feat(ci): add a pre-pull input to the reusable build workflow - #74
Merged
Conversation
A FROM on the plain-HTTP local registry fails under the docker driver with "server gave HTTP response to HTTPS client" even though the daemon's insecure-registries names the registry: the daemon-embedded BuildKit's FROM-metadata resolver ignores that setting (observed on Synology's moby 24.0.2 — the classic pull/push paths honor it fine, and the external dockerfile frontend makes no difference; verified with minimal FROM builds on the host). BuildKit does resolve a locally-present image without touching the network, so pulling the base image first — through the daemon's insecure-aware, authenticated path — makes the build work. The reusable workflow gains an optional whitespace-separated `pre-pull` input that docker-pulls the named images after the registry login and before the build. The quirk and the fix are recorded in the design doc's operational notes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #66/#69, found by MuxBox's first run on the reusable workflow (failing run): a
FROMon the plain-HTTP local registry fails under the docker driver witheven though the daemon's
insecure-registriesnames the registry.Root cause (verified on the NAS with minimal
FROMbuilds)Synology's moby 24.0.2 has a resolver split:
docker pull/docker push(classic distribution path) honorinsecure-registries— this is why Watchtower's redeploy pulls have always worked.FROM-metadata resolver ignores it — the identical minimal build fails with the HTTPS error, with and without an external# syntax=frontend (so it isn't the frontend).What changed
The reusable workflow gains an optional whitespace-separated
pre-pullinput: the named images aredocker pulled after the registry login (the pulls may need the credentials — the local registry answers 401 anonymously) and before the build, going through exactly the insecure-aware, authenticated daemon path that works. The quirk and the fix are recorded in the design doc's operational notes.The input is passed to the shell via
env, not interpolated into the script, so tag values can't inject shell syntax.Merge order
This must merge before swimmesberger/MuxBox's follow-up PR that passes
pre-pull— calling a reusable workflow with an undefined input fails validation.