CI resolves httpd:alpine to httpd@sha256:<digest> directly at
registry-1.docker.io (.gitea/scripts/resolve-base-image.sh) and passes it
as BASE_IMAGE. Only when the base is digest-pinned AND the pkg-cache
registry mirror (192.168.1.40:5000) answers over TLS with the pinned CA
is the buildx builder configured with the mirror; otherwise Docker Hub
direct as before. The image installs no OS packages, so no PKG_CACHE
build-arg / pkg-cache-repos.sh is needed; keys/pkg-cache/ is carried for
the CA (identical copy of cloud-apache-container's).
Local builds without build-args still use httpd:alpine.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
shadowdaoandClaude Opus 5.5