kevinveenbirkenbachandClaude Opus 5
280e338cdc
Run 34893363518 lost the fedora workspace job at certs.sh with exit 125. docker run resolved alpine:latest itself, the token request to auth.docker.io came back as 'read: connection reset by peer', and that single transport fault ended the job. Five of the six workspace jobs pulled the same image successfully in the same run, so the cause is transport, not a Docker Hub policy response, whose signature would be toomanyrequests after a successful token exchange.
Every other network operation on this path already retries: scripts/github/runner/pull_with_retry.sh serves two workflows, scripts/image/build.sh has its own ladder for the build frontend, and cli/administration/deploy/development/compose.py retries compose up six times. This call site had no attempts at all, so pre-pull through the existing helper rather than a new loop.
The attempt budget is 3x10s instead of the helper's 7x20s default because this runs as a prerequisite on the interactive local path, where two minutes of sleeping without a network would be felt. The call stays non-fatal so a locally cached image still carries an unreachable registry, the same semantics 0df75d83a6 established for the buildx bootstrap; set -euo pipefail is why it needs the if-guard.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Docker Runner Scripts 🐳
Shell helpers that run inside the infinito runner container defined by
the top-level compose.yml. They cover container
lifecycle (entry, healthcheck) and integration with peer compose
services (e.g. the registry-cache pull-through proxy).
Scope 📋
- This directory MUST contain only scripts that execute inside the
infinitocontainer, either as the container entrypoint, as a DockerHEALTHCHECK, or as asystemdunit hook. - This directory MUST NOT host host-side tooling. Scripts that run on
the developer or CI host belong under their workflow-specific path
(for example
scripts/tests/,scripts/image/,scripts/meta/). - This directory MUST NOT host application logic that belongs to an Ansible role.
Bind-mounted scripts 🔗
A script that is bind-mounted from this directory into a fixed in-container path (see compose.yml) MUST keep its git executable bit, because Docker bind-mounts preserve host file permissions and the in-container caller (systemd, dockerd, the entrypoint) cannot recover from a non-executable mount.
When a new script is added with a bind-mount target, its purpose and
in-container target path SHOULD be documented at the call site (the
matching compose/<service>/ README, or compose.yml.md).
Distro portability 🌐
A script in this directory MUST work across every distro variant that
the runner image is built for (currently Debian, Ubuntu, Arch, Fedora,
CentOS). Tool availability differs across these variants, so a script
SHOULD branch on command -v <tool> rather than on distro IDs.