Two things in the Dockerfile header were wrong, and the second actively misled.
The publish instructions described pushing to the Gitea registry by hand. Publishing now runs on GitHub Actions to ghcr.io (#2), because Cloudflare'''s request-body cap returns 413 on a registry layer and our own runners cannot build images (host mode, all capabilities dropped). The example tag had also been mangled to 12.11.1-ci.
"Package visibility is PUBLIC, so the runner namespace pulls without a secret" was false. The Gitea package is private — flux-config'''s kustomization says so in as many words — and the runner Deployments have always carried a pull secret.
That line cost real time: it led me to conclude the ghcr package would need no credential. It does, and forgejo-runner-system now holds github-registry-credentials (flux-config #669, merged and rolled out).
Verified with docker build --check: no warnings.
Two things in the Dockerfile header were wrong, and the second actively misled.
The publish instructions described pushing to the Gitea registry by hand. Publishing now runs on GitHub Actions to ghcr.io (#2), because Cloudflare'''s request-body cap returns **413** on a registry layer and our own runners cannot build images (host mode, all capabilities dropped). The example tag had also been mangled to `12.11.1-ci`.
*"Package visibility is PUBLIC, so the runner namespace pulls without a secret"* was **false**. The Gitea package is private — flux-config'''s kustomization says so in as many words — and the runner Deployments have always carried a pull secret.
That line cost real time: it led me to conclude the ghcr package would need no credential. It does, and `forgejo-runner-system` now holds `github-registry-credentials` (flux-config #669, merged and rolled out).
Verified with `docker build --check`: no warnings.
Two things were wrong, and the second actively misled.
The publish instructions described pushing to the Gitea registry by hand.
Publishing now runs on GitHub Actions to ghcr.io, because Cloudflare's
request-body cap returns 413 on a registry layer and our own runners cannot
build images (host mode, all capabilities dropped). The example tag had also
been mangled to "12.11.1-ci".
"Package visibility is PUBLIC, so the runner namespace pulls without a secret"
was false. The Gitea package is private — flux-config's kustomization says so
in as many words — and the runner Deployments have always carried a pull
secret. Reading that line led me to conclude the ghcr package would need no
credential; it does, and forgejo-runner-system now holds
github-registry-credentials for exactly that.
Verified with `docker build --check`: no warnings.
markus
merged commit 137dde8122 into master2026-08-20 13:48:06 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Two things in the Dockerfile header were wrong, and the second actively misled.
The publish instructions described pushing to the Gitea registry by hand. Publishing now runs on GitHub Actions to ghcr.io (#2), because Cloudflare'''s request-body cap returns 413 on a registry layer and our own runners cannot build images (host mode, all capabilities dropped). The example tag had also been mangled to
12.11.1-ci."Package visibility is PUBLIC, so the runner namespace pulls without a secret" was false. The Gitea package is private — flux-config'''s kustomization says so in as many words — and the runner Deployments have always carried a pull secret.
That line cost real time: it led me to conclude the ghcr package would need no credential. It does, and
forgejo-runner-systemnow holdsgithub-registry-credentials(flux-config #669, merged and rolled out).Verified with
docker build --check: no warnings.