CI: switch away from Docker Hub

[AkihiroSuda]

nerdctl/pkg/testutil/testutil.go

Lines 276 to 282 in ed8eec8

	// use GCR mirror to avoid hitting Docker Hub rate limit
	const (
	AlpineImage = "mirror.gcr.io/library/alpine:3.13"
	NginxAlpineImage = "mirror.gcr.io/library/nginx:1.19-alpine"
	NginxAlpineIndexHTMLSnippet = "<title>Welcome to nginx!</title>"
	RegistryImage = "mirror.gcr.io/library/registry:2"
	)

Docker Hub has rate limit, and OTOH mirror.gcr.io seems unstable:

docker: Error response from daemon: manifest for mirror.gcr.io/library/nginx:1.19-alpine not found: manifest unknown: Failed to fetch "1.19-alpine" from request "/v2/library/nginx/manifests/1.19-alpine".

We are currently using mirror.gcr.io (EDIT: switched back to plain old Docker Hub: #148) but should switch to something else.

Requirements:

• No rate limit
• Stable
• Provides multi-arch images for alpine:3.13, nginx:1.19-alpine, and registry:2

[AkihiroSuda]

@ktock
Do you think we can use org images under ghcr.io/stargz-snapshotter? (Are they guaranteed to be multi-arch?)

[ktock]

Do you think we can use org images under ghcr.io/stargz-snapshotter? (Are they guaranteed to be multi-arch?)

Makes sense.
They are copied using crane by ggcr so the entire image (including all platforms) is copied.

[AkihiroSuda]

I switched back from mirror.gcr.io to plain old Docker Hub in #148.

I'll use ghcr.io/stargz-snapshotter/<IMAGE>:<TAG>-org if we hit rate limit again.

[fahedouch]

we can specify credentials for container downloading: https://github.blog/changelog/2020-09-24-github-actions-private-registry-support-for-job-and-service-containers/ and increase the rate limit

[AkihiroSuda]

Not seeing rate limit on macOS on GHA recently, closing