deploy: join gitea netns instead of bridge (machine kernel lacks ip_tables for rootless netavark); pin image digests; push-to-create repo

2026-07-28 14:07:44 +02:00
parent ed7a9c01e7
commit 80d886c0cb
6 changed files with 28 additions and 34 deletions
@@ -9,8 +9,8 @@ After=network-online.target

 [Container]
 ContainerName=ctao-demo-web
-# Official image; re-pin to the exact digest at install (same drill as Gitea).
-Image=docker.io/library/nginx:stable-alpine
+# Pinned by digest at install (2026-07-28); tag kept for readability.
+Image=docker.io/library/nginx:stable-alpine@sha256:97d490c12ba55b4946b01546d1c3ed324e8d41ab1c9fcb2a616aa470620e5b46
 # releases/ is shared with the build container (:z shared label);
 # the config file is exclusive to nginx (:Z).
 Volume=%h/ctao-portal-demo/releases:/srv/releases:ro,z