Repository navigation
fix(providers): switch MinIO images from Docker Hub to quay.io - #963
Merged
Merged
Conversation
Docker Hub now denies pulls of minio/minio and minio/mc entirely
("pull access denied ... repository does not exist or may require
'docker login'"), breaking every test and preset/default that pulled
those images. quay.io/minio/minio and quay.io/minio/mc still serve the
same content under existing tags (verified digest-for-digest for the
mc image used by the backup/restore mirror engines), so this repoints
test fixtures, CI workflows, and production defaults (S3/RustFS
service presets, the mc utility image used by restore/mirror engines)
to the quay.io registry while keeping the same pinned release tags.
Signed-off-by: David Viejo <dviejo@kfs.es>
📓 Changelog previewThis is what your commits will add to the generated ## [Unreleased]
### Fixed
- **providers:** Switch MinIO images from Docker Hub to quay.io
- **providers:** Pin remaining test-fixture MinIO image to quay.io
- **providers:** Normalize persisted MinIO images to quay.io on load |
Greptile SummaryThis PR migrates MinIO server and client image references from Docker Hub to quay.io while retaining the existing release tags and digest pinning.
Confidence Score: 5/5The PR appears safe to merge, with the prior persisted-service compatibility issue now fully fixed and no new actionable defects identified. Persisted S3 configuration is deserialized through
|
| Filename | Overview |
|---|---|
| crates/temps-providers/src/externalsvc/s3.rs | Migrates S3 defaults and helper images to quay.io and normalizes persisted bare MinIO references, fully addressing the previous review finding. |
| crates/temps-providers/src/externalsvc/rustfs.rs | Moves the RustFS backup and restore MinIO client image to the equivalent quay.io release. |
| crates/temps-backup/src/engines/s3_mirror.rs | Changes the mirror helper registry while preserving its release tag and content digest. |
| .github/workflows/apps-e2e-tests.yml | Uses a pinned quay.io MinIO client image when initializing the E2E backup bucket. |
| .github/workflows/rust-tests.yml | Updates the MariaDB PITR fixture pull and diagnostic image lookup to the pinned quay.io MinIO image. |
| apps/temps-e2e/docker-compose.e2e.yml | Replaces the floating Docker Hub MinIO fixture with a pinned quay.io release. |
Flowchart
%%{init: {'theme': 'neutral'}}%%
flowchart LR
A[Persisted or submitted S3 configuration] --> B{Bare MinIO repository?}
B -->|minio/minio or minio/mc| C[Prefix with quay.io]
B -->|Qualified custom registry| D[Preserve unchanged]
C --> E[Runtime container image]
D --> E
Reviews (3): Last reviewed commit: "fix(providers): normalize persisted MinI..." | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
|
|
||
| fn default_image() -> String { | ||
| "minio/minio:RELEASE.2025-09-07T16-13-09Z".to_string() | ||
| "quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z".to_string() |
There was a problem hiding this comment.
Existing S3/MinIO services store their docker_image in encrypted service configuration. Changing default_image() does not update that non-empty value, and initialization, updates, and redeployments continue to reuse it. Services created with the former minio/minio:RELEASE... default will therefore keep pulling from the denied Docker Hub repository after Temps is upgraded. Normalize the exact former built-in default to its quay.io equivalent while preserving user-supplied images.
Knowledge Base Used: Deployment orchestration
CI's docker-backups integration job caught one more spot: the restore-to-new-service test fixture in s3.rs still pulled minio/minio:latest from Docker Hub, which fails the same way as everything else fixed in this branch. Signed-off-by: David Viejo <dviejo@kfs.es>
dviejokfs
enabled auto-merge
September 12, 2026 07:27
Greptile flagged that changing the built-in defaults didn't help services created before this fix: their docker_image is already persisted in the database as the old bare minio/minio or minio/mc reference, and create_container_once always re-pulls the image before even checking whether the container exists — so init()/restart on an existing S3 or RustFS-mc-backed service would keep retrying the now Docker-Hub-denied image forever. Normalize in From<S3InputConfig> for S3Config, the single conversion point used both for new services and for reconstructing config from stored parameters on every init(): rewrite the exact former bare Docker Hub defaults (minio/minio:*, minio/mc:*) to their quay.io equivalents, and leave anything already qualified (quay.io/..., a private mirror, a fork) untouched since that reflects an explicit operator choice, not our old default. Signed-off-by: David Viejo <dviejo@kfs.es>
