Skip to content

[aw-failures] Sergo agent fails with exit 123 when node:lts-alpine pull from Docker Hub times out — mirror base image to ghcr.io #36595

Description

@github-actions

Summary

Problem statement

During agent setup, all ghcr.io/... images (firewall proxies, squid, mcpg, github-mcp-server, serena-mcp-server) pulled successfully. Only node:lts-alpine, pulled from Docker Hub (registry-1.docker.io), failed all 3 attempts with connection timeouts, causing the setup step to exit 123. Because node:lts-alpine is the single base image not mirrored to ghcr.io, Docker Hub flakiness/rate-limiting is a single point of failure for any workflow whose MCP servers need it.

Affected run

Date (UTC) Run Result Note
2026-06-03 05:19 §26865342203 failure (exit 123) agent never started

Prior runs §26799873398 (06-02) ... §26491943719 (05-27) all succeeded. An audit-diff against the last success shows no behavioral drift (posture read_only, 0 blocked requests both runs) — confirming this is environmental, not a code regression.

Evidence — agent setup log (run 26865342203)
Successfully pulled ghcr.io/github/gh-aw-firewall/squid:0.25.58
Successfully pulled ghcr.io/github/gh-aw-mcpg:v0.3.22
Successfully pulled ghcr.io/github/github-mcp-server:v1.1.0
Successfully pulled ghcr.io/github/serena-mcp-server:latest@sha256:bf34...
Attempt 1 of 3: Pulling node:lts-alpine@sha256:2bdb65...
Error response from daemon: Get "(registry1.docker.io/redacted) net/http: request canceled
   (Client.Timeout exceeded while awaiting headers)
Failed to pull node:lts-alpine ... Retrying in 5s...
Attempt 2 of 3 ... context deadline exceeded ... Retrying in 10s...
Attempt 3 of 3 ... context deadline exceeded
Failed to pull node:lts-alpine ... after 3 attempts
##[error]Process completed with exit code 123.

Probable root cause

node:lts-alpine is the only agent-setup image fetched from Docker Hub rather than ghcr.io. Docker Hub is subject to transient timeouts and anonymous pull-rate limits; a single bad window fails the whole run.

Proposed remediation

  1. Mirror node:lts-alpine to ghcr.io (digest-pinned, like the other images) and reference the ghcr.io copy in the image-pull list — eliminates the Docker Hub dependency entirely.
  2. If a Docker Hub pull must remain, authenticate the pull (avoid anonymous rate limits) and widen the retry backoff for base-image pulls.

Success criteria / verification

  • Agent setup performs no pulls from registry-1.docker.io for node:lts-alpine.
  • A forced/transient Docker Hub timeout no longer fails Sergo (or other node-MCP) runs.

References

Generated by 🔍 [aw] Failure Investigator (6h) · opus48 9.4M ·

  • expires on Jun 10, 2026, 8:43 AM UTC

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions