mward4/MusicBot
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

publish: force gzip on every layer so no blob exceeds Cloudflare's 100 MB

Browse Source 
bitnami/minideb ships its base layer as an uncompressed 133 MB tar; with
the containerd image store docker push sends it as-is and Cloudflare in
front of Gitea answers 413. Build with force-compression=true (base layer
becomes ~43 MB) and document why.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
This commit is contained in:
Miles WardandClaude Fable 5.1 committed 2026-09-17 19:27:05 -04:00
1 parent 557eee9a06
commit a9f3f7acb0
2 files changed
+20 -5
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

docs/PUBLISHING.md
+12 -4
View File
@@ -86,12 +86,20 @@ natives.
The Maven stage runs on the builder's native architecture (the JAR is
architecture-neutral), so only the jlink and runtime stages run under
emulation when building `linux/amd64` on Apple Silicon.
`--provenance=false --sbom=false` matters: Unraid's Docker cannot load the
attestation manifests BuildKit attaches by default.
emulation when building `linux/amd64` on Apple Silicon. Two flags matter:
- `--provenance=false --sbom=false`: Unraid's Docker cannot load the
attestation manifests BuildKit attaches by default.
- `--output type=docker,compression=gzip,force-compression=true`:
`bitnami/minideb` publishes its base layer as an **uncompressed 133 MB
tar**. A daemon using the containerd image store pushes blobs exactly as
stored, and Gitea sits behind Cloudflare, which rejects any request body
over 100 MB with `413 Payload Too Large`. Forcing gzip on every layer takes
that one to about 43 MB; the JAR layer (61 MB) and the JRE layer (41 MB) are
already under the limit.
```bash
docker build --pull --platform linux/amd64 --provenance=false --sbom=false --build-arg "GIT_SHA=$(git rev-parse HEAD)" --build-arg VERSION=0.7.1 --build-arg "BUILD_TIMESTAMP=$(git log -1 --format=%cI)" -t gitea.milesward.dev/mward4/musicbot:0.7.1 -t gitea.milesward.dev/mward4/musicbot:latest .
docker buildx build --pull --platform linux/amd64 --provenance=false --sbom=false --build-arg "GIT_SHA=$(git rev-parse HEAD)" --build-arg VERSION=0.7.1 --build-arg "BUILD_TIMESTAMP=$(git log -1 --format=%cI)" -t gitea.milesward.dev/mward4/musicbot:0.7.1 -t gitea.milesward.dev/mward4/musicbot:latest --output type=docker,compression=gzip,force-compression=true .
```
Smoke test: an empty, writable data directory must produce a `config.txt` and
scripts/build-and-publish-unraid.sh
+8 -1
View File
@@ -109,7 +109,13 @@ COMMIT_TIME="$(git log -1 --format=%cI)"
# architecture-neutral); only the jlink and runtime stages run under emulation
# when cross-building linux/amd64 on an arm64 host. BUILD_TIMESTAMP pins the
# JAR's reproducible-build timestamp to the commit, as upstream's CI does.
docker build \
#
# force-compression matters: bitnami/minideb publishes its base layer as an
# UNCOMPRESSED 133 MB tar, a daemon with the containerd image store pushes
# blobs exactly as stored, and Gitea sits behind Cloudflare, which rejects any
# request body over 100 MB with a 413. Recompressing every layer with gzip
# brings that layer to ~43 MB; no layer of this image is then over 100 MB.
docker buildx build \
--pull \
--platform "$PLATFORM" \
--provenance=false --sbom=false \
@@ -118,6 +124,7 @@ docker build \
--build-arg "BUILD_TIMESTAMP=$COMMIT_TIME" \
--tag "$FULL_TAG" \
--tag "$LATEST_TAG" \
--output type=docker,compression=gzip,force-compression=true \
.
# Step 3: registry auth, written straight into the private config (see above).