nexus/WifiPoolToMQTT
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions

Push the image through the Podman socket proxy #3

Merged
nexus merged 2 commits from ci/registry-push into main 2026-07-23 10:16:35 +02:00
Conversation 0 Commits 2 Files changed 6 +62 -109
nexus commented 2026-07-23 10:07:46 +02:00
Owner
Copy link

Fixes the image push that PR #2 left broken.

ko built the image fine but could not publish it:

Get "https://gbjo.mazurczak.cloud/v2/": dial tcp 138.201.125.242:443: connect: connection refused

ko talks to the registry from inside the job container, where the public
address resolves but refuses connections — runner and Forgejo sit on the same
host, so the traffic would have to hairpin.

The other repositories on this instance avoid both that problem and the missing
docker CLI the same way: DOCKER_HOST: tcp://podman-socket-proxy:2375. Login,
build and push are then done by the host's daemon, which reaches the registry
without trouble. This PR follows that pattern.

Side effect worth having: ko and .ko.yaml are gone again, so CI and
make docker-build share one Dockerfile. The two build paths PR #2 introduced
are no longer needed.

The Dockerfile drops the # syntax= directive and the RUN --mount=type=cache
lines — the proxy speaks the Docker API without BuildKit, where both would be
ignored or fail. Verified locally that it still builds and the binary reports
its version.

Also moves the registry login to every branch instead of only where the
push happens. A token with the wrong scope could otherwise not surface before
the merge — the same blind spot that let the last two image failures through.

Proven on this branch: tests green, image builds through the proxy, and the
docker login with the configured REGISTRY_TOKEN succeeds. Only the push
itself waits for main, since that is the one thing a branch must not do.

Fixes the image push that PR #2 left broken. ko built the image fine but could not publish it: Get "https://gbjo.mazurczak.cloud/v2/": dial tcp 138.201.125.242:443: connect: connection refused ko talks to the registry from inside the job container, where the public address resolves but refuses connections — runner and Forgejo sit on the same host, so the traffic would have to hairpin. The other repositories on this instance avoid both that problem and the missing docker CLI the same way: `DOCKER_HOST: tcp://podman-socket-proxy:2375`. Login, build and push are then done by the host's daemon, which reaches the registry without trouble. This PR follows that pattern. Side effect worth having: **ko and .ko.yaml are gone again, so CI and `make docker-build` share one Dockerfile**. The two build paths PR #2 introduced are no longer needed. The Dockerfile drops the `# syntax=` directive and the `RUN --mount=type=cache` lines — the proxy speaks the Docker API without BuildKit, where both would be ignored or fail. Verified locally that it still builds and the binary reports its version. Also moves the registry login to **every** branch instead of only where the push happens. A token with the wrong scope could otherwise not surface before the merge — the same blind spot that let the last two image failures through. Proven on this branch: tests green, image builds through the proxy, and the `docker login` with the configured REGISTRY_TOKEN succeeds. Only the push itself waits for main, since that is the one thing a branch must not do.
Build through the Podman socket proxy instead of ko
All checks were successful
CI / test (push) Successful in 2m58s
Details
CI / image (push) Successful in 1m10s
Details
26704a7cc3 
ko could build the image but not publish it: it talks to the registry from
inside the job container, and there gbjo.mazurczak.cloud resolves to the public
address and refuses the connection.

The other repositories on this instance solve both problems at once by pointing
DOCKER_HOST at the host's Podman socket proxy — the daemon does the build and
the registry traffic, and the host can reach the registry. Following that
pattern also removes the two build paths ko had introduced: CI and 'make
docker-build' use the same Dockerfile again.

That proxy speaks the Docker API without BuildKit, so the Dockerfile drops the
syntax directive and the cache mounts. Verified locally that it still builds
and the binary reports its version.
Authenticate to the registry on every branch
All checks were successful
CI / test (push) Successful in 2m51s
Details
CI / test (pull_request) Successful in 3m9s
Details
CI / image (push) Successful in 52s
Details
CI / image (pull_request) Successful in 51s
Details
bbf547785d 
The login only ran where the push happens, so a token with the wrong scope
could not surface before the merge — the same blind spot that let the previous
two image failures through. Logging in everywhere costs nothing and turns the
token into something the branch proves.
nexus merged commit 06c9b0cade into main 2026-07-23 10:16:35 +02:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
nexus/WifiPoolToMQTT!3
No description provided.