fix(deploy): pull MinIO from quay.io - Docker Hub now denies minio/minio and minio/mc - #422
Open
AminDhouib wants to merge 1 commit into
Open
fix(deploy): pull MinIO from quay.io - Docker Hub now denies minio/minio and minio/mc#422AminDhouib wants to merge 1 commit into
AminDhouib wants to merge 1 commit into
Conversation
…nio and minio/mc
Docker Hub has revoked anonymous pull access to the MinIO namespace. An
anonymous manifest GET against registry-1.docker.io returns 401 UNAUTHORIZED
for every tag of minio/minio and minio/mc, including :latest, while the token
endpoint still issues a token for the scope and library/postgres:16-alpine
returns 200 over the identical flow.
docker pull minio/mc:RELEASE.2025-07-21T05-28-08Z
Error response from daemon: pull access denied for minio/mc,
repository does not exist or may require 'docker login'
A digest pin does not help: the digest is resolved through the same denied
repository, so `pnpm e2e:minio:up` fails at the pull exactly like a tag pull
would. The same root cause has been failing every Dokploy deploy of the
BioFlow production compose stack since 2026-09-12T10:43Z.
quay.io, MinIO's other official registry, serves these exact images.
Critically, THE DIGESTS ARE UNCHANGED - the two digests this compose already
pinned are the same two digests quay.io serves, so the upload-validation gate
keeps running the bytes it was verified against:
quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z
sha256:14cea493d9a34af32f524e538b8346cf79f3321eff8e708c1e2960462bd8936e
quay.io/minio/mc:RELEASE.2025-08-13T08-35-41Z
sha256:a7fe349ef4bd8521fb8497f55c6042871b2ae640607cf99d9bede5e9bdf11727
Both were re-fetched from quay.io by digest to confirm they resolve.
The bare digest references also gain their human-readable release tag, so the
file now says which release each digest is, instead of only a hash.
Changed: docker-compose.yml - the two image references, and the "To bump"
comment above them, which told the next maintainer to pull :latest from
Docker Hub and would now just fail.
No version change whatsoever. Rollback: revert this commit.
Review or Edit in CodeSandboxOpen the branch in Web Editor • VS Code • Insiders |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Incident
Docker Hub has revoked anonymous pull access to the MinIO namespace. Every Dokploy deployment of the BioFlow production compose stack has failed since 2026-09-12T10:43Z, within about 4 seconds of
docker compose up --build, at the image pull.This repository's
docker-compose.yml(thepnpm e2e:minio:uplocal storage stack for the upload-validation gate) pins both images by bare digest on Docker Hub. That does not help: the digest is resolved through the same denied repository, so the pull fails exactly as a tag pull would.Evidence
Anonymous manifest
GET https://registry-1.docker.io/v2/<repo>/manifests/<tag>, with a token minted fromauth.docker.iofor the requested scope:minio/miniolatestminio/minioRELEASE.2025-09-07T16-13-09Zminio/mclatestlibrary/postgres16-alpineThe token endpoint still issues a token and
library/postgresstill resolves over the identical anonymous flow, so this is a repository-level access revocation on the MinIO namespace, not a rate limit and not a deleted tag. Confirmed through the Docker daemon:mirror.gcr.iois not an alternative: it is a pull-through cache of Docker Hub and now returns 404MANIFEST_UNKNOWNfor these tags.What changed
The digests do not change. The two digests this compose already pinned are the same two digests quay.io serves, so the upload-validation gate keeps running the exact bytes it was verified against. Only the registry host moves, and each reference gains its human-readable release tag so the file says which release each digest is instead of only a hash:
minio/minio@sha256:14cea493d9a34af32f...quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z@sha256:14cea493d9a34af32f...minio/mc@sha256:a7fe349ef4bd8521fb...quay.io/minio/mc:RELEASE.2025-08-13T08-35-41Z@sha256:a7fe349ef4bd8521fb...Full digests:
sha256:14cea493d9a34af32f524e538b8346cf79f3321eff8e708c1e2960462bd8936eandsha256:a7fe349ef4bd8521fb8497f55c6042871b2ae640607cf99d9bede5e9bdf11727. Both were re-fetched from quay.io by digest to confirm they resolve there.The
To bump:comment above them is also updated: it told the next maintainer to pull:latestfrom Docker Hub and rundocker image inspect minio/minio:latest, which would now simply fail.No version change whatsoever, no port or env changes, nothing else touched.
Validation
docker compose -f docker-compose.yml config— exit 0, both services resolving to the quay references.git ls-files --eolreportsi/lf w/lf).Not changed, deliberately
apps/landing/content/docs/guides/storage/minio.mdx:48showsminio/minio server /datain a self-hosting guide for end users running their own MinIO. It is prose documentation rather than a pull path this repo executes, so it is out of scope for this fix and was left alone. Worth a separate look if the denial turns out to be permanent.Rollback
Revert this commit. That restores the Docker Hub digest references, which will fail to pull until Docker Hub restores anonymous access to the MinIO namespace.