Stop using images from Docker Hub in CI

[felixfontein]

Docker Hub's rate limits make CI fail from time to time, see for example https://github.com/getsops/sops/actions/runs/11560893288/attempts/1.

[felixfontein]

@getsops/maintainers what do you think about creating another repository and pushing the images we need into that repository's package registry? (We could also push them into the package registry associated with this repository, but that doesn't look great. I've done that in another project and now it looks like the test images there are similar to release artifacts...)

[onedr0p]

I would totally be fine with deprecating pushing to dockerhub and continue using ghcr instead.

[felixfontein]

I don't mean the releases, just the Docker images we use in the CI tests: docker.io/nsmithuk/local-kms (https://github.com/getsops/sops/blob/main/kms/keysource_test.go#L36) and vault (https://github.com/getsops/sops/blob/main/hcvault/keysource_test.go#L44)

[felixfontein]

(I don't think we publish SOPS versions to Docker Hub anyway, from https://github.com/getsops/sops/blob/main/.goreleaser.yaml#L144-L257 it seems we publish images to GHCR and Quay.io. The GHCR images are here: https://github.com/getsops/sops/pkgs/container/sops and the Quay.io images are here: https://quay.io/repository/getsops/sops?tab=tags&tag=latest)

[onedr0p]

Ah, sorry. I believe we can use the following instead?

https://gallery.ecr.aws/nsmithuk/local-kms
https://gallery.ecr.aws/hashicorp/vault

[felixfontein]

Well, that didn't help: 2024/12/24 19:55:21 could not start resource: toomanyrequests: Rate exceeded

I guess GHCR is our best bet.

[sabre1041]

@felixfontein for images that are currently hosted on Docker Hub, would it make sense to add a sync job and source it from GHCR?

[felixfontein]

@sabre1041 that's basically what I would do. I'd create a repository https://github.com/getsops/ci-container-images for that (or something like that) and set up a workflow there that does the mirroring and pushes the images to that repository's container registry.

[onedr0p]

@felixfontein I've done something like that in the past. Take a look here. https://github.com/onedr0p/containers-mirror

[felixfontein]

I created https://github.com/getsops/ci-container-images and set up basic mirroring for the images we need, and created #1722 to use them.