Repository navigation
ci + dev: MinIO from Chainguard, because quay.io/minio stopped serving - #87
Merged
Merged
Conversation
Every relay-backed CI job has failed on main since f076c06: the relay test stack's `minio-init` pull gets `401 Unauthorized` from quay.io, and so does the server image. Docker Hub's minio/* went first (upstream moved to Quay in block#7599 for that reason); Quay has now followed. This is the same outage upstream has, unfixed there. cgr.dev/chainguard/minio is the same MinIO server, public, amd64+arm64, pinned here by its index digest. Its -dev variant carries a shell, wget and mc, so one image serves the server and every bucket-init step. - docker-compose.yml, docker-compose.harness.yml, deploy/compose: the server and init use it; the healthcheck uses wget (no curl in the image); both run as root so named volumes the old root image wrote stay readable. - chart: image and mcImage; the quickstart MinIO pod gets fsGroup 65532, the image's user, so its PVC is writable. - voice-bridge lab and rebrand-proof run.sh, ARCHITECTURE.md. Checked by hand with the compose settings: server healthy, bucket created and set private; non-root mc (the chart's wait-for-bucket) lists it; the non-root server starts on tmpfs (the lab path). Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01QpU2aVq1KSeWTKPKGMfjCa Signed-off-by: Lloyd Hilaiel <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Main has been red on every relay-backed job since
f076c06e7:quay.io/minio/mcandquay.io/minio/minionow answer 401 Unauthorized (reproduced locally, both images). Docker Hub'sminio/*is gone too. Upstream block/buzz has the same references and the same outage.This swaps every MinIO reference to
cgr.dev/chainguard/minio:latest-dev, pinned by multi-arch index digest — the same MinIO, public, amd64+arm64. The-devvariant hassh,wgetandmc, so it covers the server and all bucket-init steps.curl→wget --spider;user: "0:0"so existing root-owned named volumes stay readable.image+mcImage; quickstart MinIO pod getsfsGroup: 65532for its PVC.Local proof with the compose settings: server healthy, bucket created and set private; non-root
mclists it; non-root server starts on tmpfs. The CI relay jobs on this PR are the real proof.Unblocks #63 and #44, which fail only on these jobs.
🤖 Generated with Claude Code
https://claude.ai/code/session_01QpU2aVq1KSeWTKPKGMfjCa