Publish to DockerHub #14088

zanieb · 2025-06-16T19:37:28Z

The primary motivation here is to avoid confusion with non-official repositories, e.g., #13958 which could lead to attacks against our users.

Resolves

zanieb · 2025-06-17T01:25:59Z

The test plan here is unclear to me, I might release these from a fork and just delete the images?

samypr100 · 2025-06-17T02:31:12Z

I think docker-retag-base should be skipped when publishing to docker hub, or at least filter out the new docker.io/astral/uv tags that will show up in needs.docker-publish-base.outputs.image-tags unless the intent is to do the re-push for both?

zanieb · 2025-06-17T13:24:21Z

I think docker-retag-base should be skipped when publishing to docker hub, or at least filter out the new docker.io/astral/uv tags that will show up in needs.docker-publish-base.outputs.image-tags unless the intent is to do the re-push for both?

I was wondering that. I'm not sure if it matters? It seems easy enough to skip it, so I added it.

Gankra · 2025-06-17T14:13:14Z

.github/workflows/build-docker.yml

        with:
-          username: astralshbot
-          password: ${{ secrets.DOCKERHUB_TOKEN_RO }}
+          username: ${{ needs.docker-plan.outputs.push == 'true' && 'astral' || 'astralshbot' }}
+          password: ${{ needs.docker-plan.outputs.push == 'true' && secrets.DOCKERHUB_TOKEN_RW || secrets.DOCKERHUB_TOKEN_RO }}


oh boy back in my element with github ci yml fake-js ternary exprs

Gankra · 2025-06-17T14:14:55Z

.github/workflows/build-docker.yml

      - uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
-        # PRs from forks don't have access to secrets, disable this step in that case.
        if: ${{ github.event.pull_request.head.repo.full_name == 'astral-sh/uv' }}


Wait why is this comment obsolete but the code didn't change?

I can restore that

The latter block does not have the comment, so I think I just made them the same. It's sort of apparent? idk.

Gankra · 2025-06-17T14:18:22Z

.github/workflows/build-docker.yml

-          subject-name: ${{ env.UV_BASE_IMG }}
+          subject-name: ${{ env.UV_GHCR_IMAGE }}


Is there a reason to not attest the other image? Only github's hub cares about this?

uhh maybe we should attest the DockerHub ones, I'm not sure how if it works tbh.

It would be a tad different as we'd have to use push-to-registry: true for DockerHub alongside with subject name must start with index.docker.io rather than docker.io.

I think I'd prefer to do that afterwards

Gankra · 2025-06-17T14:22:13Z

The nice thing about testing this live is that the docker publish stuff runs during the build step, so if the docker releases bomb out we will only have docker images to mop up and not like, pypi.

The dist plan parsing is pretty hard to understand, and I want to add more images, e.g., for DockerHub in #14088. As a simplifying precursor... move the dist plan processing into a dedicated step.

These regressed in #14088 and were found during my test publish from a fork.

