[opencode-collom]

The scheduled Build All Container Images workflow has been red on every run because four of the images can no longer be built at all. Each failure has an unambiguous cause.

node-exporter -- unpullable base image

ERROR: support Docker Image manifest version 2, schema 1 has been removed
ERROR: failed to build: failed to solve: quay.io/prometheus/node-exporter:v0.15.2:
       failed to resolve source metadata

v0.15.2 (2018) was only ever published as a Docker schema 1 manifest, and Docker removed schema 1 support, so the image cannot be pulled any more. The pinned version moves to v1.12.1.

Upstream v1.12.1 is a single multi-arch manifest (linux/amd64, linux/arm64, linux/arm/v7, linux/ppc64le, linux/riscv64, linux/s390x), so the per-architecture slots that image.arm and image.arm64 used to fill -- carlosedp/node_exporter:v0.15.2-arm and :v0.15.2-arm64, which are unpullable for the same reason -- are replaced by a PLATFORMS file. The build workflow reads it and builds the architectures with buildx, which is how the other multi-architecture images in this repository are already built.

vmhub5_exporter -- builder image older than the module

RUN go mod download -x

fails because go.mod declares go 1.24 and the builder image is golang:1.23. The builder moves to golang:1.26. The final image is unchanged: the binary is still a static build copied into alpine.

node-problem-detector -- base image on an end-of-life Debian

Err:1 http://deb.debian.org/debian-security bullseye-security/main amd64 libc6 amd64 2.31-13+deb11u14
  404  Not Found
E: Failed to fetch .../libc6_2.31-13%2bdeb11u14_amd64.deb  404  Not Found

Debian 11 (bullseye) has moved to archive, so the package pool entries the base image's apt metadata still points at are gone and every apt-get install in that stage 404s. The base moves to bookworm-v1.0.4. (bookworm-v1.0.9 would also fix the apt failures, but it dropped the linux/arm/v7 architecture that this image builds for; bookworm-v1.0.4 still publishes it.)

This also removes a latent mismatch: the builder stage is golang:1.21, which is bookworm based, while the runtime stage was bullseye. The CGO build linked against the newer glibc and then ran on the older one.

alertmanager-github-receiver -- builder image on an end-of-life Debian

Err:1 http://deb.debian.org/debian-security bullseye-security/main amd64 libsystemd0 amd64 247.3-7+deb11u8
  404  Not Found
E: Failed to fetch .../libsystemd0_247.3-7%2bdeb11u8_amd64.deb  404  Not Found

Same cause: golang:1.20.0 is bullseye based and its apt metadata points at package versions that have been removed from the Debian pool. The builder moves to golang:1.26. The final image is unchanged (gcr.io/distroless/static).

Two images are still broken and are deliberately not touched here, because fixing them is a content decision rather than a version bump:

• mkv-auto -- upstream deleted the master branch and moved prerequisites.sh into modules/eos-filter-tweaker/, so the clone stage checks out nothing and the wrapper image has nothing to run.
• transmission -- the Alpine transmission-daemon package no longer provides the transmission user the image expects (chown: unknown user transmission).

And the opencode image cannot be pushed to GHCR at all until a GHCR_TOKEN repository secret exists, because GITHUB_TOKEN may only publish packages that are linked to this repository.