julien/apf_portal
1
0
Fork 0
Code Issues 1 Pull Requests Actions 1 Packages Projects Releases Wiki Activity

chore(infra): pin act_runner image pull policy #10

Merged
julien merged 1 commits from chore/infra/runner-image-pull-policy into main 2026-05-04 15:55:17 +02:00
Conversation 0 Commits 1 Files Changed 3
+65 -3
julien commented 2026-05-04 15:55:00 +02:00
Owner
Copy Link
Copy Source

Summary

act_runner's default container.force_pull: true re-issues a docker pull at the start of every job, adding 10–30 s of registry round-trip even when every layer is already locally cached. With job images pinned to specific tags (catthehacker/ubuntu:act-22.04 and :full-22.04), the implicit pull is pure overhead and contradicts the deliberate-upgrade policy ADR-0015 spells out for the runner image.

  • Add infra/runner-config.yaml with container.force_pull: false.
  • Mount it read-only into all three runners and point each at it via CONFIG_FILE=/etc/runner/config.yaml.
  • Document the pre-pull procedure and image-upgrade playbook in infra/README.md → "Job image pinning and pre-pull".
  • Fold the pre-pull into the "First-time registration" walkthrough so a fresh setup is correct end-to-end.

The trade-off: the runner host must hold the images locally before the runner is asked to use them. Documented.

Roll-out (manual, on the runner host)

cd infra/

# 1. Pre-pull the job images (one-shot — pays the cold cost once).
docker pull catthehacker/ubuntu:act-22.04
docker pull catthehacker/ubuntu:full-22.04

# 2. Recreate the runners so the new mount + env var take effect.
docker compose -f ci-runners.compose.yml up -d --force-recreate
## Summary `act_runner`'s default `container.force_pull: true` re-issues a `docker pull` at the start of every job, adding 10–30 s of registry round-trip even when every layer is already locally cached. With job images pinned to specific tags (`catthehacker/ubuntu:act-22.04` and `:full-22.04`), the implicit pull is pure overhead and contradicts the deliberate-upgrade policy ADR-0015 spells out for the runner image. - Add `infra/runner-config.yaml` with `container.force_pull: false`. - Mount it read-only into all three runners and point each at it via `CONFIG_FILE=/etc/runner/config.yaml`. - Document the pre-pull procedure and image-upgrade playbook in `infra/README.md` → "Job image pinning and pre-pull". - Fold the pre-pull into the "First-time registration" walkthrough so a fresh setup is correct end-to-end. The trade-off: the runner host must hold the images locally before the runner is asked to use them. Documented. ## Roll-out (manual, on the runner host) ```bash cd infra/ # 1. Pre-pull the job images (one-shot — pays the cold cost once). docker pull catthehacker/ubuntu:act-22.04 docker pull catthehacker/ubuntu:full-22.04 # 2. Recreate the runners so the new mount + env var take effect. docker compose -f ci-runners.compose.yml up -d --force-recreate
julien added 1 commit 2026-05-04 15:55:00 +02:00
chore(infra): pin act_runner image pull policy
CI / commits (pull_request) Successful in 1m22s
Details
CI / check (pull_request) Successful in 1m29s
Details
CI / scan (pull_request) Failing after 1m32s
Details
CI / a11y (pull_request) Successful in 1m35s
Details
CI / perf (pull_request) Successful in 2m55s
Details
4934fc29da 
`act_runner`'s default `container.force_pull: true` re-issues a
`docker pull` at the start of every job, adding 10-30 s of registry
round-trip per job even when every layer is already locally cached.
The job images are already pinned to specific tags (catthehacker
ubuntu :act-22.04 + :full-22.04), so the implicit pull is both pure
overhead and contradictory with the deliberate-upgrade policy
ADR-0015 spells out for the runner image itself.

Mount a shared `infra/runner-config.yaml` into all three runners
with `force_pull: false`, point each runner at it via the
`CONFIG_FILE` env var, and document the pre-pull procedure (one-shot
`docker pull` on the runner host, plus the upgrade playbook) in
infra/README.md "Job image pinning and pre-pull".

The pre-pull is also folded into the "First-time registration"
walkthrough so a fresh setup is correct end-to-end.
julien merged commit efa660abab into main 2026-05-04 15:55:17 +02:00
julien deleted branch chore/infra/runner-image-pull-policy 2026-05-04 15:55:20 +02:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adastra-bot (AdAstra Bot) julien (Julien Gautier)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: julien/apf_portal#10
Delete Branch "chore/infra/runner-image-pull-policy"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?