From 37e1ad17ea1b32c068592f212fd6216dfcd7a098 Mon Sep 17 00:00:00 2001
From: Celes Renata <celes@frameshift.net>
Date: Sun, 19 Apr 2026 09:24:43 +0000
Subject: [PATCH] fix: use BASE_IMAGE build args to pull through Harbor cache,
 avoid Docker Hub rate limits

Dockerfiles default to Docker Hub images (unchanged for external builds).
Woodpecker passes registry.celestium.life/dockerhub-cache/... via build args.
---
 .woodpecker.yml            | 17 +++++++++++++++++
 docker/Dockerfile          |  3 ++-
 docker/Dockerfile.superset |  3 ++-
 frontend/Dockerfile        |  6 ++++--
 4 files changed, 25 insertions(+), 4 deletions(-)

diff --git a/.woodpecker.yml b/.woodpecker.yml
index 3040c4d..421b430 100644
--- a/.woodpecker.yml
+++ b/.woodpecker.yml
@@ -62,6 +62,7 @@ steps:
       context: .
       build_args:
         - SERVICE_CMD=python -m services.scheduler.app
+        - BASE_IMAGE=registry.celestium.life/dockerhub-cache/library/python:3.12-slim
     when:
       event: push
       branch: main
@@ -102,6 +103,7 @@ steps:
       context: .
       build_args:
         - SERVICE_CMD=uvicorn services.symbol_registry.app:app --host 0.0.0.0 --port 8000
+        - BASE_IMAGE=registry.celestium.life/dockerhub-cache/library/python:3.12-slim
     when:
       event: push
       branch: main
@@ -142,6 +144,7 @@ steps:
       context: .
       build_args:
         - SERVICE_CMD=python -m services.ingestion.worker
+        - BASE_IMAGE=registry.celestium.life/dockerhub-cache/library/python:3.12-slim
     when:
       event: push
       branch: main
@@ -182,6 +185,7 @@ steps:
       context: .
       build_args:
         - SERVICE_CMD=python -m services.parser.worker
+        - BASE_IMAGE=registry.celestium.life/dockerhub-cache/library/python:3.12-slim
     when:
       event: push
       branch: main
@@ -222,6 +226,7 @@ steps:
       context: .
       build_args:
         - SERVICE_CMD=python -m services.extractor.worker
+        - BASE_IMAGE=registry.celestium.life/dockerhub-cache/library/python:3.12-slim
     when:
       event: push
       branch: main
@@ -262,6 +267,7 @@ steps:
       context: .
       build_args:
         - SERVICE_CMD=python -m services.aggregation.worker
+        - BASE_IMAGE=registry.celestium.life/dockerhub-cache/library/python:3.12-slim
     when:
       event: push
       branch: main
@@ -302,6 +308,7 @@ steps:
       context: .
       build_args:
         - SERVICE_CMD=python -m services.recommendation.worker
+        - BASE_IMAGE=registry.celestium.life/dockerhub-cache/library/python:3.12-slim
     when:
       event: push
       branch: main
@@ -342,6 +349,7 @@ steps:
       context: .
       build_args:
         - SERVICE_CMD=uvicorn services.risk.app:app --host 0.0.0.0 --port 8000
+        - BASE_IMAGE=registry.celestium.life/dockerhub-cache/library/python:3.12-slim
     when:
       event: push
       branch: main
@@ -382,6 +390,7 @@ steps:
       context: .
       build_args:
         - SERVICE_CMD=python -m services.adapters.broker_adapter
+        - BASE_IMAGE=registry.celestium.life/dockerhub-cache/library/python:3.12-slim
     when:
       event: push
       branch: main
@@ -422,6 +431,7 @@ steps:
       context: .
       build_args:
         - SERVICE_CMD=python -m services.lake_publisher.worker
+        - BASE_IMAGE=registry.celestium.life/dockerhub-cache/library/python:3.12-slim
     when:
       event: push
       branch: main
@@ -462,6 +472,7 @@ steps:
       context: .
       build_args:
         - SERVICE_CMD=uvicorn services.api.app:app --host 0.0.0.0 --port 8000
+        - BASE_IMAGE=registry.celestium.life/dockerhub-cache/library/python:3.12-slim
     when:
       event: push
       branch: main
@@ -502,6 +513,7 @@ steps:
       context: .
       build_args:
         - SERVICE_CMD=uvicorn services.trading.app:app --host 0.0.0.0 --port 8000
+        - BASE_IMAGE=registry.celestium.life/dockerhub-cache/library/python:3.12-slim
     when:
       event: push
       branch: main
@@ -541,6 +553,9 @@ steps:
       dockerfile: frontend/Dockerfile
       context: frontend
       no_cache: true
+      build_args:
+        - BASE_IMAGE=registry.celestium.life/dockerhub-cache/library/node:24-alpine
+        - NGINX_IMAGE=registry.celestium.life/dockerhub-cache/nginxinc/nginx-unprivileged:alpine
     when:
       event: push
       branch: main
@@ -579,6 +594,8 @@ steps:
         - latest
       dockerfile: docker/Dockerfile.superset
       context: docker
+      build_args:
+        - BASE_IMAGE=registry.celestium.life/dockerhub-cache/apache/superset:latest
     when:
       event: push
       branch: main
diff --git a/docker/Dockerfile b/docker/Dockerfile
index 3eb0e84..df99f65 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -1,4 +1,5 @@
-FROM python:3.12-slim
+ARG BASE_IMAGE=python:3.12-slim
+FROM ${BASE_IMAGE}
 
 ENV PYTHONDONTWRITEBYTECODE=1
 ENV PYTHONUNBUFFERED=1
diff --git a/docker/Dockerfile.superset b/docker/Dockerfile.superset
index 64ede13..7e5e1a2 100644
--- a/docker/Dockerfile.superset
+++ b/docker/Dockerfile.superset
@@ -1,5 +1,6 @@
 # Custom Superset image with Trino, PostgreSQL, and Redis drivers
-FROM apache/superset:latest
+ARG BASE_IMAGE=apache/superset:latest
+FROM ${BASE_IMAGE}
 
 USER root
 RUN /app/docker/pip-install.sh --no-cache trino[sqlalchemy] psycopg2-binary redis
diff --git a/frontend/Dockerfile b/frontend/Dockerfile
index ea1b116..9c17e4d 100644
--- a/frontend/Dockerfile
+++ b/frontend/Dockerfile
@@ -1,5 +1,6 @@
 # Stage 1: Build
-FROM node:24-alpine AS build
+ARG BASE_IMAGE=node:24-alpine
+FROM ${BASE_IMAGE} AS build
 WORKDIR /app
 COPY package.json package-lock.json ./
 RUN npm ci
@@ -10,7 +11,8 @@ ARG VITE_RISK_ENGINE_URL=""
 RUN npm run build
 
 # Stage 2: Serve (unprivileged nginx, runs as uid 101, port 8080)
-FROM nginxinc/nginx-unprivileged:alpine
+ARG NGINX_IMAGE=nginxinc/nginx-unprivileged:alpine
+FROM ${NGINX_IMAGE}
 COPY --from=build /app/dist /usr/share/nginx/html
 COPY nginx.conf /etc/nginx/conf.d/default.conf
 EXPOSE 8080