From 8e6be56b502c0bc049db2c2ddb4a0eec685de04f Mon Sep 17 00:00:00 2001 From: AminDhouib Date: Sun, 13 Sep 2026 14:11:50 -0400 Subject: [PATCH] fix(deploy): pull MinIO from quay.io - Docker Hub now denies minio/minio and minio/mc Docker Hub has revoked anonymous pull access to the MinIO namespace. An anonymous manifest GET against registry-1.docker.io returns 401 UNAUTHORIZED for every tag of minio/minio and minio/mc, including :latest, while the token endpoint still issues a token for the scope and library/postgres:16-alpine returns 200 over the identical flow. docker pull minio/mc:RELEASE.2025-07-21T05-28-08Z Error response from daemon: pull access denied for minio/mc, repository does not exist or may require 'docker login' A digest pin does not help: the digest is resolved through the same denied repository, so `pnpm e2e:minio:up` fails at the pull exactly like a tag pull would. The same root cause has been failing every Dokploy deploy of the BioFlow production compose stack since 2026-09-12T10:43Z. quay.io, MinIO's other official registry, serves these exact images. Critically, THE DIGESTS ARE UNCHANGED - the two digests this compose already pinned are the same two digests quay.io serves, so the upload-validation gate keeps running the bytes it was verified against: quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z sha256:14cea493d9a34af32f524e538b8346cf79f3321eff8e708c1e2960462bd8936e quay.io/minio/mc:RELEASE.2025-08-13T08-35-41Z sha256:a7fe349ef4bd8521fb8497f55c6042871b2ae640607cf99d9bede5e9bdf11727 Both were re-fetched from quay.io by digest to confirm they resolve. The bare digest references also gain their human-readable release tag, so the file now says which release each digest is, instead of only a hash. Changed: docker-compose.yml - the two image references, and the "To bump" comment above them, which told the next maintainer to pull :latest from Docker Hub and would now just fail. No version change whatsoever. Rollback: revert this commit. --- docker-compose.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docker-compose.yml b/docker-compose.yml index 738318b64..a3ed5477d 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -3,11 +3,11 @@ # Up: pnpm e2e:minio:up Down: pnpm e2e:minio:down # Env is injected from local-dev/.env.minio by the pnpm scripts (dotenv-cli). # Images are pinned by digest for reproducibility — the exact versions the -# upload-validation gate was verified against. To bump: pull :latest, then -# `docker image inspect minio/minio:latest --format '{{index .RepoDigests 0}}'`. +# upload-validation gate was verified against. To bump: pull the newest tag from +# quay.io, then `docker image inspect quay.io/minio/minio: --format '{{index .RepoDigests 0}}'`. services: minio: - image: minio/minio@sha256:14cea493d9a34af32f524e538b8346cf79f3321eff8e708c1e2960462bd8936e + image: quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z@sha256:14cea493d9a34af32f524e538b8346cf79f3321eff8e708c1e2960462bd8936e command: server /data --console-address ":9001" ports: # Host ports default to 9100/9101 (the upup-reserved pair — validate-env.mjs @@ -26,7 +26,7 @@ services: - upup-minio-data:/data minio-setup: - image: minio/mc@sha256:a7fe349ef4bd8521fb8497f55c6042871b2ae640607cf99d9bede5e9bdf11727 + image: quay.io/minio/mc:RELEASE.2025-08-13T08-35-41Z@sha256:a7fe349ef4bd8521fb8497f55c6042871b2ae640607cf99d9bede5e9bdf11727 depends_on: - minio environment: