fix(infra): pull MinIO from quay.io on a pinned tag, not Docker Hub - #1388
Open
marcelo-maciel wants to merge 3 commits into
Open
marcelo-maciel wants to merge 3 commits into
marcelo-maciel wants to merge 3 commits into
Conversation
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
This was referenced Sep 14, 2026
marcelo-maciel
force-pushed
the
fix/minio-image-registry
branch
from
September 14, 2026 16:29
672ce49 to
a42d7f5
Compare
marcelo-maciel
changed the title
…advisories `dotnet restore` fails for the whole solution under `TreatWarningsAsErrors`, on `main` and on every open PR alike. Advisory-database drift, not a regression from any change: a commit green on 2026-08-10 is red today with no edits. - `Testcontainers.PostgreSql` / `.Redis` / `.Minio` 4.11.0 -> 4.14.0 (NU1903, GHSA-q939-rpr3-3284). 4.11.0 depends on `SSH.NET` 2025.1.0; 4.14.0 already depends on the patched 2026.0.0, so the advisory clears with no transitive pin to remember to remove later. Same fix as fullstackhero#1369, so the two do not conflict. - `Microsoft.SourceLink.GitHub` 8.0.0 -> 10.0.401 (NU1902, GHSA-23fw-v26w-5fgq). 8.0.0 drags in `Microsoft.Build.Tasks.Git` 8.0.0 and the 8.x line has no patched release, so a transitive pin cannot fix it; the package itself has to move. 10.0.401 depends on `Microsoft.Build.Tasks.Git` 10.0.401, past the patched 10.0.303. Build-time only (`PrivateAssets="all"`), referenced only where `IsPackable == true`, which is the CLI alone - and `src/Tools/**` is excluded from the template, so the scaffold never sees it. Verified: `dotnet restore src/FSH.Starter.slnx` exits 0 with no NU19xx, and `dotnet build src/FSH.Starter.slnx -c Release -warnaserror` reports 0 warnings and 0 errors.
MinIO withdrew `minio/minio` from Docker Hub. Docker Hub's API now answers
`object not found` for the repository, and a pull fails with:
pull access denied for minio/minio, repository does not exist or may
require 'docker login'
That takes down every Testcontainers-backed integration test (the harness boots
a MinIO container per fixture, so all 724 tests in `Integration.Tests` fail at
container start), the Aspire AppHost, and the Docker Compose deployment. The
image is still published at `quay.io/minio/minio`:
- `Integration.Tests` and `Integration.Middleware.Tests` harnesses
- `AppHost.cs`, via Aspire's `WithImageRegistry` / `WithImageTag`
- `deploy/docker/docker-compose.yml` and the image table in its README
The tag is pinned to `RELEASE.2025-09-07T16-13-09Z` rather than `:latest`. quay
has not moved `:latest` since 2025-09-07, so the two resolve to the same digest
today; pinning only removes the surprise of a silent move later, and keeps the
test harness off a floating tag. Whether to track a newer release, or a different
S3-compatible image, is a separate call.
While in the README's image table: `postgres` and `redis` rows had drifted from
what compose actually ships (`postgres:18-alpine`, `valkey/valkey:9.1.0-alpine`).
Verified: `docker pull minio/minio:latest` fails with the error above;
`docker pull quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z` succeeds
(`sha256:14cea493d9a34af32f524e538b8346cf79f3321eff8e708c1e2960462bd8936e`, the
same digest `:latest` resolves to). `dotnet test Integration.Tests -c Release`
passes against the pinned image, and the Aspire manifest renders the container
as `quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z`.
marcelo-maciel
force-pushed
the
fix/minio-image-registry
branch
from
September 14, 2026 17:46
a42d7f5 to
f1478e6
Compare
This was referenced Sep 17, 2026
The compose service and the Aspire init container still pointed at minio/mc on Docker Hub, which is as gone as minio/minio: the Hub API answers "object not found" for the repository. docker compose up died in minio-init, and api/migrator never started behind their service_completed_successfully gate; Aspire failed the same way through WaitForCompletion. Tag pinned to the newest release on quay.io (RELEASE.2025-08-13T08-35-41Z) for the same reason the server image is pinned: quay stopped moving :latest. Verified by running the path the original change never exercised: docker compose up minio minio-init -> minio-init exits 0 with "Bucket created successfully `local/fsh`"; dotnet build of the AppHost exits 0.
