From 480876ed38c3826c99390141af43bb2535568002 Mon Sep 17 00:00:00 2001
From: John Coffey <john@coffeylabs.org>
Date: Fri, 9 Oct 2026 14:53:59 -0700
Subject: [PATCH] build: pull base images through mirror.gcr.io

GitHub's shared runners keep hitting Docker Hub's anonymous pull limit
(429), which fails docker builds there; inbuxa-webmail and ihasvpn hit
it on 2026-10-09. mirror.gcr.io serves the same images without that
limit (references checked on 2026-10-09; pinned digests unchanged).
---
 Dockerfile | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index adb1777..ff71c50 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,8 @@
 # ---- build stage ----
-FROM node:26-alpine AS build
+# Docker Hub images, pulled through Google's mirror: GitHub's shared runners
+# hit Docker Hub's anonymous pull limit (429), which the mirror is not subject
+# to. Same images, same digests (checked 2026-10-09).
+FROM mirror.gcr.io/library/node:26-alpine AS build
 # What this build calls itself: 2.16.<PR>, worked out by whoever runs the
 # build. It cannot be worked out in here -- .dockerignore keeps .git out of the
 # context on purpose, and git is not installed either. `node scripts/version.mjs`
@@ -25,7 +28,7 @@ COPY . .
 RUN npm run build
 
 # ---- runtime stage ----
-FROM node:26-alpine AS runtime
+FROM mirror.gcr.io/library/node:26-alpine AS runtime
 # Re-declared: an ARG does not cross stages.
 ARG IHASMAIL_VERSION=""
 ARG BASE_PATH=""
-- 
2.54.0