push ghcr.io/coilysiren/repo-recall-api + ghcr.io/coilysiren/repo-recall-web to Docker Hub as a mirror #82

New issue

Closed

opened 2026-05-26 05:20:15 +00:00 by coilysiren · 1 comment

coilysiren commented

2026-05-26 05:20:15 +00:00

Owner

Problem

We currently push both repo-recall-api and repo-recall-web images to ghcr.io only. Add a parallel docker push to Docker Hub under the same short ref (docker.io/coilysiren/<image>) so the image resolves for pulls without a ghcr login.

Notes

Mirror, not source of truth. The load-bearing image registry is the k3s nodes' local pulled-image state on kai-server. ghcr.io stays primary; Docker Hub is a courtesy mirror.
Auth: Docker Hub PAT for the coilysiren user lives at /coilysiren/dockerhub/access-token (SSM SecureString). docker login -u coilysiren --password-stdin in CI, never ~/.docker/config.json plaintext.
Pattern: add docker.io/coilysiren/<image> alongside the existing ghcr.io/coilysiren/<image> tag in the build-and-publish workflow. Tag and push both refs with the same SHA pin.
lunch-money-k8s already does this. Crib from coilysiren/lunch-money-k8s/.github/workflows/docker.yml.

Pre-reqs

GitHub Actions secrets DOCKERHUB_USERNAME=coilysiren and DOCKERHUB_TOKEN=<value from SSM> on this repo.

**Problem** We currently push both repo-recall-api and repo-recall-web images to ghcr.io only. Add a parallel `docker push` to Docker Hub under the same short ref (`docker.io/coilysiren/<image>`) so the image resolves for pulls without a ghcr login. **Notes** - Mirror, not source of truth. The load-bearing image registry is the k3s nodes' local pulled-image state on `kai-server`. ghcr.io stays primary; Docker Hub is a courtesy mirror. - Auth: Docker Hub PAT for the `coilysiren` user lives at `/coilysiren/dockerhub/access-token` (SSM SecureString). `docker login -u coilysiren --password-stdin` in CI, never `~/.docker/config.json` plaintext. - Pattern: add `docker.io/coilysiren/<image>` alongside the existing `ghcr.io/coilysiren/<image>` tag in the build-and-publish workflow. Tag and push both refs with the same SHA pin. - `lunch-money-k8s` already does this. Crib from `coilysiren/lunch-money-k8s/.github/workflows/docker.yml`. **Pre-reqs** - GitHub Actions secrets `DOCKERHUB_USERNAME=coilysiren` and `DOCKERHUB_TOKEN=<value from SSM>` on this repo.

coilysiren commented

2026-05-30 05:43:50 +00:00

Author

Owner

Iceboxed in the 2026-05-29 backlog burn-down: Docker Hub courtesy mirror, ghcr stays primary; low priority. Reopen anytime if it becomes real.

coilysiren

2026-05-30 05:43:50 +00:00