dagu: run dagu-tools on the stock docker CLI image #293

Merged

mysticalsoap merged 1 commit from dagu-tools-stock into trunk

2026-09-19 23:36:04 -04:00

mysticalsoap commented

2026-09-19 23:26:55 -04:00

Owner

Problem

dagu-tools was a locally built image (alpine plus docker-cli, curl, unzip, bash) when the stock docker:<version>-cli image already ships the docker CLI and a busybox with wget and unzip. It was the one scheduled-job sidecar not on a stock upstream image, and after #290 and #291 the only build: left besides config-renderer and the two apps tracked in #292.

Fix

dagu-tools becomes docker.io/library/docker:28.5.2-cli pinned by digest, the same image the validate workflow runs check-compose.sh in, with its docker-wrapping entrypoint overridden by the idle sleep.
dagu/tools/Dockerfile removed.
The three scripts it runs (ip2location/update.sh, crowdsec-hub-update/update.sh, image-scan/list.sh) rewritten for busybox sh: wget instead of curl, no bashisms. DAGs invoke them with sh. scan.sh was already sh.
Maintenance.md sidecar bullet updated.

Verification

On the branch, just deploy dagu recreated dagu-tools from the stock image (entrypoint sleep infinity, user 948:948). Then every DAG that uses it, run by hand:

image-scan: list step in sh, 58/58 images ok, registry fallback still kicks in for invidious-companion.
docker-image-prune: succeeded.
crowdsec-hub-update: hub update and upgrade ran, crowdsec restarted and came back healthy.
ip2location: DB downloaded with wget through the real token, 11.7 MB written in place, traefik restarted and came back healthy.

Also the first real-merge run of #290's auto-detect happened just before this branch: after pulling #290 and #291, just deploy picked infra, monitoring, invidious and web from the two Dockerfile pins alone, rebuilt config-renderer and knock, and every container came back healthy.

## Problem dagu-tools was a locally built image (alpine plus docker-cli, curl, unzip, bash) when the stock `docker:<version>-cli` image already ships the docker CLI and a busybox with wget and unzip. It was the one scheduled-job sidecar not on a stock upstream image, and after #290 and #291 the only `build:` left besides config-renderer and the two apps tracked in #292. ## Fix - `dagu-tools` becomes `docker.io/library/docker:28.5.2-cli` pinned by digest, the same image the validate workflow runs check-compose.sh in, with its docker-wrapping entrypoint overridden by the idle `sleep`. - `dagu/tools/Dockerfile` removed. - The three scripts it runs (`ip2location/update.sh`, `crowdsec-hub-update/update.sh`, `image-scan/list.sh`) rewritten for busybox sh: wget instead of curl, no bashisms. DAGs invoke them with `sh`. `scan.sh` was already sh. - Maintenance.md sidecar bullet updated. ## Verification On the branch, `just deploy dagu` recreated dagu-tools from the stock image (entrypoint `sleep infinity`, user 948:948). Then every DAG that uses it, run by hand: - `image-scan`: list step in sh, 58/58 images ok, registry fallback still kicks in for invidious-companion. - `docker-image-prune`: succeeded. - `crowdsec-hub-update`: hub update and upgrade ran, crowdsec restarted and came back healthy. - `ip2location`: DB downloaded with wget through the real token, 11.7 MB written in place, traefik restarted and came back healthy. Also the first real-merge run of #290's auto-detect happened just before this branch: after pulling #290 and #291, `just deploy` picked infra, monitoring, invidious and web from the two Dockerfile pins alone, rebuilt config-renderer and knock, and every container came back healthy.

mysticalsoap added 1 commit

2026-09-19 23:26:55 -04:00

dagu: run dagu-tools on the stock docker CLI image

validate / validate (pull_request) Successful in 23s

Details

6cc11451c2

The tools sidecar was alpine plus docker-cli, curl, unzip and bash, built
locally for no reason the stock docker:<ver>-cli image doesn't cover: it
ships the CLI, and its busybox brings wget and unzip. Scheduled jobs are
meant to be helper scripts on stock upstream images; this was the one
sidecar that wasn't. The three scripts it runs move from bash and curl to
busybox sh and wget, and the DAGs invoke them with sh.

Same image the validate workflow already pins for check-compose.sh. Its
entrypoint wraps docker, so compose overrides it with the idle sleep.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

mysticalsoap merged commit 94518c4391 into trunk

2026-09-19 23:36:04 -04:00

mysticalsoap deleted branch dagu-tools-stock

2026-09-19 23:36:04 -04:00

mysticalsoap referenced this pull request from a commit

2026-09-19 23:36:05 -04:00

Merge pull request 'dagu: run dagu-tools on the stock docker CLI image' (#293) from dagu-tools-stock into trunk