From acfd376d66836a2542f0b2d9bca0252f0663fdd1 Mon Sep 17 00:00:00 2001 From: Kshitij Kapoor Date: Wed, 29 Jul 2026 17:16:17 +0500 Subject: [PATCH] ci(docker): retry buildx setup on transient Docker Hub failures MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Docker Build, Test, and Publish workflow fails when docker/setup-buildx-action can't pull the moby/buildkit:buildx-stable-1 image from Docker Hub. The failure happens during builder bootstrap at the auth token exchange — a transient network blip (connection reset, read timeout, rate limiting) that self-resolves on re-run. Recent failure (run 30449230291, merge job): read tcp 10.1.0.171:45666->104.18.43.178:443: read: connection reset by peer This has hit us before and will again — it's the same class of transient Docker Hub flake that the merge job already retries for imagetools create. But buildx setup had no retry, so a single network hiccup killed the entire job (build, publish, or merge) even though nothing was wrong with the code or the image. Fix: wrap each of the 3 buildx setup steps (build, publish, merge jobs) with continue-on-error + a conditional retry step. The maintained action is preserved as-is — we just give it a second attempt if the first fails. The action generates a unique builder name per invocation, so the retry never collides with the failed first attempt. The second attempt has no continue-on-error, so genuine persistent failures still fail the job. The docker/setup-buildx-action maintainer has explicitly said retry belongs at the workflow level, not inside the action [1], and other repos use this same continue-on-error pattern for this exact issue [2]. [1] docker/setup-buildx-action#510 [2] joshjhall/containers#688, ethpandaops/eth-client-docker-image-builder#391 --- .github/workflows/docker.yml | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index 6f45592f936..ed89185acfc 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -53,7 +53,19 @@ jobs: - name: Checkout code uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + # Retry once on transient Docker Hub / buildkit pull failures + # (connection reset, auth token timeout, rate limiting). The action + # generates a unique builder name per invocation so the retry doesn't + # collide with the failed first attempt. A genuine persistent failure + # still fails the job — only the first attempt has continue-on-error. + # Refs: docker/setup-buildx-action#510 - name: Set up Docker Buildx + id: buildx + continue-on-error: true + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3 + + - name: Set up Docker Buildx (retry) + if: steps.buildx.outcome == 'failure' uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3 # Build once, load into the local daemon for testing. Cached @@ -146,7 +158,15 @@ jobs: - name: Checkout trusted source uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + # Retry once on transient Docker Hub / buildkit pull failures. + # See build job for rationale; same pattern. - name: Set up Docker Buildx + id: buildx + continue-on-error: true + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3 + + - name: Set up Docker Buildx (retry) + if: steps.buildx.outcome == 'failure' uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3 - name: Log in to Docker Hub @@ -208,7 +228,15 @@ jobs: pattern: digest-* merge-multiple: true + # Retry once on transient Docker Hub / buildkit pull failures. + # See build job for rationale; same pattern. - name: Set up Docker Buildx + id: buildx + continue-on-error: true + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3 + + - name: Set up Docker Buildx (retry) + if: steps.buildx.outcome == 'failure' uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3 - name: Log in to Docker Hub