Sign in

Search issue titles and bodies, change requests and comments. Private repositories you cannot read are not included.
vole
Clone

Read only, no credentials:

https://rodent.software/vole.git

Write over SSH with a registered key:

git clone ssh://git@rodent.software:2222/vole.git

A free and open-source forge that lives in your Git repo.

#239

P2: runner image builds fail on Debian and Ubuntu with no unqualified-search-registries

closed · opened by keenan 22h ago

keenan opened this 22h ago

With the runtime able to start a container, the next failure is the image build itself:

STEP 1/7: FROM golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5
Error: creating build container: short-name "golang@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5"
  did not resolve to an alias and no unqualified-search registries are defined in
  "/etc/containers/registries.conf"
building image-file "verify" exited 125

.vole/images/*.yaml name their base as a short name with a digest pinned. Podman refuses to guess the registry when unqualified-search-registries is empty, and on Debian and Ubuntu /etc/containers/registries.conf ships entirely commented out. So every workflow whose image names a base this way cannot build on those distributions.

What fixed it here

/etc/containers/registries.conf.d/50-vole-runner.conf:

unqualified-search-registries = ["docker.io"]

The digest is what pins the base image; the list only says where to look for the name.

Scope

  • Choose one: qualify image references in .vole/images/*.yaml (docker.io/library/golang:…), or have the runner docs and deploy/cloud-init/runner.yaml write the registries drop-in. The first travels with the repository and works on any runner; the second covers every image a repository adds later, including contributor-written ones.
  • Whichever is chosen, docs/deploy/runner.md should say it, because the failure names a file the operator has never edited and looks like a workflow bug.
  • Consider whether a job image may name a registry other than Docker Hub at all; if images are only ever built from a digest, a stricter list is possible.

Acceptance criteria

On a clean Debian or Ubuntu runner, following only the documented steps, an image with a digest-pinned short-name base builds without a manual edit.

Related: #237 must be fixed first for the container runtime to get this far; #241 is the next failure after this one.

Comments (1)

keenan 4h ago

Taking this with #237 and #241 as one change.

Choosing the second option: the runner’s side, not qualifying references in .vole/images/*.yaml. The repository’s own images are not the population that matters — a contributor adds a workflow with a digest-pinned short name and the build fails on Debian and Ubuntu until an operator edits a file the contributor cannot see. A drop-in covers those too.

  • The package ships /etc/containers/registries.conf.d/50-vole-runner.conf with unqualified-search-registries = ["docker.io"], as a conffile.
  • Numbered at 50 so a site that wants a different list writes 99-site.conf, which is read after it.
  • Every install path (package, manual steps, cloud-init) already installs the package, so deploy/cloud-init/runner.yaml needs no change and no second copy of the setting can drift.
  • docs/deploy/runner.md and docs/packaging.md say the file exists, that the digest is the pin and the list only says where to look, and what the failure looks like without it, because that error currently reads like a workflow bug.
  • Keeping podman’s search-list semantics rather than rewriting names in code, so the resolution stays something an operator can inspect and change.