CI: harden container builds against transient registry and CDN failures#100
Merged
Conversation
Current Aviator status
This PR was merged using Aviator (commit f781c03).
See the real-time status of this PR on the
Aviator webapp.
Use the Aviator Chrome Extension
to see the status of your PR within GitHub.
|
rjhuijsman
force-pushed
the
rjh.ci-harden-docker-hub-pulls
branch
from
July 20, 2026 15:31
2ffe6c9 to
d8ef25a
Compare
rjhuijsman
requested review from
Copilot and
onelxj
and removed request for
onelxj
July 20, 2026 16:13
rjhuijsman
marked this pull request as ready for review
July 20, 2026 16:14
Contributor
There was a problem hiding this comment.
Pull request overview
This PR hardens CI container builds against transient registry/CDN failures by adding retries to Dockerfile network fetches and pre-pulling base images in GitHub Actions to keep registries off the build critical path.
Changes:
- Pre-pull devcontainer/development container base images (with retries/backoff via a composite action) before running builds in CI workflows.
- Add retry/backoff flags to
curl/wgetdownloads in Dockerfiles and avoid piping installer scripts directly into interpreters. - Align the development container’s pinned Ubuntu base image with the repo-root Dockerfile.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 8 comments.
| File | Description |
|---|---|
reboot/containers/development/Dockerfile |
Align base image with repo root and add retrying downloads + safer script execution. |
Dockerfile |
Add retrying downloads and switch several script installs from pipe-to-shell to file-then-run. |
.github/workflows/development_containers_build_test_push.yml |
Add pre-pull step for the development container base image before builds. |
.github/workflows/devcontainer.yml |
Add pre-pull step for the devcontainer base image before devcontainers/ci build. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
onelxj
approved these changes
Jul 20, 2026
rjhuijsman
force-pushed
the
rjh.ci-harden-docker-hub-pulls
branch
from
July 20, 2026 21:17
c002e65 to
ff1857a
Compare
Transient registry failures -- 5xx responses from Docker Hub and other registries -- kept aborting `docker buildx` before it could resolve a base image, failing CI jobs before they ran a single test; reruns fixed it, but the flakes kept bouncing PRs and burning hours. Every build job in `build_and_test.yml` builds the devcontainer through the reusable `devcontainer.yml` workflow via `devcontainers/ci`, and the development-containers workflow's `build-test-push` job builds `reboot/containers/development` twice, so any single base-image pull was a job-wide point of failure. Added a step to both workflows that pre-pulls the base image into the runner's local image store with retries before the build, via the parameterized `pre-pull-docker-image` composite action from dev-tools, taking the registry off the build's critical path. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UPXVU5ytyWJxSL4YChKhm6
The development container's `Dockerfile` had gone stale on `ubuntu:jammy-20240808` while the repo-root `Dockerfile` moved on to `ubuntu:jammy-20251001`; the two are supposed to share the same pinned base. Updated the development container to the same tag (verified multi-arch: amd64 and arm64 manifests exist). No other file pins or echoes either tag. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UPXVU5ytyWJxSL4YChKhm6
CDNs and download hosts intermittently reset connections or return 5xx errors, and a single such failure in any download aborted the whole container build before CI ran a single test -- most recently `curl: (35) OpenSSL SSL_connect: Connection reset by peer` fetching the awscli installer. Gave every raw `curl` and `wget` download in the repo-root and development container `Dockerfile`s retry semantics using the tools' native flags, and downloads that piped installer scripts straight into an interpreter now fetch to a temporary file and execute it instead, so a torn stream can no longer reach an interpreter. Nothing about what gets downloaded changes; validated by building the `respect-current-minimum` stage and the development image through its `uv` install. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UPXVU5ytyWJxSL4YChKhm6
aviator-app
Bot
force-pushed
the
rjh.ci-harden-docker-hub-pulls
branch
from
July 20, 2026 21:20
ff1857a to
9e35b77
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Transient network failures -- 5xx responses and SSL/TCP connection resets from registries and download CDNs -- kept killing CI builds. Any failed network fetch in the container build path would break the whole CI.
This PR prevents these types of failures by hardening some network fetches:
pre-pull-docker-imagecomposite action from3rdparty/dev-tools(Add apre-pull-docker-imagecomposite action 3rdparty/dev-tools#101). Thedevcontainers/cibuild uses the defaultdockerbuildx driver, which resolvesFROMimages from the local store, so a pre-pulled base never touches the registry on the critical path. The development-containers workflow'sbuild-test-pushjob gets the same pre-pull forreboot/containers/development.Dockerfiles: everycurl/wgetfetch in the repo-root and development containerDockerfiles now retries transient failures via native flags (e.g.curl --retry 5 --retry-all-errors).And while we're here...
Dockerfilehad gone stale onubuntu:jammy-20240808; it now shares the repo-rootDockerfile's pinned base.