Skip to content

ci: retry the stack image pull on a transient registry error - #4

Merged
maltesander merged 1 commit into
mainfrom
ci/harden-image-pull
Aug 5, 2026
Merged

ci: retry the stack image pull on a transient registry error#4
maltesander merged 1 commit into
mainfrom
ci/harden-image-pull

Conversation

@maltesander

Copy link
Copy Markdown
Member

Description

The spooling leg failed on docker compose pull with unexpected EOF:
one 41 MB layer of quay.io/minio/minio dropped partway through. Docker's
own retry budget is per layer and defaults to five attempts, and once
those were spent the whole pull failed, discarding the three images that
had already downloaded. The step lasted 57s, so the job died on about a
minute of bad luck. Memory was 14 GiB free and no OOM was recorded.

Only the spooling leg reaches quay.io, which is why it shows up there:

leg registries in play
core Docker Hub (postgres:17, trinodb/trino:483)
spooling Docker Hub + quay.io (minio, mc)

This wraps the pull in three attempts with a widening pause. Layers that
did arrive stay in the local content store, so a second attempt refetches
only what is missing and costs seconds instead of a manual job rerun.

A rate limit (toomanyrequests) and a name the registry does not serve
(manifest unknown, unauthorized, denied): exit immediately with a
named error for inspection.

A pull of quay.io/minio/minio dropped one 41 MiB layer partway through,
and the daemon's own retry budget is per layer: once those five attempts
were spent the whole pull failed, taking the images that had already
arrived with it. The spooling leg is the one that reaches quay.io, which
is why that leg is where this shows up.

Wrap the pull in three attempts with a widening pause. Layers that did
arrive stay in the local content store, so a second attempt refetches
only what is missing and costs seconds rather than a rerun of the job.

A rate limit and a name the registry does not serve are reported as
themselves without retrying. Neither improves by asking again, and the
explicit pull exists so that those two are legible in the step list
rather than surfacing as a startup timeout several minutes later.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@maltesander
maltesander requested a review from adwk67 August 5, 2026 09:46
@maltesander maltesander self-assigned this Aug 5, 2026
@maltesander
maltesander merged commit 0991758 into main Aug 5, 2026
8 checks passed
@maltesander
maltesander deleted the ci/harden-image-pull branch August 5, 2026 09:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants