docker-compose-pinned-image-no-build-section-fresh-clone-pull-access-denied
I diagnosed the issue from the problem definition and verified the fix at the Compose-config level (the Docker daemon isn't available in this environment, so I couldn't run the full image build). I built a representative reproduction matching the described repo and confirmed the before/after behavior.
Diagnosis confirmed:
docker compose config shows image: eduos-installer:latest with no build: key on api/web → on a clean host Compose falls through to a registry pull → pull access denied.build.context: /tmp/eduos-repro, dockerfile: Dockerfile, target: installer while retaining the image tag, and docker compose config exits 0.Solution written to /workspace/SOLUTION.md. It contains:
pull access denied failure on a fresh clone.image:-only services have only two behaviours (use-local or pull); eduos-installer:latest is never published, and pnpm install + plain up -d cannot produce the container image.build: {context: ., dockerfile: Dockerfile, target: installer} to both api and web while keeping the tag, plus the quickstart change to docker compose up -d --build and demotion of pnpm install to a host-dev note.docker compose config), live build proof matching the recorded 842e1a7a evidence (exit 0, Image eduos-installer:latest Built), and an end-to-end fresh-clone check including down --rmi local re-verification.build alone, dropping image:, registry publishing, and keeping pnpm install in the quickstart.Key detail for whoever applies this: target: installer (not api/web) is correct because both Compose services intentionally share the single eduos-installer:latest artifact, so the build must stop at the stage containing the installed dependencies and app code.
# Evidence - Problem class: docker-compose-pinned-image-no-build-section-fresh-clone-pull-access-denied - Model: openrouter/deepseek/deepseek-v4.1-flash - Solved: 2026-09-21T13:44:30.623Z - Verification: solution produced by pi in sandbox; see signatures.json
{"description": "docker-compose.yml pins image eduos-installer:latest on api+web with no build: section, and GETTING-STARTED quickstart documents plain docker compose up -d after pnpm install --frozen-lockfile: on a clean docker host compose tries to PULL the non-existent image (pull access denied). Fix (verified eduos DF-EDUOS-DEXDAT-COM-CO-17 commit 842e1a7a): add build{context: ., dockerfile: Dockerfile, target: installer} to both services keeping the image tag, make the quickstart first stack command docker compose up -d --build (~2min first build), demote pnpm install to a host-dev note. Live proof: docker compose build api web exit 0, Image eduos-installer:latest Built.", "environment": "", "language": "", "model": "openrouter/deepseek/deepseek-v4.1-flash", "problem_class": "docker-compose-pinned-image-no-build-section-fresh-clone-pull-access-denied", "provider": "openrouter", "solved_at": "2026-09-21T13:44:30.624Z", "version": ""}