kevinveenbirkenbachandClaude Opus 5 3ba4448a49 fix(images): probe an image at the registry that actually serves it ...

ImageRef.name drops the registry host so a role's image can be compared
across sources, and both integration sweeps handed that bare name to
their probe. A probe reaches docker.io with it, where an image published
only on ghcr.io or quay.io does not exist, and read the 404 as "cannot
tell" rather than as a wrong question. ImageRef.addressable puts the
registry back in front for the two callers that address a registry.

It also repairs the mirror read path rather than only silencing 404s.
GHCRProvider.image_base always published under {registry}/{name} while
the reader asked under docker.io/... for every foreign image, so the
mirror hit rate rises and the sweep's own mirror-coverage assertion gets
easier, not harder.

What the corrected probe exposed is the rest of this commit: five
services whose image ships no HEALTHCHECK and whose role declared none,
so nothing could tell whether the container serves.

svc-ai-litellm, web-app-homeassistant and web-app-mini-qr get a real
probe, each in the flavor its own image can run. litellm uses
http_status on health/liveliness: /health and /health/readiness both
require auth and readiness pings the database on every beat, which would
couple the gateway's health to a postgres blip. The wget flavor is
deliberately not used there although the image ships wget, because
--spider sends HEAD and FastAPI sets APIRoute.methods from the declared
methods without adding HEAD, so a HEAD to a GET-only route answers 405
forever. mini-qr is the mirror image of that argument: busybox only, no
bash and no curl, and its busybox wget offers -Y on/off rather than
--proxy=off, which is what the http flavor exists for.

sys-ctl-hlth-csp and test-e2e-playwright are marked instead. Both run as
`container run --rm` and exit with their work, and neither role renders
a compose service that could carry a probe. A probe there would be worse
than useless: sys-ctl-hlth-container greps `container ps --filter
health=unhealthy` with no compose-project filter, so a never-passing
healthcheck on a minutes-long ad-hoc container raises a host-wide alarm.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-10-18 01:21:26 +02:00

..

main.yml

feat(readme): uniform description schema and clearer role titles

2026-07-18 01:11:48 +02:00

services.yml

fix(images): probe an image at the registry that actually serves it

2026-10-18 01:21:26 +02:00