fix: pull registry probe image before the timed readiness check

The readiness probe's 4s budget also covered the curlimages/curl image
pull, so a cold pull consumed it before the poll could run. Pin the three
images used by the local registry and let renovate track them.

Author: firecow

renovate.json

@@ -9,5 +9,13 @@
       "matchUpdateTypes": ["minor", "patch", "lockFileMaintenance"],
       "groupName": "All non-major"
     }
+  ],
+  "customManagers": [
+    {
+      "customType": "regex",
+      "managerFilePatterns": ["/^src/utils\\.ts$/"],
+      "matchStrings": ["Image: string = \"(?<depName>[^:\"]+):(?<currentValue>[^\"]+)\""],
+      "datasourceTemplate": "docker"
+    }
   ]
 }

src/utils.ts

@@ -422,6 +422,9 @@ export class Utils {
     }
 
     static readonly gclRegistryPrefix: string = "registry.gcl.local";
+    static readonly gclRegistryImage: string = "registry:3.1.1";
+    static readonly gclOpensslImage: string = "alpine/openssl:3.5.7";
+    static readonly gclCurlImage: string = "curlimages/curl:8.21.0";
     static async startDockerRegistry (argv: Argv): Promise<void> {
         const gclRegistryCertVol = `${this.gclRegistryPrefix}.certs`;
         const gclRegistryDataVol = `${this.gclRegistryPrefix}.data`;
@@ -446,7 +449,7 @@ export class Utils {
                 "-addext", `subjectAltName=DNS:${this.gclRegistryPrefix}`,
             ];
             const generateCertsInPlace = [
-                argv.containerExecutable, "run", "--rm", "-v", `${gclRegistryCertVol}:/certs`, "--entrypoint", "sh", "alpine/openssl", "-c",
+                argv.containerExecutable, "run", "--rm", "-v", `${gclRegistryCertVol}:/certs`, "--entrypoint", "sh", this.gclOpensslImage, "-c",
                 [
                     "openssl", ...opensslArgs,
                     "&&", "mkdir", "-p", `/certs/${this.gclRegistryPrefix}`,
@@ -481,18 +484,20 @@ export class Utils {
             "-e", "REGISTRY_HTTP_ADDR=0.0.0.0:443",
             "-e", `REGISTRY_HTTP_TLS_CERTIFICATE=/certs/${this.gclRegistryPrefix}.crt`,
             "-e", `REGISTRY_HTTP_TLS_KEY=/certs/${this.gclRegistryPrefix}.key`,
-            "registry",
+            this.gclRegistryImage,
         ]);
 
+        await Utils.spawn([argv.containerExecutable, "pull", this.gclCurlImage]);
+
         try {
             await execa(argv.containerExecutable, [
                 "run", "--rm",
                 "--network", gclRegistryNet,
                 "--entrypoint", "sh",
-                "curlimages/curl",
+                this.gclCurlImage,
                 "-c", `until [ "$(curl -s -o /dev/null -k -w "%{http_code}" https://${this.gclRegistryPrefix}:443)" = "200" ]; do sleep 1; done;`,
             ], {
-                timeout: 4000,
+                timeout: 10000,
             });
         } catch (err) {
             await this.stopDockerRegistry(argv.containerExecutable);