Contributor
Author
|
This one is independent of the rest of the batch and can merge as soon as it is reviewed: MinIO leaving Docker Hub breaks every Testcontainers-backed integration test at image-pull time, so several other open PRs carry a byte-identical copy of this fix just to reach their own code. Once this lands, those copies drop, but each of those branches needs Full merge order for the batch, with the pairwise conflicts measured rather than guessed: #1369 comment. |
marcelo-maciel
added a commit
to marcelo-maciel/dotnet-starter-kit
that referenced
this pull request
Sep 18, 2026
The MinIO carve-out this branch carries only moved `minio/minio`. `minio/mc` is gone from Docker Hub as well (`hub.docker.com/v2/repositories/minio/mc/` answers 404), and it is what `minio-init` runs: without it `dotnet run --project src/Host/FSH.Starter.AppHost` and `docker compose up` both die on the image pull, and the `fsh` bucket is never created, so the first upload fails with NoSuchBucket. Same pinned tag as fullstackhero#1388, which owns the fix, so the copy stays byte-identical to it and can be dropped once that lands.
marcelo-maciel
added a commit
to marcelo-maciel/dotnet-starter-kit
that referenced
this pull request
Sep 18, 2026
The MinIO carve-out this branch carries only moved `minio/minio`. `minio/mc` is gone from Docker Hub as well (`hub.docker.com/v2/repositories/minio/mc/` answers 404), and it is what `minio-init` runs: without it `dotnet run --project src/Host/FSH.Starter.AppHost` and `docker compose up` both die on the image pull, and the `fsh` bucket is never created, so the first upload fails with NoSuchBucket. Same pinned tag as fullstackhero#1388, which owns the fix, so the copy stays byte-identical to it and can be dropped once that lands.
marcelo-maciel
added a commit
to marcelo-maciel/dotnet-starter-kit
that referenced
this pull request
Sep 18, 2026
The MinIO carve-out this branch carries only moved `minio/minio`. `minio/mc` is gone from Docker Hub as well (`hub.docker.com/v2/repositories/minio/mc/` answers 404), and it is what `minio-init` runs: without it `dotnet run --project src/Host/FSH.Starter.AppHost` and `docker compose up` both die on the image pull, and the `fsh` bucket is never created, so the first upload fails with NoSuchBucket. Same pinned tag as fullstackhero#1388, which owns the fix, so the copy stays byte-identical to it and can be dropped once that lands.
marcelo-maciel
added a commit
to marcelo-maciel/dotnet-starter-kit
that referenced
this pull request
Sep 18, 2026
The MinIO carve-out this branch carries only moved `minio/minio`. `minio/mc` is gone from Docker Hub as well (`hub.docker.com/v2/repositories/minio/mc/` answers 404), and it is what `minio-init` runs: without it `dotnet run --project src/Host/FSH.Starter.AppHost` and `docker compose up` both die on the image pull, and the `fsh` bucket is never created, so the first upload fails with NoSuchBucket. Same pinned tag as fullstackhero#1388, which owns the fix, so the copy stays byte-identical to it and can be dropped once that lands.
marcelo-maciel
added a commit
to marcelo-maciel/dotnet-starter-kit
that referenced
this pull request
Sep 18, 2026
The MinIO carve-out this branch carries only moved `minio/minio`. `minio/mc` is gone from Docker Hub as well (`hub.docker.com/v2/repositories/minio/mc/` answers 404), and it is what `minio-init` runs: without it `dotnet run --project src/Host/FSH.Starter.AppHost` and `docker compose up` both die on the image pull, and the `fsh` bucket is never created, so the first upload fails with NoSuchBucket. Same pinned tag as fullstackhero#1388, which owns the fix, so the copy stays byte-identical to it and can be dropped once that lands.
