chore: take base images off Docker Hub (#87) - #88
Merged
Conversation
Both Dockerfiles fetched their base image from Docker Hub. No account was involved, since these are public images, but Docker Hub rate-limits anonymous pulls per source address and CI runners share those addresses, so a build can begin failing for reasons unrelated to any change here. The ngrok image is built on the deployment host during every deploy, so the same limit fails a deploy rather than just a build. Both are Docker Official Images and are mirrored by AWS at public.ecr.aws/docker/library/, which serves the same content without an account and with far more generous anonymous limits. With this change nothing in the build chain points at Docker Hub: the backend base and the ngrok base come from the AWS mirror, and uv already came from ghcr. Verified by building both images from the new bases and running them: Python 3.11.16, uv 0.12.11, ngrok 2.3.41. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ref #87
Completes the work started in #85. That change removed the Docker Hub account from the deployment path; this removes Docker Hub from the build chain as well.
Change
docker/Dockerfile.backpython:3.11-slimpublic.ecr.aws/docker/library/python:3.11-slimdocker/Dockerfile.ngrokalpine:latestpublic.ecr.aws/docker/library/alpine:latestBoth are Docker Official Images; AWS mirrors them and serves identical content without an account.
Why it is worth doing even though nothing is broken
Docker Hub rate-limits anonymous pulls per source address, and CI runners share egress addresses. A build can therefore start failing for reasons unrelated to any change in this repository. The ngrok image is rebuilt on the deployment host during every deploy, so the same limit fails a deploy rather than merely a build — and after the handover there will be nobody positioned to recognise that failure mode quickly.
Verification
Both images built from the new bases and run:
Every remaining base reference, for the record:
Nothing points at Docker Hub.
Not included
alpine:latestanduv:latestremain floating tags. Pinning them would make builds reproducible and protect against an upstream major version breaking the build unattended, but that is a separate change with its own review.Note
Merging triggers a real deployment.
🤖 Generated with Claude Code