dank/serverAppConfigs
1
0
Fork 0
Code Issues 6 Pull Requests Actions Packages Projects Releases Wiki Activity

anubis: run the image under a localhost/ alias tag

Browse Source 
On this host's podman 5.7 quadlet path, a registry-prefixed Image ref
fails to resolve from local storage at container create time even when
the image is present ('image not known'); the identical argv works from
a shell or transient unit. Verified live: an identical unit with
Image=localhost/techarohq/anubis:v1.13.0 starts immediately. The deploy
handler now tags the alias after the guarded pull; upgrades re-tag
after pulling the new tag.
This commit is contained in:
Frank
2026-08-28 10:19:48 -07:00
parent 2e82fc10b9
commit b83b706f23
2 changed files with 15 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dankclaw/anubis/quadlet/anubis.container
+11 -6
View File
@@ -11,11 +11,16 @@
# per-vhost routing — including Authentik forward_auth — resumes. Host headers
# survive both hops, so vhost matching on the internal listener still works.
#
# Version pin: ghcr.io/techaroq/anubis:v1.13.0 was source-verified before
# pinning (policy parser is JSON-only at this tag, flags are the config
# surface via flagenv: an env var named TARGET sets --target, POLICY_FNAME
# sets --policy-fname). Upgrading = stop unit, change Image=, deploy; policy
# schema must be re-verified against the new tag first.
# Image pin: the image is pulled from ghcr.io/techarohq/anubis (source of
# truth), but the unit runs it under a localhost/-aliased tag: on this host's
# podman 5.7 quadlet path, registry-prefixed refs fail to resolve from local
# storage at container create time ("image not known") even when present; the
# localhost alias resolves (verified live 2026-08-28). v1.13.0 was
# source-verified before pinning (policy parser is JSON-only at this tag,
# flags are the config surface via flagenv: TARGET sets --target,
# POLICY_FNAME sets --policy-fname). Upgrading = pull new tag, re-tag the
# localhost alias, restart the unit; re-verify the policy schema first.
# (the active Image= key lives in the [Container] section below)
#
# No secrets here: Anubis holds no credentials (memory store; challenge
# cookies are client-side JWTs). A restart invalidates issued challenges —
@@ -28,7 +33,7 @@ Wants=network-online.target
[Container]
ContainerName=anubis
Image=ghcr.io/techaroq/anubis:v1.13.0
Image=localhost/techarohq/anubis:v1.13.0
Pull=never
Network=dankclaw_default
# flagenv maps env names to flag names (TARGET -> --target, POLICY_FNAME ->