Pull the base image through the artifactapi dockerhub remote

A buildkit FROM does its own pull and ignores the nodes' containerd mirror, so
every build was an uncached, rate-limited Docker Hub pull.

- point BASE_IMAGE at dockerhub/library/almalinux:9
- drop the syntax directive, which pulled a frontend image from Docker Hub for
  features this Dockerfile does not use

Dockerfile

@@ -1,5 +1,4 @@
-# syntax=docker/dockerfile:1
-ARG BASE_IMAGE=docker.io/almalinux:9
+ARG BASE_IMAGE=artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/almalinux:9
 
 FROM ${BASE_IMAGE} AS image
 ARG DISTRO=alma9

README.md

@@ -6,7 +6,7 @@ built. Published as `artifactapi.k8s.syd1.au.unkin.net/docker-internal/<image>:<
 
 | distro | image | from |
 | --- | --- | --- |
-| `alma9` | `almalinux9` | `docker.io/almalinux:9` |
+| `alma9` | `almalinux9` | `dockerhub/library/almalinux:9` |
 
 Each image bootstraps the internal CA, installs the estate dnf repository
 configuration pointed at artifactapi, and installs the base package set.

distros/alma9/distro.env

@@ -1,5 +1,8 @@
 # alma9 — AlmaLinux 9
-BASE_IMAGE="docker.io/almalinux:9"
+# Pulled through the artifactapi dockerhub remote: a buildkit FROM does its own pull
+# and ignores the nodes' containerd mirror. The library/ prefix is required — the
+# remote allowlists ^library/almalinux, so dockerhub/almalinux:9 returns 403.
+BASE_IMAGE="artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/almalinux:9"
 IMAGE="almalinux9"
 
 # Bootstrap of the internal CA. The image cannot trust artifactapi over HTTPS until