agent
30dabb5056
docker manifest create refuses a source that is itself a manifest list: ERROR: ...:<tag>-amd64 is a manifest list With Docker containerd image store, docker build --platform linux/amd64 produces an OCI index rather than a plain manifest, so BOTH per-arch tags are lists and the combine fails — after the slow multi-hundred-MB pushes have already succeeded. The failure mode is nasty: the per-arch tags are published and the PLAIN tag, the one both Deployments reference, is absent. Hit on 12.11.1-ci6, 2026-08-31. buildx imagetools create accepts indexes as sources and combines registry-side, so it works with either image store. Verification switches to imagetools inspect and now asserts both linux/amd64 and linux/arm64 specifically, rather than counting two distinct architecture strings.
133 lines
6.1 KiB
Bash
Executable File
133 lines
6.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# push-image.sh — build and publish the runner toolchain image, multi-arch.
|
|
#
|
|
# Why this script exists: doing it by hand hit four obstacles in a row.
|
|
#
|
|
# 1. 413 Payload Too Large. gitea.langenoja.se is behind Cloudflare, which
|
|
# caps request bodies well below a registry layer. Fixed by pinning the
|
|
# hostname to the Istio gateway on the LAN (below) so the push never
|
|
# traverses Cloudflare.
|
|
# 2. Docker only treats a name as a registry HOST if it contains a dot or a
|
|
# colon. Pushing to the bare MagicDNS name `gitea-system-gitea-tailscale-http`
|
|
# was parsed as a Docker Hub NAMESPACE, so Docker Hub refused the auth.
|
|
# 3. The Gitea PAT needs `write:package`. `read:package` is pull-only.
|
|
# 4. Multi-arch is required: forgejo-runner runs on arm64 nodes and
|
|
# zegit-runner on amd64, neither deployment sets a nodeSelector, and both
|
|
# use this one tag.
|
|
#
|
|
# The hostname MUST stay gitea.langenoja.se in the image reference, because that
|
|
# is what the cluster pulls. So we keep the name and change only the ROUTE, via
|
|
# an /etc/hosts pin that is removed again on exit.
|
|
#
|
|
# The Istio gateway serves a *.langenoja.se wildcard cert, so TLS validates
|
|
# normally — no insecure-registries, no --tls-verify=false.
|
|
set -euo pipefail
|
|
|
|
TAG="${1:-}"
|
|
GATEWAY_IP="${GATEWAY_IP:-10.40.0.10}"
|
|
REGISTRY="gitea.langenoja.se"
|
|
REPO="$REGISTRY/zegit-zoo/zegit-forgejo-runner"
|
|
MARKER="# added by push-image.sh"
|
|
HOSTS_LINE="$GATEWAY_IP $REGISTRY $MARKER"
|
|
|
|
die() { echo "error: $*" >&2; exit 1; }
|
|
|
|
if [ "$TAG" = "--unpin" ]; then
|
|
MARKER="# added by push-image.sh"
|
|
if grep -qF "$MARKER" /etc/hosts 2>/dev/null; then
|
|
sudo sed -i "\|${MARKER}\$|d" /etc/hosts; echo "removed the leftover pin"
|
|
else
|
|
echo "no pin of ours in /etc/hosts; nothing to do"
|
|
fi
|
|
exit 0
|
|
fi
|
|
[ -n "$TAG" ] || die "usage: $0 <tag> | --unpin (e.g. $0 12.11.1-ci4)"
|
|
command -v docker >/dev/null || die "docker not on PATH"
|
|
|
|
# Three cases, and they must not be confused:
|
|
# OURS — a line carrying our marker. A LEFTOVER from a run that died
|
|
# before its trap fired. Reuse it, and DO remove it on exit.
|
|
# THEIRS — a line without our marker. Deliberate; never touch it, and
|
|
# refuse if it points somewhere other than the gateway.
|
|
# ABSENT — add ours.
|
|
# The earlier version could not tell OURS from THEIRS, so a leftover pin was
|
|
# treated as deliberate and survived every subsequent run. That is the bug that
|
|
# made an operator revert /etc/hosts by hand.
|
|
PIN_OWNED=0
|
|
if grep -qF "$MARKER" /etc/hosts 2>/dev/null; then
|
|
PIN_OWNED=1
|
|
echo "found a leftover pin from an interrupted run; reusing and will clean it up"
|
|
elif grep -qE "^[^#]*[[:space:]]$REGISTRY([[:space:]]|\$)" /etc/hosts 2>/dev/null; then
|
|
existing=$(grep -E "^[^#]*[[:space:]]$REGISTRY([[:space:]]|\$)" /etc/hosts | head -1)
|
|
[ "$(echo "$existing" | awk '{print $1}')" = "$GATEWAY_IP" ] \
|
|
|| die "/etc/hosts already pins $REGISTRY elsewhere (not ours, not the gateway): $existing"
|
|
echo "an unmarked pin to the gateway already exists; leaving it exactly as found"
