cluster

commit b2b164453d0f033881a2e451eb5b3894855a61c3
parent a62c4e2bcd16b27de17872b6f3507d19506a6978
Author: MTRNord <MTRNord@users.noreply.github.com>
Date:   Sat, 11 Apr 2026 11:42:13 +0200

fix dockerfile

Signed-off-by: MTRNord <MTRNord@users.noreply.github.com>

Diffstat:
M
apps/talos_cluster/continuwuity/Dockerfile
 | 
8
++++++--
M
apps/talos_cluster/image-policies/base-images.yaml
 | 
7
++++++-

2 files changed, 12 insertions(+), 3 deletions(-)
diff --git a/apps/talos_cluster/continuwuity/Dockerfile b/apps/talos_cluster/continuwuity/Dockerfile
@@ -5,8 +5,12 @@ FROM forgejo.ellis.link/continuwuation/continuwuity:main@sha256:070b2f916bef7d54
 
 # Build ldb and sst_dump from the exact RocksDB version continuwuity uses (10.10.1)
 # so MANIFEST format is guaranteed compatible for recovery operations.
+# NOTE: do NOT pin a per-arch digest here. Flux does not report digests in latestRef
+# so any @sha256 pin in this file was manually added. Per-arch digests (from docker
+# inspect on amd64) break multi-platform builds — BuildKit uses the pinned arch for
+# all platforms, causing QEMU to reject amd64 binaries as wrong architecture.
 # {"$imagepolicy": "flux-system:docker-debian-12-slim"}
-FROM debian:12-slim@sha256:13cb01d584d2c23f475c088c168a48f9a08f033a10460572fbfd10912ec5ba7c AS rocksdb-tools-builder
+FROM debian:12-slim AS rocksdb-tools-builder
 RUN apt-get update \
     && apt-get install -y --no-install-recommends \
         build-essential cmake git ca-certificates \
@@ -30,7 +34,7 @@ RUN cmake -B build \
     && cmake --build build --target ldb sst_dump -j$(nproc)
 
 # {"$imagepolicy": "flux-system:docker-debian-12-slim"}
-FROM debian:12-slim@sha256:13cb01d584d2c23f475c088c168a48f9a08f033a10460572fbfd10912ec5ba7c
+FROM debian:12-slim
 # Runtime deps for ldb/sst_dump
 RUN apt-get update \
     && apt-get install -y --no-install-recommends \
diff --git a/apps/talos_cluster/image-policies/base-images.yaml b/apps/talos_cluster/image-policies/base-images.yaml
@@ -23,7 +23,12 @@ spec:
     alphabetical:
       order: desc
 ---
-# Debian image for continuwuity and matrix-backup builder
+# Debian image for continuwuity builder
+# IMPORTANT: Flux's image-reflector-controller runs on amd64 nodes and records the
+# per-arch amd64 manifest digest when scanning Docker Hub. Dockerfiles that use
+# multi-arch builds MUST use the {"$imagepolicy": "...:tag"} marker (tag-only update)
+# and pin the manifest list digest manually — never the full marker which overwrites
+# with an amd64-only digest that breaks linux/arm64 BuildKit builds.
 apiVersion: image.toolkit.fluxcd.io/v1beta2
 kind: ImageRepository
 metadata: