From 47ef83f503eeb68ac60a7623f6c4bbe8d1bdd94e Mon Sep 17 00:00:00 2001 From: Peter Amiri Date: Fri, 9 Oct 2026 15:14:14 -0700 Subject: [PATCH 1/2] ci: pull CI and test base images from the GHCR mirror Points the engine Dockerfiles, the compose databases, the install smokes, the rpm rebuild, the AJP check and the CLI deploy fixtures at ghcr.io/wheels-dev/mirror, which holds the same images unchanged (tags and digest pins kept), so runs no longer depend on Docker Hub's anonymous pull limit. Co-Authored-By: Claude Opus 5.5 Signed-off-by: Peter Amiri --- .github/workflows/commandbox-install-smoke.yml | 2 +- .github/workflows/distribution-install-smoke.yml | 8 ++++---- cli/lucli/tests/_fixtures/deploy/e2e/app/Dockerfile.v1 | 2 +- cli/lucli/tests/_fixtures/deploy/e2e/app/Dockerfile.v2 | 2 +- .../tests/_fixtures/deploy/e2e/docker-compose.yml | 2 +- .../tests/_fixtures/deploy/sshd/docker-compose.yml | 4 ++-- compose.yml | 10 +++++----- tools/ci/ajp/compose.ajp.yml | 2 +- tools/ci/ajp/run.sh | 2 +- tools/distribution-drafts/linux-packages/rpm-rewrap.sh | 4 ++-- tools/docker/adobe2018/Dockerfile | 2 +- tools/docker/adobe2021/Dockerfile | 2 +- tools/docker/adobe2023/Dockerfile | 2 +- tools/docker/adobe2025/Dockerfile | 2 +- tools/docker/boxlang/Dockerfile | 2 +- tools/docker/lucee5/Dockerfile | 2 +- tools/docker/lucee6/Dockerfile | 2 +- tools/docker/lucee7/Dockerfile | 2 +- 18 files changed, 27 insertions(+), 27 deletions(-) diff --git a/.github/workflows/commandbox-install-smoke.yml b/.github/workflows/commandbox-install-smoke.yml index 0981b74066..d576ea6c32 100644 --- a/.github/workflows/commandbox-install-smoke.yml +++ b/.github/workflows/commandbox-install-smoke.yml @@ -73,7 +73,7 @@ jobs: # for ForgeBox publishing (its "Install CommandBox" step), just containerized # so the box server boots in the same userland it serves from. container: - image: ortussolutions/commandbox:latest + image: ghcr.io/wheels-dev/mirror/ortussolutions/commandbox:latest env: # Throwaway values for the CI app; not secrets. SMOKE_RELOAD_PASSWORD: "wheels-dev" diff --git a/.github/workflows/distribution-install-smoke.yml b/.github/workflows/distribution-install-smoke.yml index fce3485071..e20b832b65 100644 --- a/.github/workflows/distribution-install-smoke.yml +++ b/.github/workflows/distribution-install-smoke.yml @@ -526,9 +526,9 @@ jobs: matrix: include: - label: "rocky 10, rpm 4.19" - image: rockylinux/rockylinux:10 + image: ghcr.io/wheels-dev/mirror/rockylinux/rockylinux:10 - label: "rocky 9, rpm 4.16" - image: rockylinux/rockylinux:9 + image: ghcr.io/wheels-dev/mirror/rockylinux/rockylinux:9 container: image: ${{ matrix.image }} env: @@ -576,7 +576,7 @@ jobs: # Gates (hard-fail): as of 4.0.5 the rpm's wrapper resolves the RHEL/Fedora # Java-21 layout, so `wheels --version` works on Rocky 9 (was the 4.0.4 bug). container: - image: rockylinux:9 + image: ghcr.io/wheels-dev/mirror/rockylinux:9 env: EXPECTED: ${{ needs.resolve.outputs.version }} steps: @@ -643,7 +643,7 @@ jobs: # dependency (#4237) is what makes it installable. Bleeding-edge only for # now; a stable Fedora leg is owed once 4.2.0 ships with that dependency. container: - image: fedora:44 + image: ghcr.io/wheels-dev/mirror/fedora:44 steps: - name: Add yum.wheels.dev bleeding-edge + install (the documented path) run: | diff --git a/cli/lucli/tests/_fixtures/deploy/e2e/app/Dockerfile.v1 b/cli/lucli/tests/_fixtures/deploy/e2e/app/Dockerfile.v1 index b7fa713f73..fc7ce60bef 100644 --- a/cli/lucli/tests/_fixtures/deploy/e2e/app/Dockerfile.v1 +++ b/cli/lucli/tests/_fixtures/deploy/e2e/app/Dockerfile.v1 @@ -11,5 +11,5 @@ # 2. A follow-up task can build + `docker save` this into a tarball, load # it into a dind service, and flip the test from "command-dispatch # assertions" to "real HTTP v1 serves". -FROM nginx:alpine +FROM ghcr.io/wheels-dev/mirror/nginx:alpine RUN printf '%s\n' 'v1' > /usr/share/nginx/html/index.html diff --git a/cli/lucli/tests/_fixtures/deploy/e2e/app/Dockerfile.v2 b/cli/lucli/tests/_fixtures/deploy/e2e/app/Dockerfile.v2 index da41fd0bb1..616540c650 100644 --- a/cli/lucli/tests/_fixtures/deploy/e2e/app/Dockerfile.v2 +++ b/cli/lucli/tests/_fixtures/deploy/e2e/app/Dockerfile.v2 @@ -1,4 +1,4 @@ # Minimal nginx image that serves "v2" on /. See Dockerfile.v1 for why this # isn't built by the default E2E lifecycle. -FROM nginx:alpine +FROM ghcr.io/wheels-dev/mirror/nginx:alpine RUN printf '%s\n' 'v2' > /usr/share/nginx/html/index.html diff --git a/cli/lucli/tests/_fixtures/deploy/e2e/docker-compose.yml b/cli/lucli/tests/_fixtures/deploy/e2e/docker-compose.yml index 15ea400931..dab55d3f69 100644 --- a/cli/lucli/tests/_fixtures/deploy/e2e/docker-compose.yml +++ b/cli/lucli/tests/_fixtures/deploy/e2e/docker-compose.yml @@ -11,7 +11,7 @@ services: # Port 22024 — distinct from the plain sshd fixture (22022/22023) so both # fixtures can coexist during development. e2e-host: - image: linuxserver/openssh-server:latest + image: ghcr.io/wheels-dev/mirror/linuxserver/openssh-server:latest environment: PUBLIC_KEY_FILE: /keys/authorized_keys USER_NAME: deploy diff --git a/cli/lucli/tests/_fixtures/deploy/sshd/docker-compose.yml b/cli/lucli/tests/_fixtures/deploy/sshd/docker-compose.yml index 9f1a4466c4..3ab1b6463e 100644 --- a/cli/lucli/tests/_fixtures/deploy/sshd/docker-compose.yml +++ b/cli/lucli/tests/_fixtures/deploy/sshd/docker-compose.yml @@ -4,7 +4,7 @@ # checkout finds the same config, and a deleted worktree can't leave a dangling mount. services: sshd1: - image: linuxserver/openssh-server:latest + image: ghcr.io/wheels-dev/mirror/linuxserver/openssh-server:latest