Repository navigation
ci: pull base images through mirror.gcr.io - #64
Merged
Merged
Conversation
Since builds run once per architecture (#60), every main run makes about twice as many authenticated Docker Hub pulls, all counted against the one account the jobs log in with. Five merges within half an hour exhausted its quota: every main run since then failed with 429 Too Many Requests while resolving the base images, and nothing was published. Pull request runs, which pull anonymously from separate runner IPs, kept passing. BuildKit now pulls docker.io images through mirror.gcr.io, which serves the same digests (checked for php, dunglas/frankenphp and mlocati/php-extension-installer) and falls back to Docker Hub on a miss. The login is still used to push. The publish job also drops its imagetools inspect, one more manifest request per image.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Every
mainrun since #60 failed with429 Too Many Requestswhile resolving the base images (mlocati/php-extension-installer,php,dunglas/frankenphp), so nothing was published: Docker Hub still serves the images from before #57, #58 and #59.Pull request runs kept passing because they pull anonymously, each runner from its own IP. Push runs log in, so all their pulls count against the one Docker Hub account. Since #60 builds each architecture separately, a full run makes about twice as many of them, and five merges within half an hour (#60, #58, #59, #57, #63) exhausted the quota.
docker.ioimages throughmirror.gcr.io(buildkitd-config-inline), Google's public Docker Hub mirror. It has all 21 base images used by the 8.1–8.6 Dockerfiles, serves the same digests as Docker Hub (checked forphp:8.5-apache,php:8.6-rc-alpine,dunglas/frankenphp:1-php8.5-bookworm,mlocati/php-extension-installer:latest), and falls back to Docker Hub on a miss. The Docker Hub login is still used to push.imagetools inspect, one more authenticated manifest request per image.Checked locally with a builder using the same config, on a machine that Docker Hub currently answers with 429:
dunglas/frankenphp:1-php8.5-bookwormresolved and pulled through the mirror. This PR changes the workflow, so it rebuilds every image; the publish half runs once merged.