## Summary
CI is failing in `main` before tests start because Docker Hub denies
pulls for `minio/minio` and `minio/mc`. Retrying the failed jobs
produced the same errors.
Use MinIO’s Quay images in the development, harness, deployment Compose,
and Helm configurations. Pin each image to its multi-platform digest and
retain the release tags already used by deployment templates. Update the
architecture reference to match.
### Related issue
No duplicate issue or PR found. Addresses the image-pull failures in
[main CI attempt
2](https://github.com/block/buzz/actions/runs/34645306855/attempts/2).
### Testing
- Pulled both pinned images for Linux ARM64 and AMD64.
- Started an isolated Compose stack derived from the updated MinIO
service definitions, once per architecture (AMD64 under local
emulation).
- Verified the existing health check passed and the bucket initializer
exited with code 0.
- Uploaded an object with `mc cp`, read it with `mc cat`, compared its
content, and deleted it with `mc rm` on both architectures.
- Confirmed the initialized bucket was private and removed the temporary
stack and volume.
Generated with Codex
Signed-off-by: Salman Mohammed <smohammed@squareup.com>
## What changed
Bind the development Compose stack's published PostgreSQL, Redis,
Adminer, Keycloak, MinIO, and Prometheus ports to `127.0.0.1`.
## Why
Docker publishes a host port on every interface when no host address is
specified. Running the development stack on a remote workstation or VPS
therefore exposes its infrastructure services to that machine's public
networks. Loopback bindings retain host-local development access and
Docker's internal `buzz-net` connectivity without making those services
Internet-reachable.
## Impact
Local workflows continue using the same ports. Deliberate remote
administration now requires an SSH tunnel or another trusted
private-network path.
## Validation
- `docker compose -f docker-compose.yml config --quiet`
- Recreated the six affected services with their existing named volumes
and Docker network
- PostgreSQL remained healthy and retained all 54 application tables
- Redis, MinIO, and Prometheus health checks passed
- All affected ports were closed on the host's public IPv4 and IPv6
addresses while remaining available on loopback
Origin:
`buzz://message?channel=199eb7bc-3feb-484f-ae0e-4995123721ea&id=1c5bc387e86e21bb31677f56e1c862d4d9a17943bce91f8d93e825d029ce7f72`
Signed-off-by: Paweł Karniej <karniej.p@gmail.com>