This MR contains the following updates: | Package | Update | Change | |---|---|---| | [astral-sh/uv](https://github.com/astral-sh/uv) | patch | `0.7.13` -> `0.7.14` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>astral-sh/uv (astral-sh/uv)</summary> ### [`v0.7.14`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0714) [Compare Source](astral-sh/uv@0.7.13...0.7.14) ##### Enhancements - Add XPU to `--torch-backend` ([#14172](astral-sh/uv#14172)) - Add ROCm backends to `--torch-backend` ([#14120](astral-sh/uv#14120)) - Remove preview label from `--torch-backend` ([#14119](astral-sh/uv#14119)) - Add `[tool.uv.dependency-groups].mygroup.requires-python` ([#13735](astral-sh/uv#13735)) - Add auto-detection for AMD GPUs ([#14176](astral-sh/uv#14176)) - Show retries for HTTP status code errors ([#13897](astral-sh/uv#13897)) - Support transparent Python patch version upgrades ([#13954](astral-sh/uv#13954)) - Warn on empty index directory ([#13940](astral-sh/uv#13940)) - Publish to DockerHub ([#14088](astral-sh/uv#14088)) ##### Performance - Make cold resolves about 10% faster ([#14035](astral-sh/uv#14035)) ##### Bug fixes - Don't use walrus operator in interpreter query script ([#14108](astral-sh/uv#14108)) - Fix handling of changes to `requires-python` ([#14076](astral-sh/uv#14076)) - Fix implied `platform_machine` marker for `win_amd64` platform tag ([#14041](astral-sh/uv#14041)) - Only update existing symlink directories on preview uninstall ([#14179](astral-sh/uv#14179)) - Serialize Python requests for tools as canonicalized strings ([#14109](astral-sh/uv#14109)) - Support netrc and same-origin credential propagation on index redirects ([#14126](astral-sh/uv#14126)) - Support reading `dependency-groups` from pyproject.tomls with no `[project]` ([#13742](astral-sh/uv#13742)) - Handle an existing shebang in `uv init --script` ([#14141](astral-sh/uv#14141)) - Prevent concurrent updates of the environment in `uv run` ([#14153](astral-sh/uv#14153)) - Filter managed Python distributions by platform before querying when included in request ([#13936](astral-sh/uv#13936)) ##### Documentation - Replace cuda124 with cuda128 ([#14168](astral-sh/uv#14168)) - Document the way member sources shadow workspace sources ([#14136](astral-sh/uv#14136)) - Sync documented PyTorch integration index for CUDA and ROCm versions from PyTorch website ([#14100](astral-sh/uv#14100)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this MR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this MR, check this box --- This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [ghcr.io/astral-sh/uv](https://github.com/astral-sh/uv) | final | patch | `0.7.13` -> `0.7.15` | --- ### Release Notes <details> <summary>astral-sh/uv (ghcr.io/astral-sh/uv)</summary> ### [`v0.7.15`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0715) [Compare Source](astral-sh/uv@0.7.14...0.7.15) ##### Enhancements - Consistently use `Ordering::Relaxed` for standalone atomic use cases ([#14190](astral-sh/uv#14190)) - Warn on ambiguous relative paths for `--index` ([#14152](astral-sh/uv#14152)) - Skip GitHub fast path when rate-limited ([#13033](astral-sh/uv#13033)) - Preserve newlines in `schema.json` descriptions ([#13693](astral-sh/uv#13693)) ##### Bug fixes - Add check for using minor version link when creating a venv on Windows ([#14252](astral-sh/uv#14252)) - Strip query parameters when parsing source URL ([#14224](astral-sh/uv#14224)) ##### Documentation - Add a link to PyPI FAQ to clarify what per-project token is ([#14242](astral-sh/uv#14242)) ##### Preview features - Allow symlinks in the build backend ([#14212](astral-sh/uv#14212)) ### [`v0.7.14`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0714) [Compare Source](astral-sh/uv@0.7.13...0.7.14) ##### Enhancements - Add XPU to `--torch-backend` ([#14172](astral-sh/uv#14172)) - Add ROCm backends to `--torch-backend` ([#14120](astral-sh/uv#14120)) - Remove preview label from `--torch-backend` ([#14119](astral-sh/uv#14119)) - Add `[tool.uv.dependency-groups].mygroup.requires-python` ([#13735](astral-sh/uv#13735)) - Add auto-detection for AMD GPUs ([#14176](astral-sh/uv#14176)) - Show retries for HTTP status code errors ([#13897](astral-sh/uv#13897)) - Support transparent Python patch version upgrades ([#13954](astral-sh/uv#13954)) - Warn on empty index directory ([#13940](astral-sh/uv#13940)) - Publish to DockerHub ([#14088](astral-sh/uv#14088)) ##### Performance - Make cold resolves about 10% faster ([#14035](astral-sh/uv#14035)) ##### Bug fixes - Don't use walrus operator in interpreter query script ([#14108](astral-sh/uv#14108)) - Fix handling of changes to `requires-python` ([#14076](astral-sh/uv#14076)) - Fix implied `platform_machine` marker for `...

zanieb added the releases Related to building and distributing release artifacts of uv label Jun 16, 2025

zanieb temporarily deployed to release June 16, 2025 19:37 — with GitHub Actions Inactive

zanieb force-pushed the zb/dockerhub branch from ae4a30a to d63ced2 Compare June 16, 2025 19:42

zanieb temporarily deployed to release June 16, 2025 19:42 — with GitHub Actions Inactive

zanieb marked this pull request as ready for review June 17, 2025 01:23

zanieb assigned Gankra Jun 17, 2025

zanieb requested review from Gankra and samypr100 June 17, 2025 01:26

This was referenced Jun 17, 2025

Add a docker-plan step to consolidate push and tag logic #14083

Merged

Refactor Docker image builds to use Depot #13459

Merged

FishAlchemist mentioned this pull request Jun 17, 2025

Please publish containers to docker.io #14106

Closed

zanieb force-pushed the zb/dockerhub branch from d63ced2 to 1d50dc6 Compare June 17, 2025 13:24

zanieb temporarily deployed to release June 17, 2025 13:24 — with GitHub Actions Inactive

Gankra approved these changes Jun 17, 2025

View reviewed changes

Base automatically changed from zb/docker-plan to main June 17, 2025 20:04

Publish to DockerHub

4c5d195

zanieb force-pushed the zb/dockerhub branch from 1d50dc6 to 4c5d195 Compare June 17, 2025 20:05

zanieb temporarily deployed to release June 17, 2025 20:05 — with GitHub Actions Inactive

samypr100 approved these changes Jun 18, 2025

View reviewed changes

zanieb merged commit 1fc65a1 into main Jun 18, 2025
89 of 90 checks passed

zanieb deleted the zb/dockerhub branch June 18, 2025 16:30

zanieb mentioned this pull request Jun 18, 2025

Fix Docker attestations #14133

Merged

zanieb added a commit that referenced this pull request Jun 18, 2025

Fix Docker attestations (#14133)

e104624

These regressed in #14088 and were found during my test publish from a fork.

BrewTestBot mentioned this pull request Jun 23, 2025

uv 0.7.14 Homebrew/homebrew-core#227918

Merged

		subject-name: ${{ env.UV_BASE_IMG }}
		subject-name: ${{ env.UV_GHCR_IMAGE }}

Publish to DockerHub #14088

Publish to DockerHub #14088

Uh oh!

Conversation

zanieb commented Jun 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

zanieb commented Jun 17, 2025

Uh oh!

samypr100 commented Jun 17, 2025

Uh oh!

zanieb commented Jun 17, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Gankra commented Jun 17, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

zanieb commented Jun 16, 2025 •

edited

Loading