RatherHard
added a commit
to RatherHard/StackMaster
that referenced
this pull request
Sep 17, 2026
CI 两个 Docker 相关 job 长期恒红,本次定位到**同一根因**: - `Compose 集成测试` —— 失败步骤 `全拓扑构建与启动`,耗时**约 2 秒**; - `E2E 三浏览器矩阵` —— 失败步骤 `矩阵 spec(E2E_MATRIX=1)`,耗时**约 6 秒** (= Playwright 启动 + `global-setup` 的 `topologyRunning` 2 秒轮询 + 同一 compose 拒绝);该 job 的 `globalSetup` 经 `helpers/compose.ts#composeAppUp()` 与前者**共用同一套 compose 拓扑**。 ## 根因(本机非破坏性复现,逐字原文) `compose/deps.yaml` 的 `minio` 与 `compose/app.yaml` 的 `verifier-minio-init` 使用 Docker Hub 的 `minio/minio:latest` / `minio/mc:latest`。**Docker Hub 上的 `minio/minio` 与 `minio/mc` 已不再接受匿名拉取**: ``` $ docker pull minio/minio:latest Error response from daemon: pull access denied for minio/minio, repository does not exist or may require 'docker login' (exit 1) $ docker manifest inspect minio/minio:latest denied: requested access to the resource is denied unauthorized: authentication required ``` `minio/mc:latest` 同形。CI runner **无 Docker Hub 凭证、无本地缓存** ⇒ compose 在拉取阶段被 registry 立即拒绝(**无任何层下载**,故秒级失败),两条 job 同时打红。 **为什么本地一直绿**:本机**已缓存**这两个镜像,compose 不触发拉取 ⇒ 该错在 开发机上结构性不可见。**又一例「本地绿、CI 恒红」**。 **时间量级对照**:无层下载的 registry 拒绝路径本机实测 6.7 秒(Windows + CLI 启动 开销),CI 上 2 秒量级自洽。 **上游迁移佐证**(多项目已跟进切 quay.io): - gotempsh/temps — 「switch MinIO images from Docker Hub to quay.io」 gotempsh/temps#963 - apache/iceberg — 「Build: Pull MinIO images from Quay」 apache/iceberg#18071 - camunda/camunda — 「test: use quay hosted minio image」 camunda/camunda#63189 ## 修法 两处镜像改为 **quay.io** 并**固定 tag**(原为 `:latest`,是本次脆弱性的来源): | 位置 | 改前 | 改后 | |---|---|---| | `compose/deps.yaml`(minio) | `minio/minio:latest` | `quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z` | | `compose/app.yaml`(verifier-minio-init) | `minio/mc:latest` | `quay.io/minio/mc:RELEASE.2025-08-13T08-35-41Z` | 两个 tag **正是本机已缓存、既有拓扑一直在用的版本**(`minio --version` / `mc --version` 实测读取)⇒ 行为等价、零语义变化,只是把来源换成可匿名拉取者并把 版本钉死。各加注释说明「**不得改回 Docker Hub**」及原因。 ## 验证 - `quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z` 与 `quay.io/minio/mc:RELEASE.2025-08-13T08-35-41Z`:`docker manifest inspect` 均 OK (对比 Docker Hub 侧 denied); - **实拉实测**:`docker compose -f compose/deps.yaml up -d --wait` ⇒ **exit 0**, postgres / redis / **minio** / db-roles-init 全部 **Healthy**(真正走了一次 quay 拉取,非缓存命中); - `docker pull quay.io/minio/mc:...` ⇒ `Status: Downloaded newer image`, `mc --version` = `RELEASE.2025-08-13T08-35-41Z`(与 init 脚本既有实跑版本一致); - `docker compose config --quiet` 两份文件组合 exit 0; - **清理**:`down -v` exit 0,容器与卷零残留(已核对 `docker ps -a` / `docker volume ls`)。
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
minio/minioandminio/mc(pull access denied ... repository does not exist or may require 'docker login'), which was breaking theScenario E2ECI jobs (edge, examples, observability, recovery, services, core) and every Rust test/tool that boots a MinIO container.mcimage reference — test fixtures, CI workflows (rust-tests.yml,apps-e2e-tests.yml),docker-compose.e2e.yml, and production defaults (S3/RustFS service presets, themcutility image used by the backup/restore mirror engines) — toquay.io/minio/minioandquay.io/minio/mc, keeping the exact same pinned release tags (and the same content-digest for the SHA-pinnedmcimage used bys3_mirror.rs).minio/minioas a generic example of a user-supplied image (docker-compose import detection, generic image-tag parsing, legacy-tag backward-compat parsing) — those aren't images Temps itself pulls, so they don't need a registry change.Test plan
cargo check --workspace --lib --tests— 0 errorscargo clippy -p temps-providers -p temps-backup --tests -- -D warnings— cleancargo test -p temps-providers --lib— 678 passedcargo test -p temps-backup --lib— 228 passed, 5 ignoredquay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z,quay.io/minio/mc:latest, and the digest-pinnedquay.io/minio/mc@sha256:a7fe...all pull successfullytest_minio_container_lifecycletest end-to-end against a live Docker daemon (starts/stops an actualquay.io/minio/miniocontainer) — passed