Pull minio from quay.io instead of Docker Hub - #7837
Open
CharlieTLe wants to merge 2 commits into
Open
Conversation
Every integration leg is failing at Preload Images: Error response from daemon: pull access denied for minio/minio, repository does not exist or may require 'docker login': denied: requested access to the resource is denied minio/minio is the first Docker Hub pull in the step, so no leg gets past it and all 24 fail in about 30 seconds. A CHANGELOG-only pull request reproduces it, so this is not specific to any change under test. master was last green at 4061a3d. This is not a rate limit: the same pull fails right after a successful 'docker login' with the repository credentials. The docker.io/minio/minio repository is simply no longer accessible. MinIO still publishes the identical image to quay.io. quay.io/minio/minio :RELEASE.2024-05-28T17-19-04Z is public and is a manifest list with 8 children, so it covers both the amd64 and arm64 runners. Point the integration tests, the CI preload list, and the three development docker-compose stacks at quay.io. The tag is unchanged, so no behaviour changes. Signed-off-by: Charlie Le <charlie_le@apple.com>
Preload Images still pulls consul, memcached, redis and postgres from Docker Hub. #7464 removed the Install Docker Client step from this job, and that script is where 'docker login' runs, so those pulls have been anonymous since and are subject to the anonymous rate limit. Log in explicitly, matching what the build job does. Pull requests from forks have no secrets, so skip the login there and leave those pulls anonymous instead of failing the step. This is hardening, not the fix for the current breakage: minio failed even when authenticated. Signed-off-by: Charlie Le <charlie_le@apple.com>
CharlieTLe
changed the title
CharlieTLe
force-pushed
the
fix-integration-docker-login
branch
from
September 12, 2026 19:29
8852753 to
69accec
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Every
integrationleg on every PR is failing at Preload Images:minio/miniois the first Docker Hub pull in that step, so no leg gets past it — all 24 fail in about 30s. It reproduces on a PR that only touchesCHANGELOG.md(#7836), so it is not specific to any change under test.masterwas last green at 4061a3d (2026-09-11 16:42 UTC).Cause
Not a rate limit. I first pushed a
docker loginbefore the preload step to rule that out. The login succeeded:The pull is still denied with valid credentials, so
docker.io/minio/miniois no longer accessible — not throttled.Fix
MinIO publishes the identical image to quay.io.
quay.io/minio/minio:RELEASE.2024-05-28T17-19-04Zis public and is a manifest list with 8 children, so it covers both the amd64 and arm64 runners:Commit 1 points the integration tests, the CI preload list, and the three
development/tsdb-blocks-storage-s3*docker-compose stacks at quay.io. The tag is unchanged, so no behaviour changes. The dev stacks are broken by the same cause today.Commit 2 keeps the
docker login, as hardening rather than as the fix.Preload Imagesstill pullsconsul,memcached,redisandpostgresfrom Docker Hub. #7464 removed theInstall Docker Clientstep from this job, and that script is where thedocker loginhappens, so those pulls have been anonymous ever since and are exposed to the anonymous rate limit. Fork PRs get no secrets, so the step skips the login there and leaves those pulls anonymous rather than failing.Why now
v1.22.0-rc.0is scheduled for today per RELEASE.md.integrationis a required status check, so this blocks the release cut as well as every other PR.This branch is pushed to the main repo rather than a fork so its own CI has the secrets and can exercise commit 2.