Skip to content

Commit 7ff0bf8

Browse files
lexfreilexfrei
authored
ci(build): route PR base-image pulls through mirror.gcr.io (#3042)
## Problem The Pull Request Build job authenticates only to the push registry (OCIR), so every base image (golang, ubuntu, alpine, nginx, …) is pulled from Docker Hub anonymously. Those pulls intermittently fail at `auth.docker.io/token` under Docker Hub's anonymous-pull rate limit, leaving the base image unresolved and failing `make build` — observed across several maintainer-branch runs in a short window. ## Fix Build the PR job on a docker-container buildx builder whose buildkitd routes `docker.io` through `mirror.gcr.io` (Google's public pull-through cache for Docker Hub: no auth, far higher limits, transparent fall-through to Docker Hub on a miss). This reuses the builder pattern already proven in `build-main.yaml` (same `make build`, same `DOCKER_CONFIG` auth forwarding); only the committed `hack/buildkitd.toml` mirror config is new. No base image versions or tags change. ## Risk Switches the PR build from the default embedded `docker` driver to a docker-container builder. `build-main.yaml` already runs the identical `make build` on that driver, so the path is exercised. The "Build Talos image" step uses `docker run`/`skopeo` (not buildx) and is unaffected. ## Fallback If `mirror.gcr.io` is unreachable, BuildKit logs `trying next host` and falls back to `registry-1.docker.io`, so the build still succeeds. Verified locally: a build pointed at a non-resolving mirror fell back to Docker Hub and exited 0 (at a small latency cost from the failed lookups). This strictly reduces build failures without adding a new hard dependency. ## Coverage Covered (the actual failure class — Docker Hub bases): `ubuntu`, `golang*`, `alpine*`, `debian*`, `grafana/grafana`, `nginxinc/nginx-unprivileged`, `clickhouse/*`, `altinity/*`, and explicit `docker.io/library/*`. Not covered, and never the problem: `quay.io/*`, `gcr.io/distroless/static`, `ghcr.io/siderolabs/imager` — the mirror is keyed to `docker.io` only, by design, and these were never subject to Docker Hub limits. ## Optional follow-up (not in this PR) The `moby/buildkit` builder image is still pulled from Docker Hub by the daemon to bootstrap the container builder (the mirror lives inside buildkit, so it cannot mirror its own bootstrap). That is one small pinned image versus dozens of base images, so this change is a strict net reduction in anonymous Docker Hub traffic. Pinning the bootstrap image through a mirror is deliberately left out: a no-fallback mirror on the bootstrap path would add risk for little gain. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved build reliability in pull request checks by using a configured container-based build setup. * Added a safer image-pull path for Docker Hub, with automatic fallback if the mirror is unavailable. * Preserved registry access during image builds so dependency and base-image fetching works more consistently. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2 parents 5f9ac28 + f933918 commit 7ff0bf8

2 files changed

Lines changed: 43 additions & 0 deletions

File tree

‎.github/workflows/pull-requests.yaml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -99,10 +99,32 @@ jobs:
9999
env:
100100
DOCKER_CONFIG: ${{ runner.temp }}/.docker
101101

102+
# Build on a docker-container buildx builder whose buildkitd routes
103+
# docker.io base-image pulls through mirror.gcr.io (hack/buildkitd.toml).
104+
# The default embedded `docker` driver pulls base images from Docker Hub
105+
# anonymously and intermittently trips its anonymous-pull rate limit
106+
# (auth.docker.io/token failures leaving golang/ubuntu/nginx unresolved);
107+
# the mirror sidesteps that and falls back to Docker Hub on a miss/outage.
108+
# Mirrors build-main.yaml: create the builder under the SAME DOCKER_CONFIG
109+
# the Build step reads (runner.temp/.docker, holding the OCIR auth) so
110+
# buildx forwards push/cache auth to the container builder.
111+
- name: Set up Buildx (docker-container driver, docker.io mirror)
112+
id: buildx
113+
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
114+
with:
115+
driver: docker-container
116+
buildkitd-config: hack/buildkitd.toml
117+
env:
118+
DOCKER_CONFIG: ${{ runner.temp }}/.docker
119+
102120
- name: Build
103121
run: make build
104122
env:
105123
DOCKER_CONFIG: ${{ runner.temp }}/.docker
124+
# Build on the docker-container builder created above so base-image
125+
# pulls go through the docker.io mirror (BUILDX_ARGS adds
126+
# --builder=$(BUILDER)).
127+
BUILDER: ${{ steps.buildx.outputs.name }}
106128
# Unique per (PR, commit) so concurrent PR builds never push the same
107129
# tag. PUBLISH_VERSIONED/PUBLISH_FLOATING stay off — PR images are
108130
# consumed by digest, and :latest belongs to release builds.

‎hack/buildkitd.toml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
# BuildKit daemon config for CI builds.
2+
#
3+
# Route docker.io base-image pulls through mirror.gcr.io, Google's public
4+
# pull-through cache for Docker Hub. The Build job authenticates only to the
5+
# push registry (OCIR), so every base image (golang, alpine, ubuntu, nginx, ...)
6+
# is otherwise pulled from Docker Hub ANONYMOUSLY and is subject to Docker Hub's
7+
# anonymous-pull rate limit -- which intermittently fails the build at
8+
# auth.docker.io/token with the base image left unresolved.
9+
#
10+
# mirror.gcr.io needs no auth, carries far higher limits, and transparently
11+
# falls through to Docker Hub on a cache miss. This config only takes effect on
12+
# a buildx builder created with `--config hack/buildkitd.toml` (CI wires this via
13+
# docker/setup-buildx-action `buildkitd-config:`); a plain local `make build` on
14+
# the default builder is unaffected.
15+
#
16+
# FAIL-SAFE: if mirror.gcr.io is unreachable, BuildKit logs "trying next host"
17+
# and falls back to registry-1.docker.io, so the build still succeeds (verified:
18+
# a build pointed at a non-resolving mirror fell back to Docker Hub and exited 0).
19+
# This strictly reduces build failures; it never introduces a new hard dependency.
20+
[registry."docker.io"]
21+
mirrors = ["mirror.gcr.io"]

0 commit comments

Comments
 (0)