This is an automated email from the ASF dual-hosted git repository.
tqchen pushed a commit to branch jenkins-ecr-cache
in repository https://gitbox.apache.org/repos/asf/tvm.git
The following commit(s) were added to refs/heads/jenkins-ecr-cache by this push:
new baaf6ec980 [CI] Resolve the Docker Hub cache from the AWS caller
account
baaf6ec980 is described below
commit baaf6ec980b5410970102c28e322b4bdf7dc6963
Author: Tianqi Chen <[email protected]>
AuthorDate: Thu Oct 15 13:57:58 2026 +0000
[CI] Resolve the Docker Hub cache from the AWS caller account
---
ci/jenkins/README.md | 27 ++++++++++++++-------------
ci/jenkins/generated/common.groovy | 17 ++++++++++++-----
2 files changed, 26 insertions(+), 18 deletions(-)
diff --git a/ci/jenkins/README.md b/ci/jenkins/README.md
index c40bca4dd1..5ff8dfa3ad 100644
--- a/ci/jenkins/README.md
+++ b/ci/jenkins/README.md
@@ -84,19 +84,20 @@ and the standalone skip commands retain their command-line
interfaces.
Jenkins keeps Docker Hub image names in `docker-images.ini` and image job
parameters. After published/staging image selection and parameter overrides,
-`common.groovy` maps Hub references to
-`477529581014.dkr.ecr.us-west-2.amazonaws.com/docker-hub`. Build and test
stages
-pull and run that same resolved image. Official images use the `library/`
-namespace; explicit non-Hub registries, tags and digests are preserved. Docker
-publishing retains the original selected Hub names.
-
-The optional Jenkins environment setting `DOCKER_HUB_CACHE` overrides the cache
-registry and repository prefix. An explicitly empty value disables translation;
-unset uses the configured default, including on named branches. No controller
-change is needed for the default. ECR login uses the selected image's registry
-and region, retries pulls, and removes login credentials afterward.
Authentication
-or cache-import failures fail the job rather than falling back to Docker Hub.
-Local `docker/bash.sh` and image lookup continue using public names unchanged.
+`common.groovy` maps Hub references to the AWS caller account's ECR
`docker-hub`
+namespace in `us-west-2`. The account is discovered with
+`aws sts get-caller-identity`, as in the existing ECR authentication flow.
+Build and test stages pull and run that same resolved image. Official images
use
+the `library/` namespace; explicit non-Hub registries, tags and digests are
+preserved. Docker publishing retains the original selected Hub names.
+
+The shared Jenkins script global `enable_docker_hub_cache = true` enables
+translation, including on named branches, without a controller change. Set it
to
+`false` to retain public Hub references. ECR login uses the selected image's
+registry and region, retries pulls, and removes login credentials afterward.
+Authentication or cache-import failures fail the job rather than falling back
+to Docker Hub. Local `docker/bash.sh` and image lookup continue using public
+names unchanged.
### Trust and rollout
diff --git a/ci/jenkins/generated/common.groovy
b/ci/jenkins/generated/common.groovy
index b93500e0e0..10f1533832 100644
--- a/ci/jenkins/generated/common.groovy
+++ b/ci/jenkins/generated/common.groovy
@@ -21,6 +21,7 @@ import org.jenkinsci.plugins.pipeline.modeldefinition.Utils
image_platforms = [ci_arm: 'ARM', ci_cpu: 'CPU', ci_gpu: 'GPU', ci_wasm: 'CPU']
images = image_platforms.collectEntries { name, platform -> [(name): ''] }
source_images = [:]
+enable_docker_hub_cache = true
built_images = [:]
upstream_revision = null
max_time = 180
@@ -124,10 +125,7 @@ def init_git() {
}
// Apply only after Hub selection and job overrides; inputs stay public image
names.
-def docker_hub_image(image) {
- def cache = env.DOCKER_HUB_CACHE
- if (cache == null) cache =
'477529581014.dkr.ecr.us-west-2.amazonaws.com/docker-hub'
- cache = cache.trim().replaceAll('/+$', '')
+def docker_hub_image(image, cache) {
if (!cache || !image) return image
def path = image
@@ -245,9 +243,18 @@ def prepare(node_type) {
).trim()
}
}
+ def cache = ''
+ if (enable_docker_hub_cache) {
+ def aws_account_id = sh(
+ returnStdout: true,
+ script: 'aws sts get-caller-identity --query Account --output
text',
+ label: 'Get AWS ID'
+ ).trim()
+ cache =
"${aws_account_id}.dkr.ecr.us-west-2.amazonaws.com/docker-hub"
+ }
images.keySet().each { name ->
source_images[name] = params["${name}_param"] ?: images[name]
- images[name] = docker_hub_image(source_images[name])
+ images[name] = docker_hub_image(source_images[name], cache)
}
sh(
script: 'echo "Docker images being used in this build:"\n' +
