feat(provider): daemonless oci:// + ::<path> for custom binary location

[fentas]

Summary

• New oci:// provider: pulls binaries directly from any OCI registry (Docker Hub, ghcr.io, quay.io, private) without a container runtime. Uses go-containerregistry for native auth (reads ~/.docker/config.json) and platform-aware manifest resolution.
• New :/<path> suffix on both docker:// and oci:// refs to pin an explicit in-container binary location. The leading / disambiguates the path from docker's native image:tag syntax (which b never uses — tags always go after @, consistent with every other provider).
  • docker://docker@cli:/usr/local/bin/docker
  • oci://ghcr.io/org/img@v1:/bin/tool
• Binary size impact (stripped): +1.03 MB (~10.7 MB → ~11.8 MB).

Why

• docker:// forces a running container runtime and only searches hardcoded paths, which doesn't cover custom image layouts.
• oci:// works in CI/minimal environments without docker, and makes the "any registry" intent explicit.
• @tag works for standard images, but there was no way to install a binary from a non-standard in-container path.

Design notes

• Tag separator: @ (consistent with every other b provider). Docker-style image:tag is not used.
• Path separator: :/ (single : followed by absolute path). Registry ports like localhost:5000/org/img are preserved because SplitImagePath uses LastIndex(":/") after skipping the :// scheme prefix.
• docker:// / oci:// refs are never interpreted as SCP-style env installs.

Test plan

• go test ./... — all pass
• Unit tests for ParseImageRef, SplitImagePath, BinaryName covering registry ports, empty paths, and docker-style refs.
• In-memory tar extraction tests (oci_extract_test.go): priority, no-match, non-regular files, empty search paths — no network needed.
• End-to-end: b i oci://docker@cli:/usr/local/bin/docker → extracts working docker CLI (41M) without docker daemon.
• End-to-end: b i oci://ghcr.io/linuxcontainers/alpine@latest:/bin/busybox → daemonless pull from ghcr.io.
• Regression: existing docker:// refs continue to work unchanged.

Docs

• README.md — examples and config snippet updated for :/path syntax.
• docs/b/subcommands/install.mdx — new "Install from container images" section covering both providers.
• docs/authentication.mdx — OCI auth via ~/.docker/config.json.
• docs/glossary.mdx — provider reference entry lists all supported prefixes.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR adds a new daemonless oci:// provider (OCI registry pull + in-image binary extraction) and extends both docker:// and oci:// refs with a ::<path> suffix to pin an explicit in-image binary location.

Changes:

• Introduce oci:// provider using go-containerregistry to pull images without a container runtime and extract a single binary from layers.
• Add ::<in-container-path> parsing/behavior for docker:// and oci:// refs, including correct @tag parsing and binary name derivation.
• Update CLI parsing/tests/docs plus Go module dependencies to support the new provider.

Reviewed changes

Copilot reviewed 11 out of 12 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
pkg/provider/oci.go	New OCI provider implementation: remote pull + platform selection + tar-layer extraction.
pkg/provider/oci_test.go	Basic unit tests for OCI provider metadata and ParseImageRef.
pkg/provider/docker.go	Teach Docker provider to accept ::<path> and reuse ParseImageRef.
pkg/provider/provider.go	Extend ref parsing (ParseRef, BinaryName) and add shared ParseImageRef.
pkg/provider/provider_test.go	Add tests for ParseRef and BinaryName covering ::<path>.
pkg/binary/download.go	Route downloads to the new provider.OCI install path.
pkg/cli/install.go	Update CLI arg parsing to preserve ::<path> while parsing @version.
pkg/cli/install_test.go	Ensure ::<path> isn’t misinterpreted as SCP syntax.
pkg/cli/cli_extra_test.go	Add CLI parse tests for docker:///oci:// with ::<path>.
README.md	Document new oci:// provider and ::<path> examples.
go.mod / go.sum	Add go-containerregistry and update dependency graph accordingly.

Comments suppressed due to low confidence (1)

pkg/provider/docker.go:53

• Docker.Install(): ParseImageRef currently does not strip or parse docker-style ":tag" in the image portion, but Install always appends ":" + tag. As a result, refs like "docker://org/image:1.0" will produce an invalid imageRef ("org/image:1.0:latest" when version is empty). Consider teaching ParseImageRef (or Install) to recognize and handle ":tag" (including the registry-port case) so existing docker-style refs don’t break.

	rest := strings.TrimPrefix(ref, "docker://")
	image, refTag, inContainerPath := ParseImageRef(rest)

	tag := version
	if tag == "" {
		tag = refTag
	}
	if tag == "" {
		tag = "latest"
	}
	imageRef := image + ":" + tag
	name := BinaryName(ref)

[Copilot]

Pull request overview

Copilot reviewed 15 out of 16 changed files in this pull request and generated 9 comments.

[Copilot]

Pull request overview

Copilot reviewed 15 out of 16 changed files in this pull request and generated 4 comments.

Comments suppressed due to low confidence (1)

pkg/provider/docker.go:54

• Docker.Install now uses ParseImageRef() and then builds imageRef as image+":"+tag. If the user passes a docker-style image ref containing a ':tag' (common copy/paste), image will already include the tag and this will produce an invalid reference like "alpine:3.19:latest" (and a confusing runtime error). Consider explicitly detecting docker-style tags (only ':' after last '/') and either parsing them into refTag when version is empty, stripping them before appending tag, or returning a clear error instructing users to use '@tag'.

	rest := strings.TrimPrefix(ref, "docker://")
	image, refTag, inContainerPath := ParseImageRef(rest)

	tag := version
	if tag == "" {
		tag = refTag
	}
	if tag == "" {
		tag = "latest"
	}
	imageRef := image + ":" + tag
	name := BinaryName(ref)

[Copilot]

Pull request overview

Copilot reviewed 15 out of 16 changed files in this pull request and generated 3 comments.

[Copilot]

Pull request overview

Copilot reviewed 15 out of 16 changed files in this pull request and generated no new comments.