Pull minio from docker.io/cortexproject instead of quay.io - #7864
Merged
CharlieTLe merged 1 commit intoSep 25, 2026
Merged
Conversation
Every integration leg is failing at Preload Images: docker pull quay.io/minio/minio:RELEASE.2024-05-28T17-19-04Z Error response from daemon: unauthorized: access to the requested resource is not authorized MinIO has withdrawn its public images from quay.io, after doing the same on Docker Hub (which is why cortexproject#7837 moved us to quay.io). No mirror still serves the multi-arch RELEASE.2024-05-28T17-19-04Z image. Host an unmodified copy of MinIO's official RELEASE.2024-07-04T14-25-45Z image under docker.io/cortexproject/minio. It was copied with `crane copy`, so its index digest, sha256:5db7e40b69f0c3ad5a878521ff5029468e3070ef146c084dc2540e2d492075c4, is identical to the source and it keeps linux/amd64 and linux/arm64. Its binary reports the commit behind MinIO's signed release tag, and its SLSA provenance records a build of github.com/minio/minio from MinIO's own release commit. The image runs as root like the previous one, so the e2e harness works unchanged. The development docker-compose stacks previously pulled the untagged (latest) image; pin them to the same tag, since that is the only tag we host. Signed-off-by: Charlie Le <charlie_le@apple.com>
friedrichg
approved these changes
Sep 25, 2026
CharlieTLe
added a commit
that referenced
this pull request
Sep 25, 2026
Backports to release-1.22 for v1.22.0-rc.2: * Ingester: fix cortex_ingester_ingestion_delay_seconds losing most observations (#7858) * Pull minio from docker.io/cortexproject instead of quay.io (#7864) Co-authored-by: SungJin1212 <tjdwls1201@gmail.com> Signed-off-by: Charlie Le <charlie_le@apple.com>
CharlieTLe
added a commit
that referenced
this pull request
Sep 25, 2026
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Every integration leg on master and on open PRs is failing at Preload Images, before any test runs:
MinIO has withdrawn its public images from quay.io, after doing the same on Docker Hub (which is why #7837 moved us to quay.io). Last green integration run was 2026-09-24 07:29 UTC; first failure 2026-09-25 04:50 UTC. No registry I could reach (quay.io, Docker Hub, mirror.gcr.io, ghcr.io, ECR Public) still serves the multi-arch
RELEASE.2024-05-28T17-19-04Zimage.Change
Point the integration tests, the CI preload step and the three development
docker-composestacks atdocker.io/cortexproject/minio:RELEASE.2024-07-04T14-25-45Z, an unmodified copy of MinIO's official image now hosted in the project's own Docker Hub namespace.The
docker-composestacks used the untagged (latest) image; they are pinned to the same tag, since it is the only one we host.Provenance of the hosted image
Copied with
crane copyfrom an ECR Public mirror ofquay.io/minio/minio, so the index is byte-identical to the source:sha256:5db7e40b69f0c3ad5a878521ff5029468e3070ef146c084dc2540e2d492075c4sha256:2df94bd88de97f069f9cff76cea9751623de554800bd9ed80de147a5075b2e65sha256:429f9e43c577fc3309de27132c2005390a70b15363f9e2ea65ed5ea90e3ed6cbWhy it is MinIO's own build and not a rebuild:
minio --versionreports commit107d951893c3, the commit behind MinIO's GPG-verified release tagRELEASE.2024-07-04T14-25-45Z.github.com/minio/miniousingDockerfile.releaseatcf371da34619, MinIO's release-bot commit on top of that tag.The one check not done: comparing the binary against the checksums on dl.min.io, which was unreachable.
Version
This moves MinIO from
RELEASE.2024-05-28T17-19-04ZtoRELEASE.2024-07-04T14-25-45Z. The new image runs as root like the old one, so the e2e harness needs no change. Locally, againstrelease-1.22test code and the publishedv1.22.0-rc.1image, these pass:TestGettingStartedSingleProcessConfigWithBlocksStorage,TestGettingStartedWithGossipedRing,TestIngesterSharding,TestLoadRuntimeConfigFromStorageBackend,TestQueryFrontendWithVerticalSharding. This PR's CI runs the full suite on amd64 and arm64.This also blocks
v1.22.0-rc.2: its backport PR (#7863) cannot pass integration until this is cherry-picked there.