Build through artifactapi and get the internal CA into buildkit #2

2026-09-27T22:19:42+10:00

unkin-agent commented

2026-09-27 22:19:42 +10:00

The CI matrix overrode BASE_IMAGE with docker.io/almalinux:9, so every CI
build pulled the base straight from Docker Hub — uncached and rate-limited —
and the artifactapi path set in distros/alma9/distro.env only ever applied to
local make build.

Pointing CI at artifactapi exposed a second defect: the buildkit_config block
is dead YAML. The plugin-docker-buildx build we run has no
PLUGIN_BUILDKIT_CONFIG, so docker buildx create ran without --config and
the spawned buildkit container had no internal CA. The plugin generates that
config itself, but only when registry is set — which is why the tag build
pushed fine and a PR build could not have pulled.

Point the matrix BASE_IMAGE at the artifactapi dockerhub remote
Set registry on every step and drop the dead buildkit_config blocks
Fail ci/check-distros.sh when a matrix value restating a distro.env key drifts from it

The CI matrix overrode `BASE_IMAGE` with `docker.io/almalinux:9`, so every CI build pulled the base straight from Docker Hub — uncached and rate-limited — and the artifactapi path set in `distros/alma9/distro.env` only ever applied to local `make build`. Pointing CI at artifactapi exposed a second defect: the `buildkit_config` block is dead YAML. The `plugin-docker-buildx` build we run has no `PLUGIN_BUILDKIT_CONFIG`, so `docker buildx create` ran without `--config` and the spawned buildkit container had no internal CA. The plugin generates that config itself, but only when `registry` is set — which is why the tag build pushed fine and a PR build could not have pulled. - Point the matrix `BASE_IMAGE` at the artifactapi dockerhub remote - Set `registry` on every step and drop the dead `buildkit_config` blocks - Fail `ci/check-distros.sh` when a matrix value restating a `distro.env` key drifts from it

unkin-agent added 1 commit 2026-09-27 22:19:42 +10:00

Build through artifactapi and get the internal CA into buildkit

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/build Pipeline was successful

Details

b9d45eff68

The buildkit_config setting does not exist in the plugin-docker-buildx build
we run: the binary has no PLUGIN_BUILDKIT_CONFIG, so the block was dead YAML
and `docker buildx create` ran without --config. The plugin only writes a
buildkit.toml (pointing at /etc/docker/certs.d/<registry>/ca.crt) when
`registry` is set, which is why the tag build pushed fine and the PR build
had no CA. Set registry on every step and drop the dead block.

The matrix also overrode BASE_IMAGE with the Docker Hub path, so CI never
used the artifactapi remote that distro.env selects. Point it at artifactapi
and have ci/check-distros.sh fail when a matrix value restating a distro.env
key drifts from it.

benvin merged commit 437123a00b into main

2026-09-27 23:12:40 +10:00

benvin deleted branch container-scaffold

2026-09-27 23:12:40 +10:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/container-base#2