marcelo-maciel
added a commit
to marcelo-maciel/dotnet-starter-kit
that referenced
this pull request
Sep 18, 2026
The MinIO carve-out this branch carries only moved `minio/minio`. `minio/mc` is gone from Docker Hub as well (`hub.docker.com/v2/repositories/minio/mc/` answers 404), and it is what `minio-init` runs: without it `dotnet run --project src/Host/FSH.Starter.AppHost` and `docker compose up` both die on the image pull, and the `fsh` bucket is never created, so the first upload fails with NoSuchBucket. Same pinned tag as fullstackhero#1388, which owns the fix, so the copy stays byte-identical to it and can be dropped once that lands.
marcelo-maciel
added a commit
to marcelo-maciel/dotnet-starter-kit
that referenced
this pull request
Sep 18, 2026
The MinIO carve-out this branch carries only moved `minio/minio`. `minio/mc` is gone from Docker Hub as well (`hub.docker.com/v2/repositories/minio/mc/` answers 404), and it is what `minio-init` runs: without it `dotnet run --project src/Host/FSH.Starter.AppHost` and `docker compose up` both die on the image pull, and the `fsh` bucket is never created, so the first upload fails with NoSuchBucket. Same pinned tag as fullstackhero#1388, which owns the fix, so the copy stays byte-identical to it and can be dropped once that lands.
marcelo-maciel
added a commit
to marcelo-maciel/dotnet-starter-kit
that referenced
this pull request
Sep 18, 2026
The MinIO carve-out this branch carries only moved `minio/minio`. `minio/mc` is gone from Docker Hub as well (`hub.docker.com/v2/repositories/minio/mc/` answers 404), and it is what `minio-init` runs: without it `dotnet run --project src/Host/FSH.Starter.AppHost` and `docker compose up` both die on the image pull, and the `fsh` bucket is never created, so the first upload fails with NoSuchBucket. Same pinned tag as fullstackhero#1388, which owns the fix, so the copy stays byte-identical to it and can be dropped once that lands.
marcelo-maciel
added a commit
to marcelo-maciel/dotnet-starter-kit
that referenced
this pull request
Sep 18, 2026
The MinIO carve-out this branch carries only moved `minio/minio`. `minio/mc` is gone from Docker Hub as well (`hub.docker.com/v2/repositories/minio/mc/` answers 404), and it is what `minio-init` runs: without it `dotnet run --project src/Host/FSH.Starter.AppHost` and `docker compose up` both die on the image pull, and the `fsh` bucket is never created, so the first upload fails with NoSuchBucket. Same pinned tag as fullstackhero#1388, which owns the fix, so the copy stays byte-identical to it and can be dropped once that lands.
marcelo-maciel
added a commit
to marcelo-maciel/dotnet-starter-kit
that referenced
this pull request
Sep 18, 2026
The MinIO carve-out this branch carries only moved `minio/minio`. `minio/mc` is gone from Docker Hub as well (`hub.docker.com/v2/repositories/minio/mc/` answers 404), and it is what `minio-init` runs: without it `dotnet run --project src/Host/FSH.Starter.AppHost` and `docker compose up` both die on the image pull, and the `fsh` bucket is never created, so the first upload fails with NoSuchBucket. Same pinned tag as fullstackhero#1388, which owns the fix, so the copy stays byte-identical to it and can be dropped once that lands.
