sneak/upaas
1
0
Fork 1
Code Issues 5 Pull Requests 2 Actions Packages Projects Releases 1 Wiki Activity

Deployments always fail on a fresh host: the pinned alpine/git image is never pulled #190

New Issue
Closed
opened 2026-09-09 14:39:08 +02:00 by clawbot · 1 comment
clawbot commented 2026-09-09 14:39:08 +02:00
Collaborator
Copy Link
Copy Source

What is wrong

µPaaS clones repositories by starting a container from a pinned alpine/git image, but it never pulls that image. On any host that does not already happen to have that exact digest cached, every deployment fails at the first step.

internal/docker/client.go:44:

const gitImage = "alpine/git@sha256:" +
    "d86f367afb53d022acc4377741e7334bc20add161bb10234272b91b459b4b7d8"

createGitContainer (internal/docker/client.go:670) calls ContainerCreate with that image. The Docker API does not pull on create. There is no ImagePull call anywhere in internal/.

How to reproduce

On a host where the image is absent (docker image inspect alpine/git@sha256:d86f367afb53d022acc4377741e7334bc20add161bb10234272b91b459b4b7d8 fails), run µPaaS, create an app, and trigger its webhook with a push payload for the configured branch. The deployment fails immediately and the deploy log shows:

failed to clone repo: failed to create git container: Error response from daemon:
No such image: alpine/git@sha256:d86f367afb53d022acc4377741e7334bc20add161bb10234272b91b459b4b7d8

Running docker pull alpine/git@sha256:d86f367afb... by hand and re-sending the same webhook makes the clone and the build succeed, so this is the only thing standing in the way.

What acceptable looks like

A fresh µPaaS on a fresh host deploys an app without any manual docker pull.

Pull the image when it is missing: inspect it at startup or before the first clone, and ImagePull the pinned digest if inspect fails, streaming the pull into the deployment log so a slow first deploy is visible rather than silent. Report a clear error if the pull itself fails (no network, private registry) instead of the raw No such image. The same check is worth having for any other image the deploy path assumes.

Model: opus-5

## What is wrong µPaaS clones repositories by starting a container from a pinned `alpine/git` image, but it never pulls that image. On any host that does not already happen to have that exact digest cached, every deployment fails at the first step. `internal/docker/client.go:44`: ```go const gitImage = "alpine/git@sha256:" + "d86f367afb53d022acc4377741e7334bc20add161bb10234272b91b459b4b7d8" ``` `createGitContainer` (`internal/docker/client.go:670`) calls `ContainerCreate` with that image. The Docker API does not pull on create. There is no `ImagePull` call anywhere in `internal/`. ## How to reproduce On a host where the image is absent (`docker image inspect alpine/git@sha256:d86f367afb53d022acc4377741e7334bc20add161bb10234272b91b459b4b7d8` fails), run µPaaS, create an app, and trigger its webhook with a push payload for the configured branch. The deployment fails immediately and the deploy log shows: ``` failed to clone repo: failed to create git container: Error response from daemon: No such image: alpine/git@sha256:d86f367afb53d022acc4377741e7334bc20add161bb10234272b91b459b4b7d8 ``` Running `docker pull alpine/git@sha256:d86f367afb...` by hand and re-sending the same webhook makes the clone and the build succeed, so this is the only thing standing in the way. ## What acceptable looks like A fresh µPaaS on a fresh host deploys an app without any manual `docker pull`. Pull the image when it is missing: inspect it at startup or before the first clone, and `ImagePull` the pinned digest if inspect fails, streaming the pull into the deployment log so a slow first deploy is visible rather than silent. Report a clear error if the pull itself fails (no network, private registry) instead of the raw `No such image`. The same check is worth having for any other image the deploy path assumes. Model: opus-5
clawbot commented 2026-09-09 16:13:26 +02:00
Author
Collaborator
Copy Link
Copy Source

Fixed in #193: the alpine/git image (pinned digest unchanged) is pulled when absent, before the clone container is created. Verified by deploying with the image removed — it was pulled and the clone succeeded.

Model: opus-4-8

Fixed in https://git.eeqj.de/sneak/upaas/pulls/193: the `alpine/git` image (pinned digest unchanged) is pulled when absent, before the clone container is created. Verified by deploying with the image removed — it was pulled and the clone succeeded. Model: opus-4-8
sneak closed this issue 2026-09-10 11:17:43 +02:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
Something is not working
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 merge-ready
All checks pass, reviewed, rebased, ready for merge
 needs-checks
make check does not pass cleanly
 needs-rebase
PR has merge conflicts or is behind main
 needs-review
Code review not yet done
 needs-rework
Code review found issues to fix
 notplanned
question
More information is needed
 wontfix
This won't be fixed
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
clawbot sneak (Jeffrey Paul)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sneak/upaas#190