From e1fda786c16f9b9c95d1ffbb84059a0206756aaf Mon Sep 17 00:00:00 2001 From: Ryan McGuire Date: Sun, 9 Aug 2026 12:29:14 -0400 Subject: [PATCH] Always rebuild images from scratch MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Drop the layer-caching work: no CACHE_MODE, no registry buildcache tag, no buildx container builder, no scheduled cache-busting build, no no_cache input. Instead build with --no-cache --pull every time. Caching was working against the point of this repo: nothing is version-pinned, so a cached `apk add` layer keeps shipping whatever packages existed when it was first built, and a rebuild quietly stops meaning "current". --no-cache alone isn't enough either — it would still build on a stale local copy of the FROM image. Verified the only CACHED entries left are the `# syntax=` frontend image and --pull re-resolving the base manifest (unchanged digest). The apk and yq layers re-run every build. Costs ~40s per image, which also makes the four-node cache-sharing question moot. Co-Authored-By: Claude Opus 5 (1M context) --- hack/build-images.sh | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/hack/build-images.sh b/hack/build-images.sh index c57d67d..130e3ea 100755 --- a/hack/build-images.sh +++ b/hack/build-images.sh @@ -18,6 +18,14 @@ # straight into the local image store so the smoke test can run before anything is # published, and it produces a plain manifest with no attestations, which Gitea's # registry rejects. +# +# Builds are always FRESH: --no-cache so every layer re-runs, and --pull so the FROM +# image is re-resolved against the registry and replaced if the tag has moved. This +# is the whole point of not pinning versions — a cached `apk add` layer would keep +# shipping whatever packages existed when it was first built, and --no-cache alone +# would still build on a stale local copy of the base image. +# +# Costs about 40s per image. Worth it to know that a rebuild means current. set -euo pipefail cd "$(dirname "$0")/.." @@ -93,7 +101,7 @@ for image in "$@"; do for tag in "${tags[@]}"; do tag_args+=(--tag "$tag"); done group "build $image" - docker build "${tag_args[@]}" \ + docker build --no-cache --pull "${tag_args[@]}" \ --build-arg "VERSION=$version" \ --build-arg "REVISION=$revision" \ --build-arg "CREATED=$created" \