ci: pin httpd:alpine by digest; pull via the pkg-cache registry mirror #1

2026-10-22T14:15:53Z

jknapp commented

2026-10-22 14:15:53 +00:00

Wires this image build to the internal package cache's registry mirror (CT130 pkg-cache), same pattern as cloud-apache-container / cloud-node-container.

What changes

Dockerfile: ARG BASE_IMAGE=httpd:alpine + FROM ${BASE_IMAGE}. Local builds without build-args are unchanged.
Workflow (Build-and-Push; job name, tag, trigger unchanged):
- Resolve base image digest (Docker Hub, direct): resolves httpd:alpine → httpd@sha256:… straight from registry-1.docker.io (.gitea/scripts/resolve-base-image.sh), passed as BASE_IMAGE. Lookup failure → tag, mirror NOT used.
- Probe package cache: logs pkg-cache: repos=… registry-mirror=…; mirror only when the base is digest-pinned and https://192.168.1.40:5000/v2/ answers with the pinned CA.
- Two Set up Docker Buildx variants (mirror + ca= via buildkitd-config-inline, or plain), keeping this repo's https://github.com/docker/setup-buildx-action@v3 ref style.
No PKG_CACHE / pkg-cache-repos.sh: the image installs no OS packages (only sed + COPY). keys/pkg-cache/ is copied whole (for the CA), byte-identical to cloud-apache-container.

Tests (measured)

Unmodified main still builds locally (last CI build was 2025-07).
Local fallback (no cache reachable): --build-arg BASE_IMAGE=httpd@sha256:759a1d91… → OK, log FROM docker.io/library/httpd@sha256:759a1d9178d351185978e41be37a3e91675a4ddc0653aa5df493cfd4c67e24ec; Apache 2.4.69, rewrite_module enabled. Build without args also OK.
CT990 (CI-runner clone, CI network): same digest build OK; mirror probe https://192.168.1.40:5000/v2/ with the CA OK.

🤖 Generated with Claude Code

Wires this image build to the internal package cache's **registry mirror** (CT130 pkg-cache), same pattern as cloud-apache-container / cloud-node-container. ## What changes - **Dockerfile**: `ARG BASE_IMAGE=httpd:alpine` + `FROM ${BASE_IMAGE}`. Local builds without build-args are unchanged. - **Workflow** (`Build-and-Push`; job name, tag, trigger unchanged): - `Resolve base image digest (Docker Hub, direct)`: resolves `httpd:alpine` → `httpd@sha256:…` straight from registry-1.docker.io (`.gitea/scripts/resolve-base-image.sh`), passed as `BASE_IMAGE`. Lookup failure → tag, mirror NOT used. - `Probe package cache`: logs `pkg-cache: repos=… registry-mirror=…`; mirror only when the base is digest-pinned and `https://192.168.1.40:5000/v2/` answers with the pinned CA. - Two `Set up Docker Buildx` variants (mirror + `ca=` via `buildkitd-config-inline`, or plain), keeping this repo's `https://github.com/docker/setup-buildx-action@v3` ref style. - No `PKG_CACHE` / `pkg-cache-repos.sh`: the image installs no OS packages (only `sed` + `COPY`). `keys/pkg-cache/` is copied whole (for the CA), byte-identical to cloud-apache-container. ## Tests (measured) - Unmodified `main` still builds locally (last CI build was 2025-07). - Local fallback (no cache reachable): `--build-arg BASE_IMAGE=httpd@sha256:759a1d91…` → OK, log `FROM docker.io/library/httpd@sha256:759a1d9178d351185978e41be37a3e91675a4ddc0653aa5df493cfd4c67e24ec`; Apache 2.4.69, rewrite_module enabled. Build without args also OK. - CT990 (CI-runner clone, CI network): same digest build OK; mirror probe `https://192.168.1.40:5000/v2/` with the CA OK. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

jknapp added 1 commit 2026-10-22 14:15:53 +00:00

ci: pin httpd:alpine by Docker Hub digest; pull it via the pkg-cache registry mirror 6eed6aa615

CI resolves httpd:alpine to httpd@sha256:<digest> directly at
registry-1.docker.io (.gitea/scripts/resolve-base-image.sh) and passes it
as BASE_IMAGE. Only when the base is digest-pinned AND the pkg-cache
registry mirror (192.168.1.40:5000) answers over TLS with the pinned CA
is the buildx builder configured with the mirror; otherwise Docker Hub
direct as before. The image installs no OS packages, so no PKG_CACHE
build-arg / pkg-cache-repos.sh is needed; keys/pkg-cache/ is carried for
the CA (identical copy of cloud-apache-container's).

Local builds without build-args still use httpd:alpine.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

jknapp merged commit 97b76d5be5 into main

2026-10-22 14:16:00 +00:00

jknapp deleted branch ci/pkg-cache

2026-10-22 14:16:00 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: cloud-hosting-platform/whp-default-container#1