One job on the trusted x86 runner builds amd64 and arm64 (QEMU), pushes each
platform by digest, then scripts/assemble-multiarch-index.sh creates :latest.
arm64 is continue-on-error: a failed arm64 leg publishes the usual amd64-only
tag. No Dockerfile change (both base images publish arm64). Adds
workflow_dispatch and an offline test for the assemble script and workflow
wiring.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0185ukXjXyosSkunDsdWz3mb
- Base image pinned by digest resolved directly from Docker Hub
(.gitea/scripts/resolve-base-image.sh); registry mirror only when pinned.
- Probe the cache over TLS with the pinned CA; without it, builds use the
upstream repositories and Docker Hub exactly as before.
- Dockerfile: ARG BASE_IMAGE / PKG_CACHE; package RUN rewrites repos via
scripts/pkg-cache-repos.sh (canonical copy from cloud-apache-container),
installs epel-release with GPG-verified release-install, restores repo
files before the RUN ends.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
entrypoint.sh ran memcached in the foreground under bash. bash as PID 1 has no
SIGTERM handler, so the kernel dropped docker stop's SIGTERM; docker waited the
full 10s timeout and SIGKILLed the container (exit 137). exec memcached so it
becomes PID 1; it installs its own SIGTERM/SIGINT handlers and exits at once.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
shadowdaoandClaude Sonnet 5.5