From 25e2fcb68f33b8a721cc9dc142667bddb5fda7de Mon Sep 17 00:00:00 2001 From: Dimitri Yatsenko Date: Wed, 30 Sep 2026 17:27:53 -0500 Subject: [PATCH] fix(tests): pull MinIO from a registry that still serves it MinIO withdrew its public images. `minio/minio` on Docker Hub was deleted on 2026-09-11 -- the whole repository, not just `latest`, so pinning a tag does not help -- and `quay.io/minio/minio` began requiring authentication on 2026-09-24. Free community builds stopped in October 2025 and the open-source repository was archived in February 2026, so this is a withdrawal rather than an outage: re-running a job will not clear it. Every object-storage suite fails at collection in CI as a result -- test_gc, test_npy_codec, test_codecs, test_attach, test_object -- while passing locally for anyone with the old image still in their Docker cache, which is why this did not show up until CI ran on a clean machine. Switches the fixture to Chainguard's build, which is public, needs no credentials, and is drop-in for testcontainers' MinioContainer. It is also the safer choice on its own merits: the last community image is a year stale and carries unpatched high-severity CVEs, while the Chainguard build is rebuilt continuously. The image is now read from DJ_TEST_MINIO_IMAGE, matching DJ_TEST_MYSQL_IMAGE, so a deployment can point at its own mirror without editing tests. Verified with the local MinIO cache deleted, so the pull is cold as it is in CI: 118 passed across the five object-storage suites. --- tests/conftest.py | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/tests/conftest.py b/tests/conftest.py index d1a6f6e7d..bfbbc293d 100644 --- a/tests/conftest.py +++ b/tests/conftest.py @@ -174,8 +174,13 @@ def minio_container(): from testcontainers.minio import MinioContainer + # MinIO withdrew its public images: `minio/minio` on Docker Hub is gone + # entirely (any tag, not just `latest`) and `quay.io/minio/minio` now + # requires authentication. Chainguard publishes a maintained build that + # needs no credentials and is drop-in for this fixture. Overridable so a + # deployment can point at its own mirror without editing tests. container = MinioContainer( - image="minio/minio:latest", + image=os.environ.get("DJ_TEST_MINIO_IMAGE", "cgr.dev/chainguard/minio:latest"), access_key="datajoint", secret_key="datajoint", )