker image refs likeregistry.example.com:5000/team/service-image:latestfail schema validation at MCP Gateway (gh-aw-mcpg) startup, causing the entire gateway process to exit before any MCP server starts — even unrelated, correctly-configured servers.Context
Reported upstream: github/gh-aw#61678. Affects gh-aw-mcpg v0.4.9;
gh aw compiledoes not catch this since the compiler doesn't validate the pattern.Root Cause
Current pattern
^[a-zA-Z0-9][a-zA-Z0-9./_-]*(:([a-zA-Z0-9._-]+|latest))?$cannot distinguish aregistry_host:portprefix from a trailing:tag, so any second colon fails.Proposed Solution
Update the schema's
containerpattern (likely in AWF's enclave/mcp-gateway config schema or wherever this JSON schema is owned/vendored) to allow an optional:<port>immediately after the registry host, before path segments, following Docker's reference grammar, e.g.^[a-zA-Z0-9][a-zA-Z0-9.-]*(:[0-9]+)?(/[a-zA-Z0-9._-]+)*(:[a-zA-Z0-9._-]+)?$. Add a schema unit test coveringhost:port/path:tag,host/path:tag, and barepathforms.