Docs: storage quota errors in troubleshooting; runner_image and rollout (#144)
Git, container registry and import troubleshooting get the storage limit message from #139. Configuration lists RUNNER_IMAGE and deploy step 4 says jobs can still land on the old image until the live test sees the deployed one (#138). Claude-Session: https://claude.ai/code/session_016q5wwBFck8JHq14gHUM2CL Co-authored-by: Claude <noreply@anthropic.com>
Canberk Demirci authored · GitHub committed signed1 parent 4a91970commit 7bc0a5772fd97bba02612bd65d78fefd9285e74cBrowse files
5 files changed+5−1
Files (5)
modifiedapps/diffinery/docs/migrate-from-github.md+1−0View file
| @@ -965,6 +965,7 @@ | ||
| 965 | 965 | | --- | --- | |
| 966 | 966 | | `GitHub repository acme/website was not found or the token cannot read it` | The name is wrong, or the repository is private and the GitHub token is missing or can't see it. | |
| 967 | 967 | | `GitHub rejected the token (expired or revoked?)` | Create a new GitHub token. | |
| 968 | +| `acme has reached its storage limit of N bytes (...)` | The Diffinery owner is at its [storage quota](/docs/reference/limits#account-quotas). An import stores what it copies, so it is refused up front, and one that reaches the limit on the way stops with the same message. Free space or ask a site administrator to raise it, then retry. | | |
| 968 | 969 | | `no GitHub organization or user named acme` | Check the spelling, and `github_api_url` for Enterprise. | |
| 969 | 970 | | `acme has no repositories to import` | The account has none the token can see, or the filters excluded all of them. | |
| 970 | 971 | | `acme/website already exists; choose another name` | Pick another `name` (or **New repository name**), or delete the existing repository. | |
modifiedapps/diffinery/docs/packages/container-registry.md+1−0View file
| @@ -568,6 +568,7 @@ | ||
| 568 | 568 | |
| 569 | 569 | | Message | Cause and fix | |
| 570 | 570 | | --- | --- | |
| 571 | +| `denied: acme has reached its storage limit of N bytes (...)` | The package owner is at its [storage quota](/docs/reference/limits#account-quotas). Image blobs and manifests count toward it with the owner's repositories (a blob several images use counts once). Delete old image versions, or ask a site administrator to raise it. Pulls keep working. | | |
| 571 | 572 | | `unauthorized: sign in with a Diffinery token: docker login diffinery.com` | You aren't signed in. Run `docker login diffinery.com` with a token as the password. | |
| 572 | 573 | | `unauthorized: authentication required` | The package is private and the client sent no credentials, or the credentials were rejected. Sign in again with a valid, unexpired token. | |
| 573 | 574 | | `name unknown: repository acme/website not found` | The package doesn't exist, or you can't pull it. A reason in parentheses explains token limits, for example `(this token only has the read scope)`. | |
modifiedapps/diffinery/docs/repositories/git.md+1−0View file
| @@ -329,6 +329,7 @@ | ||
| 329 | 329 | |
| 330 | 330 | | What you see | Cause | Fix | |
| 331 | 331 | | --- | --- | --- | |
| 332 | +| `remote: Push refused: acme has reached its storage limit of N bytes ...` and every ref `[remote rejected] ... (storage limit reached)` | The push brings new objects and the repository owner is at its [storage quota](/docs/reference/limits#account-quotas) (git objects, Git LFS objects, release assets and packages, 10 GB by default). Nothing from the push is kept. | Free space: delete releases, assets, image versions or repositories, or delete branches and then [purge unreachable objects](/docs/security/push-protection#removing-a-secret-that-was-pushed). Or ask a site administrator to raise the quota. Pushes that only delete or move refs still work. | | |
| 332 | 333 | | `The requested URL returned error: 400` on clone or fetch | Git is older than 2.26 or protocol v2 is turned off. The server's message is `Diffinery requires Git protocol v2 (git 2.26 or newer, or run: git config --global protocol.version 2)`. | Update Git, or run `git config --global protocol.version 2`. | |
| 333 | 334 | | `Authentication failed` after entering a password | You entered a password instead of a token, the token expired or was revoked (`invalid, expired or revoked token`), or it isn't a `dfy_` token (`unrecognised token; create one under Settings → Access tokens`). | Create a token under **Settings → Access tokens** and use it as the password. Clear the old one from your credential helper (for example `git credential reject`, or your keychain). | |