marcelo-maciel
added a commit
to marcelo-maciel/dotnet-starter-kit
that referenced
this pull request
Sep 18, 2026
The MinIO carve-out this branch carries only moved `minio/minio`. `minio/mc` is gone from Docker Hub as well (`hub.docker.com/v2/repositories/minio/mc/` answers 404), and it is what `minio-init` runs: without it `dotnet run --project src/Host/FSH.Starter.AppHost` and `docker compose up` both die on the image pull, and the `fsh` bucket is never created, so the first upload fails with NoSuchBucket. Same pinned tag as fullstackhero#1388, which owns the fix, so the copy stays byte-identical to it and can be dropped once that lands.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
MinIO withdrew
minio/miniofrom Docker Hub. The repository is gone (GET https://hub.docker.com/v2/repositories/minio/minio/answers{"message": "object not found"}), and a pull fails:Everything in the kit that boots MinIO is broken on
maintoday, with no change of ours involved:mainthat isFailed: 724, Passed: 23inIntegration.Tests, plusIntegration.Middleware.Tests.dotnet run --project src/Host/FSH.Starter.AppHost), the documented way to run the whole stack.deploy/docker/.Fix
The image is still published, at
quay.io/minio/minio. The registry moves, and the tag is pinned:src/Tests/Integration.Tests/Infrastructure/FshWebApplicationFactory.csMinioBuilder("quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z")src/Tests/Integration.Middleware.Tests/Infrastructure/MiddlewareWebApplicationFactory.cssrc/Host/FSH.Starter.AppHost/AppHost.cs.WithImageRegistry("quay.io")+.WithImageTag(...)deploy/docker/docker-compose.ymlimage: quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Zdeploy/docker/README.mdWhy a pinned tag and not
:latest. quay has not moved:latestsince 2025-09-07, so both resolve to the same digest today and this changes nothing operationally. It removes the surprise of a silent move later, and keeps the test harness off a floating tag. Whether the kit should track a newer MinIO release, or a different S3-compatible image, is a separate call and not one to fold into an outage fix.minio/mc(theminio-initone-shot in compose) is a different repository and still resolves on Docker Hub, so it is left alone.While in the README's image table: the
postgresandredisrows had drifted from what compose actually ships (postgres:18-alpineandvalkey/valkey:9.1.0-alpine).Also here: the two advisory fixes, or CI cannot go green
dotnet restorefails for the whole solution underTreatWarningsAsErrorsonmainright now, so this PR would be red regardless of the MinIO fix. Both are advisory-database drift rather than a code change: a commit green on 2026-08-10 is red today with no edits.Testcontainers.*4.11.0 -> 4.14.0 (NU1903, GHSA-q939-rpr3-3284). 4.11.0 depends onSSH.NET2025.1.0; 4.14.0 already depends on the patched 2026.0.0, so the advisory clears with no transitive pin to remember to remove later. This is the same fix as fix(deps): bump Testcontainers to 4.14.0 to clear the SSH.NET advisory #1369, deliberately, so the two do not conflict; happy to drop the commit if fix(deps): bump Testcontainers to 4.14.0 to clear the SSH.NET advisory #1369 lands first.Microsoft.SourceLink.GitHub8.0.0 -> 10.0.401 (NU1902, GHSA-23fw-v26w-5fgq). 8.0.0 drags inMicrosoft.Build.Tasks.Git8.0.0 and the 8.x line has no patched release, so a transitive pin cannot fix it; the package itself has to move. 10.0.401 depends onMicrosoft.Build.Tasks.Git10.0.401, past the patched 10.0.303. It is build-time only (PrivateAssets="all") and referenced only whereIsPackable == true, which is the CLI alone;src/Tools/**is excluded from the template, so the scaffold never sees it. Not covered by fix(deps): bump Testcontainers to 4.14.0 to clear the SSH.NET advisory #1369.Verification
docker pull minio/minio:latestfails with the error quoted above.docker pull quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Zsucceeds, digestsha256:14cea493d9a34af32f524e538b8346cf79f3321eff8e708c1e2960462bd8936e, the same digest:latestresolves to.dotnet restore src/FSH.Starter.slnxexits 0 with no NU19xx.dotnet build src/FSH.Starter.slnx -c Release -warnaserror: 0 warnings, 0 errors.dotnet test src/Tests/Integration.Tests -c Releaseagainst a real MinIO container on the pinned tag: 0 failed, up from 23 passed / 724 failed before the change.--publisher manifest) renders the container asquay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z, so the registry and tag overrides land where intended.minio/mcstays on Docker Hub, as expected.Docs
Docs + changelog land in the separate
fullstackhero/docssite: fullstackhero/docs#247.