ci: build through the internal package cache; mirror bases by Docker Hub digest (2026.10.7) #14

2026-10-22T14:20:11Z

jknapp commented

2026-10-22 14:20:11 +00:00

Wires both image builds to the internal package cache (CT130, https://192.168.1.40), same scheme as cloud-apache-container / cloud-node-container, and makes the weekly base-image mirror pull by the digest Docker Hub reports.

Changes

Dockerfile (haproxy-manager-base): ARG PKG_CACHE=; the apt RUN (dist-upgrade + pinned haproxy=3.0.11-1+deb13u3 + socat cron certbot curl jq net-tools) runs pkg-cache-repos.sh apt first and restore before it ends. No PKG_CACHE = upstream Debian, unchanged.
coraza-spoa/Dockerfile: same for the build stage apt RUN; go mod download/go build (build + catalog stages) run under eval "$(pkg-cache-repos.sh go-env)" + restore (GOPROXY via cache, fallback proxy.golang.org; GOSUMDB unchanged). Distroless runtime stage untouched. Build context is ./coraza-spoa, so coraza-spoa/scripts/pkg-cache-repos.sh and coraza-spoa/keys/pkg-cache/ are byte-identical copies of the root ones (simplest option that keeps plain docker build ./coraza-spoa working; no buildx named context needed).
build-push.yaml / build-push-coraza.yaml: "Probe package cache" step (TLS with pinned CA, 5 s), PKG_CACHE build-arg. Bases are repo.anhonesthost.net/... (and gcr.io distroless), not docker.io, so the registry mirror is not used and no digest-resolve step is needed; log line: pkg-cache: repos=... registry-mirror=<not used: no docker.io base ...>. Job names, tags, triggers unchanged.
mirror-base-image.yaml: resolves python:3.12-slim / golang:1.25 digests DIRECTLY at registry-1.docker.io (.gitea/scripts/resolve-base-image.sh), pulls docker.io/library/<img>@sha256:..., checks the pulled image is recorded under that digest, pushes the same destination tags. Lookup failure fails the job (last week's mirror stays). Values reach run: only via env:. Not routed through the cache.
Canonical copies (sha256-verified): scripts/pkg-cache-repos.sh (111f85c2…), .gitea/scripts/resolve-base-image.sh (8a3af5c4…), keys/pkg-cache/. .gitea/ is never COPYed into either image.
VERSION 2026.10.7 so this rebuild does not overwrite the deployed :2026.10.6 tag.

Testing

Local fallback (no PKG_CACHE): both Dockerfiles build; main image: all build-time unit suites OK, [validate-config] default/full: haproxy -c OK; logs show PKG_CACHE not set - using upstream repositories / default GOPROXY.
CT 990 (CI runner template clone) with PKG_CACHE=https://192.168.1.40: both build. apt Get: https://192.168.1.40/debian… and /debian-security… (incl. haproxy 3.0.11-1+deb13u3); GOPROXY via https://192.168.1.40/goproxy; every RUN printed original repository files restored (no reference to 192.168.1.40 left); haproxy -c gate OK.
Mirror step dry run locally (push skipped): both digests resolved and pulled by digest, digest check passed.

Not proxied (unchanged, noted)

pip install -r requirements.txt (PyPI) — not proxied by design.
coraza-spoa source: git clone --depth 1 --branch v0.7.1 from GitHub (tag, not commit-pinned); Go modules remain go.sum/sumdb-verified.

