Switch container publish from Kaniko to Buildah (amd64 only) #45

New issue

Closed

opened 2026-06-12 02:25:31 +00:00 by coding-agent-marvin8 · 2 comments

coding-agent-marvin8 commented

2026-06-12 02:25:31 +00:00

(Migrated from codeberg.org)

The CI container publish step has been failing with a Kaniko HTTP/2 stream error against codeberg.org's registry:

stream error: stream ID 3; CANCEL; received from peer

The error occurs during Kaniko's pre-flight push-permission check, before any build work starts. Adding push_retry has no effect at this stage. Kaniko's registry client uses HTTP/2 and there is no way to force HTTP/1.1 through the Woodpecker plugin settings.

Buildah is the standard non-privileged alternative. It uses HTTP/1.1 for registry communication by default and can run without a Docker daemon using --isolation=chroot. Multi-platform (arm64) builds are dropped; amd64 only.

The CI container publish step has been failing with a Kaniko HTTP/2 stream error against codeberg.org's registry: stream error: stream ID 3; CANCEL; received from peer The error occurs during Kaniko's pre-flight push-permission check, before any build work starts. Adding push_retry has no effect at this stage. Kaniko's registry client uses HTTP/2 and there is no way to force HTTP/1.1 through the Woodpecker plugin settings. Buildah is the standard non-privileged alternative. It uses HTTP/1.1 for registry communication by default and can run without a Docker daemon using --isolation=chroot. Multi-platform (arm64) builds are dropped; amd64 only.

coding-agent-marvin8 commented

2026-06-12 02:25:43 +00:00

(Migrated from codeberg.org)

Plan of attack

Replace woodpeckerci/plugin-kaniko with quay.io/buildah/stable in .woodpecker/docker-publish.yaml
Drop platforms: — amd64 only, matching the CI runner
--isolation=chroot avoids needing privileged mode; --storage-driver=vfs avoids overlay fs requirements
Re-implement auto_tag in shell: parse CI_COMMIT_TAG (e.g. 3.7.1) into 3.7.1, 3.7, 3, and latest tags
Login via buildah login with existing docker_username/docker_password secrets

Branch: fix/issue-45-buildah-publish

**Plan of attack** - Replace `woodpeckerci/plugin-kaniko` with `quay.io/buildah/stable` in `.woodpecker/docker-publish.yaml` - Drop `platforms:` — amd64 only, matching the CI runner - `--isolation=chroot` avoids needing privileged mode; `--storage-driver=vfs` avoids overlay fs requirements - Re-implement `auto_tag` in shell: parse `CI_COMMIT_TAG` (e.g. `3.7.1`) into `3.7.1`, `3.7`, `3`, and `latest` tags - Login via `buildah login` with existing `docker_username`/`docker_password` secrets Branch: `fix/issue-45-buildah-publish`

coding-agent-marvin8 commented

2026-06-12 04:25:02 +00:00

(Migrated from codeberg.org)

Change of direction

After working through Kaniko HTTP/2 CANCEL errors, Buildah blocked by missing user-namespace support on Codeberg's runners, and Woodpecker plugin/environment schema conflicts, CI-based container publishing has been abandoned on this PR.

Instead, container publishing is moving to a local just publish-container recipe in the justfile. This fits the existing manual release workflow (just release) and removes all CI registry secrets and workarounds. The dry-run Containerfile build check in checks.yml is kept so CI still catches a broken Containerfile on PRs.

**Change of direction** After working through Kaniko HTTP/2 CANCEL errors, Buildah blocked by missing user-namespace support on Codeberg's runners, and Woodpecker plugin/environment schema conflicts, CI-based container publishing has been abandoned on this PR. Instead, container publishing is moving to a local `just publish-container` recipe in the justfile. This fits the existing manual release workflow (`just release`) and removes all CI registry secrets and workarounds. The dry-run Containerfile build check in `checks.yml` is kept so CI still catches a broken `Containerfile` on PRs.