fix: use BASE_IMAGE build args to pull through Harbor cache, avoid Docker Hub rate limits

Dockerfiles default to Docker Hub images (unchanged for external builds).
Woodpecker passes registry.celestium.life/dockerhub-cache/... via build args.

.woodpecker.yml

@@ -62,6 +62,7 @@ steps:
       context: .
       build_args:
         - SERVICE_CMD=python -m services.scheduler.app
+        - BASE_IMAGE=registry.celestium.life/dockerhub-cache/library/python:3.12-slim
     when:
       event: push
       branch: main
@@ -102,6 +103,7 @@ steps:
       context: .
       build_args:
         - SERVICE_CMD=uvicorn services.symbol_registry.app:app --host 0.0.0.0 --port 8000
+        - BASE_IMAGE=registry.celestium.life/dockerhub-cache/library/python:3.12-slim
     when:
       event: push
       branch: main
@@ -142,6 +144,7 @@ steps:
       context: .
       build_args:
         - SERVICE_CMD=python -m services.ingestion.worker
+        - BASE_IMAGE=registry.celestium.life/dockerhub-cache/library/python:3.12-slim
     when:
       event: push
       branch: main
@@ -182,6 +185,7 @@ steps:
       context: .
       build_args:
         - SERVICE_CMD=python -m services.parser.worker
+        - BASE_IMAGE=registry.celestium.life/dockerhub-cache/library/python:3.12-slim
     when:
       event: push
       branch: main
@@ -222,6 +226,7 @@ steps:
       context: .
       build_args:
         - SERVICE_CMD=python -m services.extractor.worker
+        - BASE_IMAGE=registry.celestium.life/dockerhub-cache/library/python:3.12-slim
     when:
       event: push
       branch: main
@@ -262,6 +267,7 @@ steps:
       context: .
       build_args:
         - SERVICE_CMD=python -m services.aggregation.worker
+        - BASE_IMAGE=registry.celestium.life/dockerhub-cache/library/python:3.12-slim
     when:
       event: push
       branch: main
@@ -302,6 +308,7 @@ steps:
       context: .
       build_args:
         - SERVICE_CMD=python -m services.recommendation.worker
+        - BASE_IMAGE=registry.celestium.life/dockerhub-cache/library/python:3.12-slim
     when:
       event: push
       branch: main
@@ -342,6 +349,7 @@ steps:
       context: .
       build_args:
         - SERVICE_CMD=uvicorn services.risk.app:app --host 0.0.0.0 --port 8000
+        - BASE_IMAGE=registry.celestium.life/dockerhub-cache/library/python:3.12-slim
     when:
       event: push
       branch: main
@@ -382,6 +390,7 @@ steps:
       context: .
       build_args:
         - SERVICE_CMD=python -m services.adapters.broker_adapter
+        - BASE_IMAGE=registry.celestium.life/dockerhub-cache/library/python:3.12-slim
     when:
       event: push
       branch: main
@@ -422,6 +431,7 @@ steps:
       context: .
       build_args:
         - SERVICE_CMD=python -m services.lake_publisher.worker
+        - BASE_IMAGE=registry.celestium.life/dockerhub-cache/library/python:3.12-slim
     when:
       event: push
       branch: main
@@ -462,6 +472,7 @@ steps:
       context: .
       build_args:
         - SERVICE_CMD=uvicorn services.api.app:app --host 0.0.0.0 --port 8000
+        - BASE_IMAGE=registry.celestium.life/dockerhub-cache/library/python:3.12-slim
     when:
       event: push
       branch: main
@@ -502,6 +513,7 @@ steps:
       context: .
       build_args:
         - SERVICE_CMD=uvicorn services.trading.app:app --host 0.0.0.0 --port 8000
+        - BASE_IMAGE=registry.celestium.life/dockerhub-cache/library/python:3.12-slim
     when:
       event: push
       branch: main
@@ -541,6 +553,9 @@ steps:
       dockerfile: frontend/Dockerfile
       context: frontend
       no_cache: true
+      build_args:
+        - BASE_IMAGE=registry.celestium.life/dockerhub-cache/library/node:24-alpine
+        - NGINX_IMAGE=registry.celestium.life/dockerhub-cache/nginxinc/nginx-unprivileged:alpine
     when:
       event: push
       branch: main
@@ -579,6 +594,8 @@ steps:
         - latest
       dockerfile: docker/Dockerfile.superset
       context: docker
+      build_args:
+        - BASE_IMAGE=registry.celestium.life/dockerhub-cache/apache/superset:latest
     when:
       event: push
       branch: main

docker/Dockerfile

@@ -1,4 +1,5 @@
-FROM python:3.12-slim
+ARG BASE_IMAGE=python:3.12-slim
+FROM ${BASE_IMAGE}
 
 ENV PYTHONDONTWRITEBYTECODE=1
 ENV PYTHONUNBUFFERED=1

docker/Dockerfile.superset

@@ -1,5 +1,6 @@
 # Custom Superset image with Trino, PostgreSQL, and Redis drivers
-FROM apache/superset:latest
+ARG BASE_IMAGE=apache/superset:latest
+FROM ${BASE_IMAGE}
 
 USER root
 RUN /app/docker/pip-install.sh --no-cache trino[sqlalchemy] psycopg2-binary redis

frontend/Dockerfile

@@ -1,5 +1,6 @@
 # Stage 1: Build
-FROM node:24-alpine AS build
+ARG BASE_IMAGE=node:24-alpine
+FROM ${BASE_IMAGE} AS build
 WORKDIR /app
 COPY package.json package-lock.json ./
 RUN npm ci
@@ -10,7 +11,8 @@ ARG VITE_RISK_ENGINE_URL=""
 RUN npm run build
 
 # Stage 2: Serve (unprivileged nginx, runs as uid 101, port 8080)
-FROM nginxinc/nginx-unprivileged:alpine
+ARG NGINX_IMAGE=nginxinc/nginx-unprivileged:alpine
+FROM ${NGINX_IMAGE}
 COPY --from=build /app/dist /usr/share/nginx/html
 COPY nginx.conf /etc/nginx/conf.d/default.conf
 EXPOSE 8080