Files

T

Kristian WindandClaude Opus 5 a8a29a963d docs: the registry has to be public, and docker login was the wrong advice

Installing the Rune still failed after v0.2.0 was published, with the same
message as before:

    create container: Error response from daemon:
    No such image: ghcr.io/kristianwind/verdande:latest

The advice in these pages — log the host's Docker daemon in — cannot
work, and Yggdrasil's source says why. Its PullImage calls the Docker
SDK's ImagePull with an empty image.PullOptions{}; RegistryAuth is never
set, and there are no registry credentials anywhere in the panel. A
private image answers 401. pullImageRetry discards that error on purpose
("second failure surfaces at create"), and ContainerCreate — which only
ever looks locally — then reports the image as missing. The message is a
liar: the tag is in the registry the whole time.

docker login does not change this. It is client-side: the daemon stores
no credentials, the CLI sends them itself with each request, and
Yggdrasil is a different client that sends none.

So the package has to be public, and the pages now say that rather than
offering a login that does nothing. Keeping it private is still possible
but is now described as what it is: putting the image on the host by hand
before creating the server and again after every release.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

2026-08-17 11:55:56 +02:00

3.3 KiB

Raw Blame History

Installing as a Rune

verdande ships with a Rune manifest for Yggdrasil Panel.

If the image will not pull

create container: Error response from daemon:
No such image: ghcr.io/kristianwind/verdande:latest

This message is a liar. It does not mean the tag is missing from the registry — it means the image is not on the host, and the panel's attempt to fetch it failed without saying so.

The usual cause is a private GHCR package. Yggdrasil pulls anonymously: its PullImage calls the Docker SDK with no RegistryAuth, so a private image comes back 401. The pull error is discarded, and ContainerCreate — which only ever looks locally — then reports the image as missing.

!!! warning "docker login on the host does not help" docker login is client-side. The daemon stores no credentials; the CLI sends them itself with each request. Yggdrasil is a different client and sends none, so logging in changes nothing for the panel.

Make the package public. Under Packages → verdande → Package settings → Change visibility. The repository stays private; only the built image becomes readable, which is what the manifest and these pages have always assumed.

To keep it private you have to put the image on the host yourself, before creating the server, and again after every release:

echo "$GHCR_TOKEN" | docker login ghcr.io -u kristianwind --password-stdin
docker pull ghcr.io/kristianwind/verdande:latest

GHCR_TOKEN is a GitHub token with the read:packages scope. The panel's own pull still fails silently; it simply finds the image already there.

Installing

Runes → Carve a rune (upload) and pick rune/verdande.yaml from the repository.
Create a server from it.
Fill in the settings below.
Start it, open the URL, create the first account.

Settings

Setting	What to put
Public address	The address you reach it on. `{{PUBLIC_URL}}` is the default and usually right.
SMTP host	Your mail server. Leave blank and invite links are shown in the app instead of emailed.
SMTP port	587 for STARTTLS, 465 for implicit TLS.
SMTP username / password	As your mail server expects.
Sender address	What invites and reminders come from.
Use STARTTLS	On, unless you are on port 465.
How long a login lasts	`720h` — thirty days.

!!! note "Why the public address cannot be guessed" The host port is not chosen until the server is created, so verdande has no way to work out its own address. The panel does, and passes it in as {{PUBLIC_URL}}.

Reaching it from outside

Give the server a Subdomain under its settings and enable Cloudflare Tunnel (subdomains) under Settings → Network. No port forwarding and no public IP.

Backups

The Rune's backup includes the whole /data directory, which is what you want — see the warning about copying the database alone.

Watchers

The manifest ships log watchers for database errors, repeated failed logins and HTTP 5xx. They appear under Settings → Kvasir Watchers as ordinary per-server rules you can edit or turn off.

3.3 KiB Raw Blame History