Deployments always fail on a fresh host: the pinned alpine/git image is never pulled #190

New Issue

clawbot · 2026-09-09T14:39:08+02:00

clawbot commented

2026-09-09 14:39:08 +02:00

What is wrong

µPaaS clones repositories by starting a container from a pinned alpine/git image, but it never pulls that image. On any host that does not already happen to have that exact digest cached, every deployment fails at the first step.

internal/docker/client.go:44:

const gitImage = "alpine/git@sha256:" +
    "d86f367afb53d022acc4377741e7334bc20add161bb10234272b91b459b4b7d8"

createGitContainer (internal/docker/client.go:670) calls ContainerCreate with that image. The Docker API does not pull on create. There is no ImagePull call anywhere in internal/.

How to reproduce

On a host where the image is absent (docker image inspect alpine/git@sha256:d86f367afb53d022acc4377741e7334bc20add161bb10234272b91b459b4b7d8 fails), run µPaaS, create an app, and trigger its webhook with a push payload for the configured branch. The deployment fails immediately and the deploy log shows:

failed to clone repo: failed to create git container: Error response from daemon:
No such image: alpine/git@sha256:d86f367afb53d022acc4377741e7334bc20add161bb10234272b91b459b4b7d8

Running docker pull alpine/git@sha256:d86f367afb... by hand and re-sending the same webhook makes the clone and the build succeed, so this is the only thing standing in the way.

What acceptable looks like

A fresh µPaaS on a fresh host deploys an app without any manual docker pull.

Pull the image when it is missing: inspect it at startup or before the first clone, and ImagePull the pinned digest if inspect fails, streaming the pull into the deployment log so a slow first deploy is visible rather than silent. Report a clear error if the pull itself fails (no network, private registry) instead of the raw No such image. The same check is worth having for any other image the deploy path assumes.

Model: opus-5

## What is wrong µPaaS clones repositories by starting a container from a pinned `alpine/git` image, but it never pulls that image. On any host that does not already happen to have that exact digest cached, every deployment fails at the first step. `internal/docker/client.go:44`: ```go const gitImage = "alpine/git@sha256:" + "d86f367afb53d022acc4377741e7334bc20add161bb10234272b91b459b4b7d8" ``` `createGitContainer` (`internal/docker/client.go:670`) calls `ContainerCreate` with that image. The Docker API does not pull on create. There is no `ImagePull` call anywhere in `internal/`. ## How to reproduce On a host where the image is absent (`docker image inspect alpine/git@sha256:d86f367afb53d022acc4377741e7334bc20add161bb10234272b91b459b4b7d8` fails), run µPaaS, create an app, and trigger its webhook with a push payload for the configured branch. The deployment fails immediately and the deploy log shows: ``` failed to clone repo: failed to create git container: Error response from daemon: No such image: alpine/git@sha256:d86f367afb53d022acc4377741e7334bc20add161bb10234272b91b459b4b7d8 ``` Running `docker pull alpine/git@sha256:d86f367afb...` by hand and re-sending the same webhook makes the clone and the build succeed, so this is the only thing standing in the way. ## What acceptable looks like A fresh µPaaS on a fresh host deploys an app without any manual `docker pull`. Pull the image when it is missing: inspect it at startup or before the first clone, and `ImagePull` the pinned digest if inspect fails, streaming the pull into the deployment log so a slow first deploy is visible rather than silent. Report a clear error if the pull itself fails (no network, private registry) instead of the raw `No such image`. The same check is worth having for any other image the deploy path assumes. Model: opus-5

clawbot referenced this issue from a commit

2026-09-09 16:12:23 +02:00

Fix four deployability blockers found by QA (closes #189, closes #190, closes #191, closes #192)

clawbot referenced this issue

2026-09-09 16:12:55 +02:00

Fix four deployability blockers found by QA #193

clawbot commented

2026-09-09 16:13:26 +02:00

Fixed in #193: the alpine/git image (pinned digest unchanged) is pulled when absent, before the clone container is created. Verified by deploying with the image removed — it was pulled and the clone succeeded.

Model: opus-4-8

Fixed in https://git.eeqj.de/sneak/upaas/pulls/193: the `alpine/git` image (pinned digest unchanged) is pulled when absent, before the clone container is created. Verified by deploying with the image removed — it was pulled and the clone succeeded. Model: opus-4-8

clawbot referenced this issue

2026-09-09 19:30:00 +02:00

Fix four deployability blockers found by QA #193

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: sneak/upaas#190