- Base image pinned by digest resolved directly from Docker Hub
(.gitea/scripts/resolve-base-image.sh); registry mirror only when pinned.
- Probe the cache over TLS with the pinned CA; without it, builds use the
upstream repositories and Docker Hub exactly as before.
- Dockerfile: ARG BASE_IMAGE / PKG_CACHE; package RUN rewrites repos via
scripts/pkg-cache-repos.sh (canonical copy from cloud-apache-container),
installs epel-release with GPG-verified release-install, restores repo
files before the RUN ends.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
entrypoint.sh ran memcached in the foreground under bash. bash as PID 1 has no
SIGTERM handler, so the kernel dropped docker stop's SIGTERM; docker waited the
full 10s timeout and SIGKILLed the container (exit 137). exec memcached so it
becomes PID 1; it installs its own SIGTERM/SIGINT handlers and exits at once.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
shadowdaoandClaude Opus 5.5