Repository navigation
The default task-runner image is not public #424
Description
What happens: v1alpha1.DefaultTaskImage (pkg/apis/v1alpha1/types.go:38), examples/task.yaml, examples/simple.yaml, and demo.sh use gcr.io/ax-substrate/ate-images/ax-task-runner. An anonymous pull of this image returns 403 Forbidden. A task without spec.image fails on every cluster outside Google.
Reproduce:
docker buildx imagetools inspect gcr.io/ax-substrate/ate-images/ax-task-runner@sha256:3a0dea6ad8b55278685db58aca6e37dc4ba04056831d45bef3aaeafdca43cac6
# ERROR: ... 403 ForbiddenSuggested fix: Publish the runner image to a public registry for amd64 and arm64. Or document that users must build it (make push-task-runner), and add a controller flag for the default image.
Environment: google/ax d0bc38b and Agent Substrate 1d7ca8c, on a local kind cluster (Docker Desktop on Apple Silicon).
Activity
ilaigold commentedon Sep 28, 2026
Still the case on
v0.3.1(e70162a).examples/task.yaml,examples/simple.yamlandDefaultTaskImageall point atgcr.io/ax-substrate/ate-images/ax-task-runner, and an anonymous pull is still refused today (failed to fetch anonymous token). On GKE (Standard1.36.3-gke.1767000) withv0.3.0, the pull failed withartifactregistry.repositories.downloadArtifacts DENIED.A workaround that works on
v0.3.1:cmd/ax-task-runnerfor your platform.spec.imagepinned by digest. A tag reference fails, because Substrate rejects images that are not pinned by digest, and AX reports that asactor template not found(Custom ActorTemplate creation errors are swallowed; Task fails with misleading 'actor template not found' (e.g. tag-referenced image) #366).eren23 commentedon Oct 20, 2026
One more thing I found while checking this on my lab.
DefaultTaskImagehas no digest. Substrate only accepts an actor template whose image is pinned by digest. So a Task with nospec.imagefails at template creation, before any pull. Without resource limits the error is the vagueactor template not foundfrom #366. Making the image public is not enough on its own. The default also needs a digest.