build-tools is the image the pipeline's build pod runs its shell steps in.
It was owned by devops-lib, which is an odd home: it is not library code,
it is an artefact built by hand and pushed to Harbor, exactly like the
mirrors here. devops-lib only ever referenced the result by tag, and it
still will.
Three deliberate changes from the homelab's version:
- Pushed to base-images/build-tools:1, not homelab/. That project is
public, so build pods pull it with no credentials — the same reason the
language images live there.
- FROM the mirrored docker:27-cli rather than Docker Hub, with that tag
added to images.txt. Otherwise building the image that exists to remove
a Docker Hub dependency would itself depend on Docker Hub.
- yq is pinned instead of "releases/latest". An image that resolves a
different yq on every build is not reproducible, and that is the kind
of drift that surfaces months later as an unexplained pipeline failure.
The README gains the build-and-push procedure: the same pod shape as the
mirror, with the registry CA mounted into dind so the push is trusted, and
DOCKER_BUILDKIT=0, since BuildKit wants to write state under /root/.docker
where the push credentials get mounted read-only.
Verified the three places that must agree do: images.txt, the README's
inlined ConfigMap copy of it, and the Dockerfile's FROM tag.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LEsTefWWifp4ikvhHF5s6N
Same manifest and same script as the homelab repo; what differs is the
registry host and, substantially, TLS.
The homelab's Harbor speaks plain HTTP and its mirror pod passes
--insecure-registry. Harbor here serves a real certificate issued from the
private CA Terraform created, so the pod instead mounts that CA into the
dind container at /etc/docker/certs.d/<registry host>/ca.crt. It goes in
the dind container specifically: dockerd performs the push, while
docker-cli only talks to it over TCP.
The README's project-creation and verification curls now use https and
--cacert, since a laptop has no reason to trust this CA either.
Still no robot credentials in the pod, for the same reason as the
homelab's: the jenkins robot is scoped to the homelab project, and making
base-images public grants anonymous pull but never push. A one-off admin
docker login beats provisioning another robot for something run this
rarely.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LEsTefWWifp4ikvhHF5s6N
Mirror push failed "unauthorized to access repository: base-images/
golang, action: push" — harbor-robot-dockerconfig is scoped only to
the homelab project's robot account, nothing on base-images. Making
base-images public only grants anonymous pull, never push. Removed
the read-only docker-config secret mount (it would have blocked
`docker login` from writing new credentials anyway) and switched to
logging in interactively with Harbor admin credentials instead, since
this whole mirror is a rarely-run manual task, not worth provisioning
a dedicated robot account for.
