mirror of
https://github.com/cozystack/cozystack.git
synced 2026-10-23 03:27:50 +09:00
Aleksei Sviridkin
7c519ad079
The Pull Request Build job authenticates only to the push registry (OCIR), so every base image (golang, ubuntu, alpine, nginx, ...) is pulled from Docker Hub anonymously. Those pulls intermittently fail at auth.docker.io/token under Docker Hub's anonymous-pull rate limit, leaving the base image unresolved and failing make build. Build on a docker-container buildx builder whose buildkitd routes docker.io through mirror.gcr.io, Google's public pull-through cache for Docker Hub: no auth, far higher limits, transparent fall-through to Docker Hub on a miss. This reuses the builder pattern already proven in build-main.yaml (same make build, same DOCKER_CONFIG auth forwarding); only the committed hack/buildkitd.toml mirror config is new. Fail-safe: if mirror.gcr.io is unreachable, BuildKit falls back to registry-1.docker.io and the build still succeeds, so this strictly reduces build failures without adding a new hard dependency. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Aleksei Sviridkin <f@lex.la>
22 lines
1.2 KiB
TOML
22 lines
1.2 KiB
TOML
# BuildKit daemon config for CI builds.
|
|
#
|
|
# Route docker.io base-image pulls through mirror.gcr.io, Google's public
|
|
# pull-through cache for Docker Hub. The Build job authenticates only to the
|
|
# push registry (OCIR), so every base image (golang, alpine, ubuntu, nginx, ...)
|
|
# is otherwise pulled from Docker Hub ANONYMOUSLY and is subject to Docker Hub's
|
|
# anonymous-pull rate limit -- which intermittently fails the build at
|
|
# auth.docker.io/token with the base image left unresolved.
|
|
#
|
|
# mirror.gcr.io needs no auth, carries far higher limits, and transparently
|
|
# falls through to Docker Hub on a cache miss. This config only takes effect on
|
|
# a buildx builder created with `--config hack/buildkitd.toml` (CI wires this via
|
|
# docker/setup-buildx-action `buildkitd-config:`); a plain local `make build` on
|
|
# the default builder is unaffected.
|
|
#
|
|
# FAIL-SAFE: if mirror.gcr.io is unreachable, BuildKit logs "trying next host"
|
|
# and falls back to registry-1.docker.io, so the build still succeeds (verified:
|
|
# a build pointed at a non-resolving mirror fell back to Docker Hub and exited 0).
|
|
# This strictly reduces build failures; it never introduces a new hard dependency.
|
|
[registry."docker.io"]
|
|
mirrors = ["mirror.gcr.io"]
|