bug: generator emits ghcr.io/disinto/agents image ref but no registry pull is configured #853

New issue

Closed

opened 2026-04-16 10:13:52 +00:00 by dev-bot · 0 comments

dev-bot commented

2026-04-16 10:13:52 +00:00

Collaborator

Problem

lib/generators.sh (in _generate_local_model_services) emits:

image: ghcr.io/disinto/agents:${DISINTO_IMAGE_TAG:-latest}

for every hired agent. The running deployment has no credentials for ghcr.io/disinto/agents, and the repo is not public. docker compose up fails with:

 Error Head "https://ghcr.io/v2/disinto/agents/manifests/latest": denied

Locally built images are named disinto/agents:latest (no registry prefix). The legacy hardcoded agents-llama compose stanza uses the local name and works. Only the new TOML-driven services emit the ghcr path.

Repro

Hire a new agent: disinto hire-an-agent dev-qwen2 dev --local-model <url> --model <name>
docker compose --profile agents-dev-qwen2 up -d agents-dev-qwen2
Pull fails with denied.

Temporary workaround (applied today to unblock dev-qwen2): docker tag disinto/agents:latest ghcr.io/disinto/agents:latest.

Fix options

Use local image ref — emit image: disinto/agents:${DISINTO_IMAGE_TAG:-latest} and drop the ghcr prefix. Simplest, matches legacy stanza and what disinto init --build already produces.
Emit build: directive — emit both image: and build: { context: ., dockerfile: docker/agents/Dockerfile } so docker compose build rebuilds locally when pull fails. Matches pattern used by the other hardcoded services in the repo.
Document registry login as prerequisite — only viable if the ghcr image is meant to be public/pull-auth-configured, which it currently isn't.

Option 1 is the minimal fix; option 2 is more robust across dev and CI environments. Probably want both: local image ref + build: fallback.

Acceptance

docker compose --profile agents-<name> up -d agents-<name> succeeds on a host that built images locally (no ghcr auth configured)
No regression for hosts that do have ghcr credentials (if any exist)
disinto init --build + hire-an-agent + up works end-to-end without manual docker tag

Affected files

lib/generators.sh — _generate_local_model_services, image: line (and optionally build: block)

Context

Caught while bringing up dev-qwen2. Blocked startup until workaround applied. dev-qwen's agents-llama container dodged this because it comes from the legacy hardcoded stanza with the local image ref.

## Problem `lib/generators.sh` (in `_generate_local_model_services`) emits: ```yaml image: ghcr.io/disinto/agents:${DISINTO_IMAGE_TAG:-latest} ``` for every hired agent. The running deployment has no credentials for `ghcr.io/disinto/agents`, and the repo is not public. `docker compose up` fails with: ``` Error Head "https://ghcr.io/v2/disinto/agents/manifests/latest": denied ``` Locally built images are named `disinto/agents:latest` (no registry prefix). The legacy hardcoded `agents-llama` compose stanza uses the local name and works. Only the new TOML-driven services emit the ghcr path. ## Repro 1. Hire a new agent: `disinto hire-an-agent dev-qwen2 dev --local-model <url> --model <name>` 2. `docker compose --profile agents-dev-qwen2 up -d agents-dev-qwen2` 3. Pull fails with `denied`. Temporary workaround (applied today to unblock dev-qwen2): `docker tag disinto/agents:latest ghcr.io/disinto/agents:latest`. ## Fix options 1. **Use local image ref** — emit `image: disinto/agents:${DISINTO_IMAGE_TAG:-latest}` and drop the ghcr prefix. Simplest, matches legacy stanza and what `disinto init --build` already produces. 2. **Emit `build:` directive** — emit both `image:` and `build: { context: ., dockerfile: docker/agents/Dockerfile }` so `docker compose build` rebuilds locally when pull fails. Matches pattern used by the other hardcoded services in the repo. 3. **Document registry login as prerequisite** — only viable if the ghcr image is meant to be public/pull-auth-configured, which it currently isn't. Option 1 is the minimal fix; option 2 is more robust across dev and CI environments. Probably want both: local image ref + build: fallback. ## Acceptance - [ ] `docker compose --profile agents-<name> up -d agents-<name>` succeeds on a host that built images locally (no ghcr auth configured) - [ ] No regression for hosts that do have ghcr credentials (if any exist) - [ ] `disinto init --build` + hire-an-agent + up works end-to-end without manual `docker tag` ## Affected files - `lib/generators.sh` — `_generate_local_model_services`, `image:` line (and optionally `build:` block) ## Context Caught while bringing up dev-qwen2. Blocked startup until workaround applied. dev-qwen's agents-llama container dodged this because it comes from the legacy hardcoded stanza with the local image ref.