fix(ci): switch MinIO tests to Chainguard images (#4985)

## Summary

Switches the MinIO test and local development containers to Chainguard's
maintained Docker Hub images because the previous Quay images are no
longer publicly pullable.

## Fix

Pins the multi-platform server and client images by digest. The local
stack now uses the Chainguard client entrypoint for bucket
initialization, while test containers keep client state in a writable
temporary directory.

Author: carderne

.github/workflows/e2e-webapp.yml

@@ -102,7 +102,7 @@ jobs:
               redis:7.2 \
               testcontainers/ryuk:0.14.0 \
               ghcr.io/s2-streamstore/s2:0.40.0@sha256:b26249e2ede0949755f5af8028185dc2bcfc3aa2db21eb9610543d144eb6ee9d \
-              quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z@sha256:14cea493d9a34af32f524e538b8346cf79f3321eff8e708c1e2960462bd8936e
+              chainguard/minio:latest@sha256:6a1d0b45c8669726bba580ced0bfa4cb9fdeed1ed636dfabd81d1577beb6937b
             do
               pull "$image" &
               pids+=("$!")

.github/workflows/unit-tests-webapp.yml

@@ -109,7 +109,7 @@ jobs:
               redis:7.2 \
               testcontainers/ryuk:0.14.0 \
               electricsql/electric:1.2.4@sha256:20da3d0b0e74926c5623392db67fd56698b9e374c4aeb6cb5cadeb8fea171c36 \
-              quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z@sha256:14cea493d9a34af32f524e538b8346cf79f3321eff8e708c1e2960462bd8936e
+              chainguard/minio:latest@sha256:6a1d0b45c8669726bba580ced0bfa4cb9fdeed1ed636dfabd81d1577beb6937b
             do
               pull "$image" &
               pids+=("$!")

docker/docker-compose.yml

@@ -144,12 +144,13 @@ services:
   # routes to it when the OBJECT_STORE_* env vars are set (see .env.example).
   minio:
     container_name: ${CONTAINER_PREFIX:-}minio
-    image: quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z@sha256:14cea493d9a34af32f524e538b8346cf79f3321eff8e708c1e2960462bd8936e
+    image: chainguard/minio:latest@sha256:6a1d0b45c8669726bba580ced0bfa4cb9fdeed1ed636dfabd81d1577beb6937b
     restart: always
     command: server /data --console-address ":9001"
     environment:
       MINIO_ROOT_USER: minioadmin
       MINIO_ROOT_PASSWORD: minioadmin
+      MC_HOST_local: http://minioadmin:minioadmin@localhost:9000
     volumes:
       - minio-data:/data
     ports:
@@ -158,25 +159,22 @@ services:
     networks:
       - app_network
     healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]
+      test: ["CMD", "mc", "ready", "local"]
       interval: 5s
       timeout: 5s
       retries: 5
       start_period: 5s
 
   minio-init:
-    image: quay.io/minio/mc:RELEASE.2025-08-13T08-35-41Z@sha256:a7fe349ef4bd8521fb8497f55c6042871b2ae640607cf99d9bede5e9bdf11727
+    image: chainguard/minio-client:latest@sha256:b2bd7824d23d3e3b15bedd7e87fbc3be29d2e213307b4f901e4a1d92356dc20f
     depends_on:
       minio:
         condition: service_healthy
     networks:
       - app_network
-    entrypoint: /bin/sh
-    command:
-      - -c
-      - |
-        mc alias set local http://minio:9000 minioadmin minioadmin
-        mc mb -p local/packets || true
+    environment:
+      MC_HOST_local: http://minioadmin:minioadmin@minio:9000
+    command: ["mb", "--ignore-existing", "local/packets"]
     restart: "no"
 
   electric:

internal-packages/testcontainers/src/minio.ts

@@ -17,7 +17,7 @@ export class MinIOContainer extends GenericContainer {
   private region = "us-east-1";
 
   constructor(
-    image = "quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z@sha256:14cea493d9a34af32f524e538b8346cf79f3321eff8e708c1e2960462bd8936e"
+    image = "chainguard/minio:latest@sha256:6a1d0b45c8669726bba580ced0bfa4cb9fdeed1ed636dfabd81d1577beb6937b"
   ) {
     super(image);
     this.withExposedPorts(MINIO_PORT);
@@ -49,13 +49,14 @@ export class MinIOContainer extends GenericContainer {
 
     const startedContainer = await super.start();
 
-    // Create the "packets" bucket using MinIO client
     await x(
       "docker",
       [
         "exec",
         startedContainer.getId(),
         "mc",
+        "--config-dir",
+        "/tmp/.mc",
         "alias",
         "set",
         "local",
@@ -66,9 +67,11 @@ export class MinIOContainer extends GenericContainer {
       { throwOnError: true }
     );
 
-    await x("docker", ["exec", startedContainer.getId(), "mc", "mb", "local/packets"], {
-      throwOnError: true,
-    });
+    await x(
+      "docker",
+      ["exec", startedContainer.getId(), "mc", "--config-dir", "/tmp/.mc", "mb", "local/packets"],
+      { throwOnError: true }
+    );
 
     return new StartedMinIOContainer(
       startedContainer,
@@ -123,14 +126,35 @@ export class StartedMinIOContainer extends AbstractStartedContainer {
   public async resetBucket(bucket = "packets"): Promise<void> {
     await x(
       "docker",
-      ["exec", this.getId(), "mc", "rm", "--recursive", "--force", `local/${bucket}`],
+      [
+        "exec",
+        this.getId(),
+        "mc",
+        "--config-dir",
+        "/tmp/.mc",
+        "rm",
+        "--recursive",
+        "--force",
+        `local/${bucket}`,
+      ],
       {
         throwOnError: false,
       }
     );
-    await x("docker", ["exec", this.getId(), "mc", "mb", "--ignore-existing", `local/${bucket}`], {
-      throwOnError: true,
-    });
+    await x(
+      "docker",
+      [
+        "exec",
+        this.getId(),
+        "mc",
+        "--config-dir",
+        "/tmp/.mc",
+        "mb",
+        "--ignore-existing",
+        `local/${bucket}`,
+      ],
+      { throwOnError: true }
+    );
   }
 
   /**