From f9d06f523a82efba87a10efefac8969a54ee4630 Mon Sep 17 00:00:00 2001 From: James Greenhill Date: Fri, 11 Sep 2026 22:29:00 +0000 Subject: [PATCH 1/2] build: pull MinIO from quay.io instead of Docker Hub MinIO deleted its Docker Hub repositories. Both `minio/minio` and `minio/mc` now return 404 from the Hub API, and every pull fails with "repository does not exist or may require 'docker login'", which reads like an auth problem but is not one. This turns controlplane-tests and integration-tests red on every branch. The images are still published to quay.io, so point every reference there. Pin a dated release tag rather than `latest` so a later rebuild cannot change the image underneath us. The minio tag resolves to the same digest the Hub served before it was removed. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01WCY5Jf2BQPCVKJTZU1TpEe --- .github/workflows/ci.yml | 3 ++- docker-compose.yaml | 6 ++++-- k8s/local-config-store.compose.yaml | 4 +++- tests/integration/docker-compose.yml | 6 ++++-- 4 files changed, 13 insertions(+), 6 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b86770de3..ba045a4a1 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -175,11 +175,12 @@ jobs: - name: Start MinIO run: | + # MinIO deleted its Docker Hub repositories; quay.io is the live source. docker run -d --name minio \ -p 39000:9000 \ -e MINIO_ROOT_USER=minioadmin \ -e MINIO_ROOT_PASSWORD=minioadmin \ - quay.io/minio/minio:latest server /data + quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z server /data # Wait for MinIO to be ready for i in {1..30}; do curl -sf http://localhost:39000/minio/health/live && break diff --git a/docker-compose.yaml b/docker-compose.yaml index f7a3e4408..5960d659a 100644 --- a/docker-compose.yaml +++ b/docker-compose.yaml @@ -17,7 +17,9 @@ services: retries: 5 minio: - image: minio/minio:latest + # MinIO deleted its Docker Hub repositories, so pull from quay.io. The tag is a + # dated release rather than `latest` so a rebuild cannot silently change it. + image: quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z container_name: ducklake-storage command: server /data --console-address ":9001" environment: @@ -36,7 +38,7 @@ services: # Creates the ducklake bucket on startup minio-init: - image: minio/mc:latest + image: quay.io/minio/mc:RELEASE.2025-08-13T08-35-41Z container_name: ducklake-storage-init depends_on: minio: diff --git a/k8s/local-config-store.compose.yaml b/k8s/local-config-store.compose.yaml index 70f6c7381..273260373 100644 --- a/k8s/local-config-store.compose.yaml +++ b/k8s/local-config-store.compose.yaml @@ -47,7 +47,9 @@ services: - /var/lib/postgresql/data minio: - image: minio/minio:latest + # MinIO deleted its Docker Hub repositories, so pull from quay.io. The tag is a + # dated release rather than `latest` so a rebuild cannot silently change it. + image: quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z container_name: duckgres-local-minio command: server /data --console-address ":9001" environment: diff --git a/tests/integration/docker-compose.yml b/tests/integration/docker-compose.yml index f69c9fd06..1b4a850d3 100644 --- a/tests/integration/docker-compose.yml +++ b/tests/integration/docker-compose.yml @@ -42,7 +42,9 @@ services: # MinIO for DuckLake object storage minio: - image: minio/minio:latest + # MinIO deleted its Docker Hub repositories, so pull from quay.io. The tag is a + # dated release rather than `latest` so a rebuild cannot silently change it. + image: quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z container_name: duckgres-test-minio command: server /data --console-address ":9001" environment: @@ -61,7 +63,7 @@ services: # Creates the ducklake bucket on startup minio-init: - image: minio/mc:latest + image: quay.io/minio/mc:RELEASE.2025-08-13T08-35-41Z container_name: duckgres-test-minio-init depends_on: minio: From 64852587a3c8faece893b4aa3a949ca9efeb50f2 Mon Sep 17 00:00:00 2001 From: James Greenhill Date: Fri, 11 Sep 2026 22:42:32 +0000 Subject: [PATCH 2/2] build: run mc from its image, not the archived download dl.min.io now returns 410 Gone. MinIO archived the community mc client alongside the Docker Hub images, so the CI step that installed the binary cannot work either. Worse, `curl -sL` without -f writes the 410 body to /tmp/mc and the step then chmods and runs an HTML page. Run mc from the quay.io image this branch already pins. Joining the MinIO container's network namespace keeps the endpoint on its internal port, so the step no longer depends on the published one. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01WCY5Jf2BQPCVKJTZU1TpEe --- .github/workflows/ci.yml | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ba045a4a1..fbc345f7e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -189,12 +189,14 @@ jobs: - name: Create MinIO bucket run: | - # Install mc client - curl -sL https://dl.min.io/client/mc/release/linux-arm64/mc -o /tmp/mc - chmod +x /tmp/mc - # Configure and create bucket - /tmp/mc alias set minio http://localhost:39000 minioadmin minioadmin - /tmp/mc mb minio/ducklake --ignore-existing + # dl.min.io returns 410 Gone: MinIO archived the community mc client + # alongside the Docker Hub images. Run mc from its quay.io image + # instead. `--network container:minio` joins MinIO's own namespace, + # so the endpoint is its internal port, not the published one. + docker run --rm --network container:minio \ + -e MC_HOST_minio=http://minioadmin:minioadmin@localhost:9000 \ + quay.io/minio/mc:RELEASE.2025-08-13T08-35-41Z \ + mb minio/ducklake --ignore-existing - name: Run integration tests run: just test-integration