The pinned 2025.7.13 package shipped only the root anchor (CN=unkin.net).
Hosts that present a bare leaf issued by CN=unkin.net Intermediate
Authority — s3.ceph.unkin.net among them — fail to verify from images
built on this base.
- Pin CA_RPM_URL/CA_RPM_SHA256 to unkin-ca-certificates-2026.10.2-1.el9,
which installs both the root and intermediate anchors.
A buildkit FROM does its own pull and ignores the nodes' containerd mirror, so
every build was an uncached, rate-limited Docker Hub pull.
- point BASE_IMAGE at dockerhub/library/almalinux:9
- drop the syntax directive, which pulled a frontend image from Docker Hub for
features this Dockerfile does not use
Replace the packer-images almalinux base with a Dockerfile matrix over distros/,
publishing one image per distro to docker-internal on a single repo semver.
- bootstrap the internal CA from a sha256-pinned rpm fetched over plain HTTP
- install the estate dnf repo configuration pointed at artifactapi
- run in-image assertions as a --target test build stage
- add pull_request build/test/pre-commit and tag-triggered docker workflows
unkin-agent