| 334 | 335 | | `repository '...' not found` for a repository you can see in the browser | The token belongs to another account, is restricted to other repositories, or Git sent stale credentials. | Check with `diffinery whoami` and `diffinery token list`. | |
modifiedapps/diffinery/docs/self-hosting/configuration.md+1−0View file
| @@ -40,6 +40,7 @@ | ||
| 40 | 40 | | `AGENT_POLL_MS` | Not set | Never in production | The end-to-end tests only: how often a running agent task is checked, in milliseconds, from `200` to `3000` (the default). Like `WAIT_TIMER_MINUTE_MS`, it counts only on a Worker on this machine; a deployed Worker ignores it. | |
| 41 | 41 | | `TERMINAL_POLL_MS` | Not set | Never in production | The end-to-end tests only: how often open web terminals are checked for their limits and their agent's access, in milliseconds, from `2000` to `60000` (the default). It counts only on a Worker on this machine; a deployed Worker ignores it. | |
| 42 | 42 | | `EGRESS` | Not set | No | `web` limits hosted Actions jobs and agent sandboxes (including tasks, reviews and terminals) to HTTP and HTTPS (ports 80 and 443) and DNS. Any other value, or none, leaves them open to the whole internet. Accounts run by a site administrator stay open. See [EGRESS](#egress). | |
| 43 | +| `RUNNER_IMAGE` | Set by the deploy | No | The runner image's name and tag (for example `diffinery-runner:96dbbe31790f`), as jobs report it in `runner.image`. `scripts/render-config.mjs` sets it when the deploy uses a prebuilt runner image, and `GET /api/v3/meta` returns it as `runner_image` (`null` when not set). Don't set it by hand. | | |
| 43 | 44 | | `TERMINALS` | Not set | No | `off` switches [terminals](/docs/agents/terminal) off: nobody can open one, and open ones end at their next check, within a minute. Anything else, or not set, leaves them on. | |
| 44 | 45 | |
| 45 | 46 | When either `ACCESS_TEAM_DOMAIN` or `ACCESS_AUD` is empty, email sign-in at `/auth/access` is off: the page answers "Account recovery by email is not set up on this instance. Ask an administrator for a sign-in link.", and the sign-in page doesn't offer **Recover your account by email**. Passkeys, invitations and admin sign-in links keep working, but the first administrator can't sign in, because email sign-in is how an account in `BOOTSTRAP_ADMINS` is created. |
modifiedapps/diffinery/docs/self-hosting/deploy.md+1−1View file
| @@ -28,7 +28,7 @@ | ||
| 28 | 28 | 1. Install dependencies, build the runner agent, the web UI's client bundles and the documentation (the pages under `apps/diffinery/docs`, the CLI reference and the CLI file served at `/-/cli/diffinery.mjs`), typecheck and run the unit tests. |
| 29 | 29 | 2. `scripts/bootstrap.sh` creates whatever is missing in your account (D1 database, R2 bucket, queues, the Cloudflare Access application for `/auth/access`), sets the R2 bucket's lifecycle rules, checks Email Sending, writes `apps/diffinery/wrangler.deploy.jsonc` with the real IDs and your hostname's route, `PUBLIC_URL` and email sender, and applies D1 migrations. |
| 30 | 30 | 3. `wrangler deploy -c wrangler.deploy.jsonc` uploads the Worker, the Durable Object classes, the two Workflows (workflow runs and GitHub imports) and the cron trigger, and builds and pushes the runner image for Containers. |
| 31 | -4. `scripts/wait-container-rollout.sh` waits until the container rollouts of the new runner image reach their last step, so jobs and sandboxes started after the deploy get the new image. Running containers keep the old image until they finish. It gives up with a warning, not a failure, after `ROLLOUT_WAIT_MINUTES` (10 by default). | |
| 31 | +4. `scripts/wait-container-rollout.sh` waits until the container rollouts of the new runner image reach their last step. Even then, an instance the rollout hasn't updated yet can start a job on the old image, so the live test waits until jobs report the deployed image (`runner_image` on `GET /api/v3/meta`). Running containers keep the old image until they finish. It gives up with a warning, not a failure, after `ROLLOUT_WAIT_MINUTES` (10 by default). | |
| 32 | 32 | 5. `scripts/ensure-secrets.sh` creates the Worker's two secrets, `MASTER_KEY` and `OIDC_PRIVATE_KEY`, the first time only. |
| 33 | 33 | 6. On the very first deploy, bootstrap runs again to finish the Access setup, and the Worker is redeployed. |
| 34 | 34 | 7. Smoke tests check `/healthz`, the sign-in pages, static assets and D1 sessions. |