🤖 Generated with Claude Code

Wires both image builds to the internal package cache (CT130, `https://192.168.1.40`), same scheme as cloud-apache-container / cloud-node-container, and makes the weekly base-image mirror pull by the digest Docker Hub reports. ## Changes - **Dockerfile** (haproxy-manager-base): `ARG PKG_CACHE=`; the apt RUN (dist-upgrade + pinned `haproxy=3.0.11-1+deb13u3` + socat cron certbot curl jq net-tools) runs `pkg-cache-repos.sh apt` first and `restore` before it ends. No PKG_CACHE = upstream Debian, unchanged. - **coraza-spoa/Dockerfile**: same for the build stage apt RUN; `go mod download`/`go build` (build + catalog stages) run under `eval "$(pkg-cache-repos.sh go-env)"` + `restore` (GOPROXY via cache, fallback proxy.golang.org; GOSUMDB unchanged). Distroless runtime stage untouched. Build context is `./coraza-spoa`, so `coraza-spoa/scripts/pkg-cache-repos.sh` and `coraza-spoa/keys/pkg-cache/` are **byte-identical copies** of the root ones (simplest option that keeps plain `docker build ./coraza-spoa` working; no buildx named context needed). - **build-push.yaml / build-push-coraza.yaml**: "Probe package cache" step (TLS with pinned CA, 5 s), `PKG_CACHE` build-arg. Bases are `repo.anhonesthost.net/...` (and gcr.io distroless), not docker.io, so the registry mirror is not used and no digest-resolve step is needed; log line: `pkg-cache: repos=... registry-mirror=<not used: no docker.io base ...>`. Job names, tags, triggers unchanged. - **mirror-base-image.yaml**: resolves `python:3.12-slim` / `golang:1.25` digests DIRECTLY at registry-1.docker.io (`.gitea/scripts/resolve-base-image.sh`), pulls `docker.io/library/<img>@sha256:...`, checks the pulled image is recorded under that digest, pushes the same destination tags. Lookup failure fails the job (last week's mirror stays). Values reach `run:` only via `env:`. Not routed through the cache. - Canonical copies (sha256-verified): `scripts/pkg-cache-repos.sh` (111f85c2…), `.gitea/scripts/resolve-base-image.sh` (8a3af5c4…), `keys/pkg-cache/`. `.gitea/` is never COPYed into either image. - VERSION 2026.10.7 so this rebuild does not overwrite the deployed `:2026.10.6` tag. ## Testing - Local fallback (no PKG_CACHE): both Dockerfiles build; main image: all build-time unit suites OK, `[validate-config] default/full: haproxy -c OK`; logs show `PKG_CACHE not set - using upstream repositories` / `default GOPROXY`. - CT 990 (CI runner template clone) with `PKG_CACHE=https://192.168.1.40`: both build. apt `Get: https://192.168.1.40/debian…` and `/debian-security…` (incl. haproxy 3.0.11-1+deb13u3); `GOPROXY via https://192.168.1.40/goproxy`; every RUN printed `original repository files restored (no reference to 192.168.1.40 left)`; haproxy -c gate OK. - Mirror step dry run locally (push skipped): both digests resolved and pulled by digest, digest check passed. ## Not proxied (unchanged, noted) - `pip install -r requirements.txt` (PyPI) — not proxied by design. - coraza-spoa source: `git clone --depth 1 --branch v0.7.1` from GitHub (tag, not commit-pinned); Go modules remain go.sum/sumdb-verified. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

jknapp added 1 commit 2026-10-22 14:20:11 +00:00

ci: build through the internal package cache; mirror bases by Docker Hub digest (2026.10.7) dc1cbeb12a

- Dockerfile: optional ARG PKG_CACHE; the apt RUN (dist-upgrade + pinned
  haproxy) rewrites sources via scripts/pkg-cache-repos.sh apt and restores
  them before the RUN ends. Without PKG_CACHE: upstream Debian, as before.
- coraza-spoa/Dockerfile: same for the build stage's apt RUN; go mod
  download / go build (build + catalog stages) use go-env (GOPROXY via the
  cache with proxy.golang.org fallback; GOSUMDB unchanged) and restore.
  Build context is ./coraza-spoa, so coraza-spoa/scripts/pkg-cache-repos.sh
  and coraza-spoa/keys/pkg-cache/ are byte-identical copies of the root ones.
- build-push.yaml / build-push-coraza.yaml: "Probe package cache" step
  (TLS with the pinned CA), PKG_CACHE build-arg. Bases come from
  repo.anhonesthost.net / gcr.io, not docker.io: registry mirror not used.
- mirror-base-image.yaml: resolve the tag's digest directly at Docker Hub
  (.gitea/scripts/resolve-base-image.sh) and pull docker.io/library/<img>@sha256
  so the mirrored content is exactly the digest Docker Hub reported; same
  destination tags. Values reach run: via env only.
- Canonical copies (byte-identical) of scripts/pkg-cache-repos.sh,
  .gitea/scripts/resolve-base-image.sh and keys/pkg-cache/ from
  cloud-apache-container.
- VERSION 2026.10.7 so the rebuild does not overwrite the 2026.10.6 tag.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

jknapp merged commit 1ee5760c1b into main

2026-10-22 14:20:17 +00:00

jknapp deleted branch ci/pkg-cache

2026-10-22 14:20:17 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: cloud-hosting-platform/haproxy-manager-base#14