|
|
fi
|
|
|
|
# Removes ONLY lines carrying our marker, so a deliberate pin is never touched.
|
|
unpin() {
|
|
if grep -qF "$MARKER" /etc/hosts 2>/dev/null; then
|
|
sudo sed -i "\|${MARKER}\$|d" /etc/hosts
|
|
echo "removed the /etc/hosts pin"
|
|
fi
|
|
}
|
|
cleanup() { [ "$PIN_OWNED" = "1" ] && unpin; }
|
|
# INT and TERM too: EXIT alone leaves the pin behind on Ctrl-C in some shells.
|
|
trap cleanup EXIT INT TERM
|
|
|
|
if [ "$PIN_OWNED" = "0" ] && ! grep -qE "^[^#]*[[:space:]]$REGISTRY([[:space:]]|\$)" /etc/hosts 2>/dev/null; then
|
|
echo "pinning $REGISTRY -> $GATEWAY_IP (bypasses Cloudflare; removed on exit)"
|
|
echo "$HOSTS_LINE" | sudo tee -a /etc/hosts >/dev/null
|
|
PIN_OWNED=1
|
|
fi
|
|
|
|
# Prove the route before building anything: 401 means the registry answered and
|
|
# wants auth, which is success here. A timeout means the pin or the LAN is wrong.
|
|
code=$(curl -sS -o /dev/null -w '%{http_code}' --max-time 20 "https://$REGISTRY/v2/" || true)
|
|
case "$code" in
|
|
401|200) echo "registry reachable via the pin (HTTP $code)" ;;
|
|
*) die "registry not reachable via $GATEWAY_IP (HTTP ${code:-timeout}). Is this host on the LAN?" ;;
|
|
esac
|
|
|
|
docker login "$REGISTRY" || die "login failed — the PAT needs write:package, not read:package"
|
|
|
|
for arch in amd64 arm64; do
|
|
echo "building linux/$arch"
|
|
docker build --platform "linux/$arch" -t "$REPO:$TAG-$arch" . \
|
|
|| die "build failed for $arch (arm64 needs qemu/binfmt registered)"
|
|
# Explicit tag, never $_ — in zsh $_ is the last ARGUMENT, which here is '.'
|
|
docker push "$REPO:$TAG-$arch" || die "push failed for $arch"
|
|
done
|
|
|
|
# `docker manifest create` REFUSES a source that is itself a manifest list:
|
|
# ERROR: gitea.langenoja.se/...:<tag>-amd64 is a manifest list
|
|
# With Docker's containerd image store, `docker build --platform linux/amd64`
|
|
# produces an OCI index rather than a plain manifest, so both per-arch tags are
|
|
# lists and the combine step fails after the (slow, large) pushes have already
|
|
# succeeded — leaving the per-arch tags published and the plain tag absent,
|
|
# which is the one the Deployments reference. Seen on 12.11.1-ci6, 2026-08-31.
|
|
#
|
|
# `buildx imagetools create` accepts indexes as sources and does the combine
|
|
# registry-side, so it works with either image store.
|
|
docker buildx imagetools create -t "$REPO:$TAG" "$REPO:$TAG-amd64" "$REPO:$TAG-arm64" \
|
|
|| die "failed to combine the per-arch tags into $REPO:$TAG"
|
|
|
|
# Verify by reading it back, rather than trusting the push's exit code.
|
|
echo "verifying the published manifest lists both architectures"
|
|
inspect=$(docker buildx imagetools inspect "$REPO:$TAG") \
|
|
|| die "published $REPO:$TAG cannot be read back"
|
|
got=$(echo "$inspect" | grep -o 'linux/[a-z0-9]*' | sort -u | grep -cE 'linux/(amd64|arm64)')
|
|
[ "$got" -ge 2 ] || die "published manifest does not list both architectures:
|
|
$inspect"
|
|
echo "$inspect" | grep -o 'linux/[a-z0-9]*' | sort -u
|
|
|
|
cat <<EOF
|
|
|
|
published $REPO:$TAG
|
|
|
|
Next, in flux-config, bump BOTH deployments that use this image:
|
|
applications/forgejo-runner/base/deployment-zegit-runner.yaml
|
|
applications/forgejo-runner/base/deployment-forgejo-runner.yaml
|
|
(markus-runner uses markus/gitea-runner and is unaffected.)
|
|
EOF
|