environment: PUBLIC_KEY: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIED8dz5J/2zX6dKwp5Oqlp5wguhfg4lY0Pg91Z/tIa/h wheels-deploy-test" USER_NAME: deploy @@ -14,7 +14,7 @@ services: - "22022:2222" sshd2: - image: linuxserver/openssh-server:latest + image: ghcr.io/wheels-dev/mirror/linuxserver/openssh-server:latest environment: PUBLIC_KEY: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIED8dz5J/2zX6dKwp5Oqlp5wguhfg4lY0Pg91Z/tIa/h wheels-deploy-test" USER_NAME: deploy diff --git a/compose.yml b/compose.yml index 31a2244f45..5ef987e7b1 100644 --- a/compose.yml +++ b/compose.yml @@ -360,7 +360,7 @@ services: - wheels-network mysql: - image: mysql:9.7.0 + image: ghcr.io/wheels-dev/mirror/mysql:9.7.0 restart: always environment: MYSQL_ROOT_PASSWORD: wheelstestdb @@ -381,7 +381,7 @@ services: - wheels-network postgres: - image: postgres:18.4 + image: ghcr.io/wheels-dev/mirror/postgres:18.4 restart: always environment: POSTGRES_USER: wheelstestdb @@ -431,7 +431,7 @@ services: - wheels-network cockroachdb: - image: cockroachdb/cockroach:v24.3.32 + image: ghcr.io/wheels-dev/mirror/cockroachdb/cockroach:v24.3.32 restart: always command: start-single-node --insecure --advertise-addr=cockroachdb ports: @@ -449,7 +449,7 @@ services: - wheels-network cockroachdb-init: - image: cockroachdb/cockroach:v24.3.32 + image: ghcr.io/wheels-dev/mirror/cockroachdb/cockroach:v24.3.32 depends_on: cockroachdb: condition: service_healthy @@ -459,7 +459,7 @@ services: - wheels-network oracle: - image: gvenzl/oracle-free:23.26.1-slim + image: ghcr.io/wheels-dev/mirror/gvenzl/oracle-free:23.26.1-slim restart: always environment: ORACLE_PASSWORD: wheelstestdb diff --git a/tools/ci/ajp/compose.ajp.yml b/tools/ci/ajp/compose.ajp.yml index a633d85c68..42f2c7174d 100644 --- a/tools/ci/ajp/compose.ajp.yml +++ b/tools/ci/ajp/compose.ajp.yml @@ -14,7 +14,7 @@ services: source: ${AJP_SERVER_JSON:?run through tools/ci/ajp/run.sh, which generates it} target: /wheels-test-suite/server.json httpd: - image: ${AJP_HTTPD_IMAGE:-httpd:2.4} + image: ${AJP_HTTPD_IMAGE:-ghcr.io/wheels-dev/mirror/httpd:2.4} network_mode: "service:lucee7" volumes: - type: bind diff --git a/tools/ci/ajp/run.sh b/tools/ci/ajp/run.sh index ff6d0031c6..fcf0de536c 100755 --- a/tools/ci/ajp/run.sh +++ b/tools/ci/ajp/run.sh @@ -21,7 +21,7 @@ PROJECT="${1:-wheels-ajp}" PORT="${AJP_HTTPD_PORT:-9590}" OUT="${AJP_RESULT_JSON:-$(mktemp)}" # compose.ajp.yml runs the same image the stock config is read from. -export AJP_HTTPD_IMAGE="${AJP_HTTPD_IMAGE:-httpd:2.4}" +export AJP_HTTPD_IMAGE="${AJP_HTTPD_IMAGE:-ghcr.io/wheels-dev/mirror/httpd:2.4}" GEN="$(mktemp -d "${TMPDIR:-/tmp}/wheels-ajp.XXXXXX")" export AJP_SERVER_JSON="$GEN/server-ajp.json" export AJP_HTTPD_CONF="$GEN/httpd.conf" diff --git a/tools/distribution-drafts/linux-packages/rpm-rewrap.sh b/tools/distribution-drafts/linux-packages/rpm-rewrap.sh index d8670f817f..508c4a63d6 100644 --- a/tools/distribution-drafts/linux-packages/rpm-rewrap.sh +++ b/tools/distribution-drafts/linux-packages/rpm-rewrap.sh @@ -25,8 +25,8 @@ set -euo pipefail IN="${1:?usage: rpm-rewrap.sh }" OUT="${2:?usage: rpm-rewrap.sh }" -BUILD_IMAGE="${RPM_REWRAP_BUILD_IMAGE:-rockylinux/rockylinux:9}" -CHECK_IMAGES="${RPM_REWRAP_CHECK_IMAGES:-rockylinux/rockylinux:10 rockylinux/rockylinux:9}" +BUILD_IMAGE="${RPM_REWRAP_BUILD_IMAGE:-ghcr.io/wheels-dev/mirror/rockylinux/rockylinux:9}" +CHECK_IMAGES="${RPM_REWRAP_CHECK_IMAGES:-ghcr.io/wheels-dev/mirror/rockylinux/rockylinux:10 ghcr.io/wheels-dev/mirror/rockylinux/rockylinux:9}" IN_ABS="$(cd "$(dirname "${IN}")" && pwd)/$(basename "${IN}")" OUT_DIR_ABS="$(mkdir -p "$(dirname "${OUT}")" && cd "$(dirname "${OUT}")" && pwd)" diff --git a/tools/docker/adobe2018/Dockerfile b/tools/docker/adobe2018/Dockerfile index 3190079ab4..98350712b9 100644 --- a/tools/docker/adobe2018/Dockerfile +++ b/tools/docker/adobe2018/Dockerfile @@ -1,4 +1,4 @@ -FROM ortussolutions/commandbox:latest +FROM ghcr.io/wheels-dev/mirror/ortussolutions/commandbox:latest LABEL maintainer "Wheels Core Team" diff --git a/tools/docker/adobe2021/Dockerfile b/tools/docker/adobe2021/Dockerfile index 14a4d336cc..d27e73b15a 100644 --- a/tools/docker/adobe2021/Dockerfile +++ b/tools/docker/adobe2021/Dockerfile @@ -1,4 +1,4 @@ -FROM ortussolutions/commandbox:latest +FROM ghcr.io/wheels-dev/mirror/ortussolutions/commandbox:latest LABEL maintainer "Wheels Core Team" diff --git a/tools/docker/adobe2023/Dockerfile b/tools/docker/adobe2023/Dockerfile index a7b5e7a5d8..49a38e077c 100644 --- a/tools/docker/adobe2023/Dockerfile +++ b/tools/docker/adobe2023/Dockerfile @@ -1,4 +1,4 @@ -FROM ortussolutions/commandbox:latest@sha256:1f180edf899d1db7fc906835e20c12ed18a93db2c2c1053ac5cace2f28626da0 +FROM ghcr.io/wheels-dev/mirror/ortussolutions/commandbox:latest@sha256:1f180edf899d1db7fc906835e20c12ed18a93db2c2c1053ac5cace2f28626da0 LABEL maintainer "Wheels Core Team" diff --git a/tools/docker/adobe2025/Dockerfile b/tools/docker/adobe2025/Dockerfile index ca1d401734..1b6d114c96 100644 --- a/tools/docker/adobe2025/Dockerfile +++ b/tools/docker/adobe2025/Dockerfile @@ -1,4 +1,4 @@ -FROM ortussolutions/commandbox:jdk21@sha256:d65126caeb6c80c115d4cc93f9b9db88697c4fe2aa4ca83ea9a36dadc62c02c1 +FROM ghcr.io/wheels-dev/mirror/ortussolutions/commandbox:jdk21@sha256:d65126caeb6c80c115d4cc93f9b9db88697c4fe2aa4ca83ea9a36dadc62c02c1 LABEL maintainer "Wheels Core Team" diff --git a/tools/docker/boxlang/Dockerfile b/tools/docker/boxlang/Dockerfile index 34c1812610..b63db1f50e 100644 --- a/tools/docker/boxlang/Dockerfile +++ b/tools/docker/boxlang/Dockerfile @@ -1,4 +1,4 @@ -FROM ortussolutions/commandbox:latest@sha256:1f180edf899d1db7fc906835e20c12ed18a93db2c2c1053ac5cace2f28626da0 +FROM ghcr.io/wheels-dev/mirror/ortussolutions/commandbox:latest@sha256:1f180edf899d1db7fc906835e20c12ed18a93db2c2c1053ac5cace2f28626da0 LABEL maintainer "Wheels Core Team" diff --git a/tools/docker/lucee5/Dockerfile b/tools/docker/lucee5/Dockerfile index d7096e6d50..ba64f985f2 100644 --- a/tools/docker/lucee5/Dockerfile +++ b/tools/docker/lucee5/Dockerfile @@ -1,4 +1,4 @@ -FROM ortussolutions/commandbox:latest +FROM ghcr.io/wheels-dev/mirror/ortussolutions/commandbox:latest LABEL maintainer "Wheels Core Team" diff --git a/tools/docker/lucee6/Dockerfile b/tools/docker/lucee6/Dockerfile index d98542d0ac..b5c4029741 100644 --- a/tools/docker/lucee6/Dockerfile +++ b/tools/docker/lucee6/Dockerfile @@ -1,4 +1,4 @@ -FROM ortussolutions/commandbox:latest@sha256:1f180edf899d1db7fc906835e20c12ed18a93db2c2c1053ac5cace2f28626da0 +FROM ghcr.io/wheels-dev/mirror/ortussolutions/commandbox:latest@sha256:1f180edf899d1db7fc906835e20c12ed18a93db2c2c1053ac5cace2f28626da0 LABEL maintainer "Wheels Core Team" diff --git a/tools/docker/lucee7/Dockerfile b/tools/docker/lucee7/Dockerfile index a2d9f08627..21cd9e583d 100644 --- a/tools/docker/lucee7/Dockerfile +++ b/tools/docker/lucee7/Dockerfile @@ -1,4 +1,4 @@ -FROM ortussolutions/commandbox:latest@sha256:1f180edf899d1db7fc906835e20c12ed18a93db2c2c1053ac5cace2f28626da0 +FROM ghcr.io/wheels-dev/mirror/ortussolutions/commandbox:latest@sha256:1f180edf899d1db7fc906835e20c12ed18a93db2c2c1053ac5cace2f28626da0 LABEL maintainer "Wheels Core Team" From 6234640b41406aefb9d685b3c3eef4bb69963794 Mon Sep 17 00:00:00 2001 From: Peter Amiri Date: Fri, 9 Oct 2026 15:15:21 -0700 Subject: [PATCH 2/2] ci: keep the CockroachDB and Oracle services on Docker Hub Co-Authored-By: Claude Opus 5.5 Signed-off-by: Peter Amiri --- compose.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/compose.yml b/compose.yml index 5ef987e7b1..aa013df560 100644 --- a/compose.yml +++ b/compose.yml @@ -431,7 +431,7 @@ services: - wheels-network cockroachdb: - image: ghcr.io/wheels-dev/mirror/cockroachdb/cockroach:v24.3.32 + image: cockroachdb/cockroach:v24.3.32 restart: always command: start-single-node --insecure --advertise-addr=cockroachdb ports: @@ -449,7 +449,7 @@ services: - wheels-network cockroachdb-init: - image: ghcr.io/wheels-dev/mirror/cockroachdb/cockroach:v24.3.32 + image: cockroachdb/cockroach:v24.3.32 depends_on: cockroachdb: condition: service_healthy @@ -459,7 +459,7 @@ services: - wheels-network oracle: - image: ghcr.io/wheels-dev/mirror/gvenzl/oracle-free:23.26.1-slim + image: gvenzl/oracle-free:23.26.1-slim restart: always environment: ORACLE_PASSWORD: wheelstestdb