Skip to content

Pull the musl build image from a pinned mirror, with retries - #32

Merged
cb1kenobi merged 1 commit into
mainfrom
chris/musl-image-mirror
Oct 10, 2026
Merged

cb1kenobi merged 1 commit into
mainfrom
chris/musl-image-mirror

Conversation

@cb1kenobi

Copy link
Copy Markdown
Member

Both musl legs of run 37992614440 failed within seconds of each other, before any build ran. docker run alpine:latest timed out on Docker Hub's anonymous-pull token endpoint:

docker: Error response from daemon: Head "https://registry-1.docker.io/v2/library/alpine/manifests/latest":
Get "https://auth.docker.io/token?...": context deadline exceeded

Nothing in the build broke. The musl legs passed in today's 06:08 and 16:54 runs. But each musl leg pulls alpine:latest twice, from one registry, with no retry. Any Docker Hub hiccup therefore fails the release, and the musl toolchain silently changes whenever Alpine moves latest.

Changes

  • Mirror. The image now comes from ECR Public (public.ecr.aws/docker/library/alpine), which mirrors Docker Hub's official images and doesn't go through Docker Hub's token endpoint.
  • Pin. It is pinned to alpine:3.24@sha256:294b683c…. That is the digest the last green musl build (run 37962402212) pulled, and I checked that ECR serves the same digest for 3.24. The musl toolchain (gcc 15.2) now changes only through a reviewed bump.
  • Retry. A new Pull musl build image step pulls once per musl job, retrying up to 5 times with linear backoff. Both docker run steps (build and archive verification) then use the local image.

Verification

  • actionlint: no new findings (the pre-existing shellcheck notes are unchanged).
  • Not exercised by this PR's CI. Pull-request runs only do validate; the build matrix is skipped. A workflow_dispatch on this branch would run the release job, so I didn't trigger one. The first real proof is the next nightly or dispatch from main after merge. Please watch the two musl legs there.

🤖 Generated with Claude Code

Both musl legs failed at once when Docker Hub's anonymous-pull token endpoint timed out on
alpine:latest. Pull alpine 3.24 by digest from ECR Public, which mirrors the same official image,
once per job with backoff, and run both musl steps on that image.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@gemini-code-assist

Copy link
Copy Markdown
Contributor

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

@cb1kenobi
cb1kenobi merged commit f638d79 into main Oct 10, 2026
7 checks passed
@cb1kenobi
cb1kenobi deleted the chris/musl-image-mirror branch October 10, 2026 00:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant