feat(vmm): add OCI registry image discovery and pull support

Add ability for VMM to discover available guest images from an OCI
registry and pull them on-demand through the web UI. Images are pulled
in the background with status tracked server-side, surviving page
refreshes. The UI auto-refreshes every 3s while the registry panel
is open.

- New `image_registry` config field (e.g., "cr.kvin.wang/dstack/guest-image")
- New RPC: ListRegistryImages, PullRegistryImage
- Registry module: list tags via Docker Registry HTTP API v2, pull and
  extract via `docker export`
- Background pull with pulling state in App memory
- UI: Image Registry button + dialog with pull/status per tag

Author: kvinwang

Cargo.lock

@@ -55,6 +55,9 @@ fatfs.workspace = true
 fscommon.workspace = true
 or-panic.workspace = true
 url.workspace = true
+reqwest.workspace = true
+flate2.workspace = true
+tar.workspace = true
 
 [dev-dependencies]
 insta.workspace = true

vmm/Cargo.toml

@@ -350,6 +350,11 @@ service Vmm {
   rpc SvStop(Id) returns (google.protobuf.Empty);
   // Remove a stopped supervisor process by ID.
   rpc SvRemove(Id) returns (google.protobuf.Empty);
+
+  // List images available in the configured OCI registry.
+  rpc ListRegistryImages(google.protobuf.Empty) returns (RegistryImageListResponse);
+  // Pull an image from the OCI registry to local storage.
+  rpc PullRegistryImage(PullRegistryImageRequest) returns (google.protobuf.Empty);
 }
 
 // DHCP lease event reported by the host DHCP server.
@@ -365,6 +370,29 @@ message SvListResponse {
   repeated SvProcessInfo processes = 1;
 }
 
+// Available images discovered from the OCI registry.
+message RegistryImageListResponse {
+  repeated RegistryImageInfo images = 1;
+}
+
+// Metadata for an image tag in the OCI registry.
+message RegistryImageInfo {
+  // Tag name (e.g., "0.5.8", "nvidia-0.5.8")
+  string tag = 1;
+  // Whether this image is already downloaded locally
+  bool local = 2;
+  // Whether this image is currently being pulled
+  bool pulling = 3;
+  // Error message from the last failed pull attempt (empty if no error)
+  string error = 4;
+}
+
+// Request to pull an image from the OCI registry.
+message PullRegistryImageRequest {
+  // Tag to pull (e.g., "0.5.8")
+  string tag = 1;
+}
+
 // Information about a single supervisor process.
 message SvProcessInfo {
   string id = 1;

vmm/rpc/proto/vmm_rpc.proto

@@ -35,6 +35,7 @@ pub use qemu::{VmConfig, VmWorkDir};
 mod id_pool;
 mod image;
 mod qemu;
+pub(crate) mod registry;
 
 #[derive(Deserialize, Serialize, Debug, Clone)]
 pub struct PortMapping {
@@ -118,12 +119,20 @@ pub struct GpuSpec {
     pub slot: String,
 }
 
+#[derive(Clone, Debug)]
+pub(crate) enum PullStatus {
+    Pulling,
+    Failed(String),
+}
+
 #[derive(Clone)]
 pub struct App {
     pub config: Arc<Config>,
     pub supervisor: SupervisorClient,
     state: Arc<Mutex<AppState>>,
     forward_service: Arc<tokio::sync::Mutex<ForwardService>>,
+    /// Pull status for registry images: tag → status.
+    pub(crate) pull_status: Arc<Mutex<std::collections::HashMap<String, PullStatus>>>,
 }
 
 impl App {
@@ -152,6 +161,7 @@ impl App {
             })),
             config: Arc::new(config),
             forward_service: Arc::new(tokio::sync::Mutex::new(ForwardService::new())),
+            pull_status: Arc::new(Mutex::new(std::collections::HashMap::new())),
         }
     }
 
@@ -172,7 +182,7 @@ impl App {
         {
             bail!("Invalid image name");
         }
-        let image_path = self.config.image_path.join(&manifest.image);
+        let image_path = self.config.image.path.join(&manifest.image);
         let image = Image::load(&image_path).context("Failed to load image")?;
         let vm_id = manifest.id.clone();
         let app_compose = vm_work_dir
@@ -739,7 +749,7 @@ impl App {
         {
             bail!("Invalid image name");
         }
-        let image_path = self.config.image_path.join(&manifest.image);
+        let image_path = self.config.image.path.join(&manifest.image);
         let image = Image::load(&image_path).context("Failed to load image")?;
         let vm_id = manifest.id.clone();
         let already_running = cids_assigned.contains_key(&vm_id);
@@ -854,7 +864,7 @@ impl App {
     }
 
     pub fn list_images(&self) -> Result<Vec<(String, ImageInfo)>> {
-        let image_path = self.config.image_path.clone();
+        let image_path = self.config.image.path.clone();
         let images = fs::read_dir(image_path).context("Failed to read image directory")?;
         Ok(images
             .flat_map(|entry| {
@@ -1115,7 +1125,7 @@ fn rotate_serial_log(work_dir: &VmWorkDir, max_bytes: u64) {
 }
 
 pub(crate) fn make_sys_config(cfg: &Config, manifest: &Manifest) -> Result<String> {
-    let image_path = cfg.image_path.join(&manifest.image);
+    let image_path = cfg.image.path.join(&manifest.image);
     let image = Image::load(image_path).context("Failed to load image info")?;
     let img_ver = image.info.version_tuple().unwrap_or((0, 0, 0));
     let kms_urls = if manifest.kms_urls.is_empty() {