Conversation
…limit Signed-off-by: Jonas Toelke <jtoelke@nvidia.com>
pimlock
approved these changes
Apr 24, 2026
jtoelke2
added a commit
that referenced
this pull request
Apr 24, 2026
#966 hard-coded `buildkitd-config: /etc/buildkit/buildkitd.toml` inside the `driver: local` branch of the setup-buildx composite action. The only caller using that driver is shadow-docker-build.yml, which runs inside the ghcr.io/nvidia/openshell/ci:latest container — so the host-side buildkitd.toml was invisible to docker/setup-buildx-action and every matrix job failed at "Set up buildx". Revert the hard-coded path and expose it as an opt-in input on the action (empty default, passed through to both the remote and local branches). Wire shadow-docker-build.yml to bind-mount /etc/buildkit into the ci container and pass the path explicitly, so the action can read the file from inside the container. Remote-driver callers are unaffected (empty input is a no-op). Signed-off-by: Jonas Toelke <jtoelke@nvidia.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
First dispatch of
shadow-docker-build(run 24908165293) hit Docker Hub's unauthenticated pull rate limit on 3/6 jobs — classic "lucky pulls go through, unlucky ones hit the cap" pattern on shared-runner egress.Per pimlock's pointer (nv-gha-runners best-practices, Use Docker Cache for BuildKit), the fix is one input to
docker/setup-buildx-action@v3:buildkitd-config: /etc/buildkit/buildkitd.toml. That TOML is pre-populated on every nv-gha-runner and points Docker Hub traffic at an in-environment mirror.Related Issue
OS-49 runner migration, Phase 3 / OS-127. Unblocks clean shadow dispatches on PR 964's shadow workflow.
Changes
.github/actions/setup-buildx/action.yml: addbuildkitd-config: /etc/buildkit/buildkitd.tomlto thedriver: localbranch only. Remote-driver path is unaffected (ARC BuildKit pods live inside EKS and don't egress to Docker Hub).Testing
mise run pre-commit— Rust / Python / license / helm all green.markdown:lint:mdfails on 8 pre-existing MD040 errors inarchitecture/podman-rootless-networking.mdfrom PR Openshell driver podman #904 — unrelated to this PR.shadow-docker-buildafter merge; expect all 6 matrix cells to succeed on image pulls.Checklist