From 03ab698efa4cd0fc3f6da078bf0213adc27c9116 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sun, 27 Sep 2026 18:37:18 +1000 Subject: [PATCH] Pull the base image through the artifactapi dockerhub remote A buildkit FROM does its own pull and ignores the nodes' containerd mirror, so every build was an uncached, rate-limited Docker Hub pull. - point BASE_IMAGE at dockerhub/library/almalinux:9 - drop the syntax directive, which pulled a frontend image from Docker Hub for features this Dockerfile does not use --- Dockerfile | 3 +-- README.md | 2 +- distros/alma9/distro.env | 5 ++++- 3 files changed, 6 insertions(+), 4 deletions(-) diff --git a/Dockerfile b/Dockerfile index 91cbb94..c5b83c4 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,5 +1,4 @@ -# syntax=docker/dockerfile:1 -ARG BASE_IMAGE=docker.io/almalinux:9 +ARG BASE_IMAGE=artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/almalinux:9 FROM ${BASE_IMAGE} AS image ARG DISTRO=alma9 diff --git a/README.md b/README.md index 0294588..4c81b4f 100644 --- a/README.md +++ b/README.md @@ -6,7 +6,7 @@ built. Published as `artifactapi.k8s.syd1.au.unkin.net/docker-internal/:< | distro | image | from | | --- | --- | --- | -| `alma9` | `almalinux9` | `docker.io/almalinux:9` | +| `alma9` | `almalinux9` | `dockerhub/library/almalinux:9` | Each image bootstraps the internal CA, installs the estate dnf repository configuration pointed at artifactapi, and installs the base package set. diff --git a/distros/alma9/distro.env b/distros/alma9/distro.env index 877acde..ffe5b18 100644 --- a/distros/alma9/distro.env +++ b/distros/alma9/distro.env @@ -1,5 +1,8 @@ # alma9 — AlmaLinux 9 -BASE_IMAGE="docker.io/almalinux:9" +# Pulled through the artifactapi dockerhub remote: a buildkit FROM does its own pull +# and ignores the nodes' containerd mirror. The library/ prefix is required — the +# remote allowlists ^library/almalinux, so dockerhub/almalinux:9 returns 403. +BASE_IMAGE="artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/almalinux:9" IMAGE="almalinux9" # Bootstrap of the internal CA. The image cannot trust artifactapi over HTTPS until