image reader waits out a registry 429 and tries again (3 tries); 08 + changelog: the dry-run measurement of the Docker Hub change (0 refused), two runners = two tag caches (R-1334)

scripts/image_runtime.py

@@ -176,15 +176,25 @@ def split_ref(ref):
     return reg, path, tag
 
 
+RETRY_TRIES = 3          # a registry 429 is waited out (its Retry-After, capped, else 10/30 s) and tried again; only the
+RETRY_BACKOFF_S = (10, 30)   # last try's 429 is an answer (ghcr.io refused blob reads in back-to-back dry runs, 2026-10-28)
+
+
 def _get(url, headers=None, stream=False):
-    req = urllib.request.Request(url, headers=dict({"User-Agent": UA}, **(headers or {})))
-    try:
-        r = urllib.request.urlopen(req, timeout=60)
-    except urllib.error.HTTPError as e:
-        return e.code, e.headers, b""
-    if stream:
-        return r.status, r.headers, r
-    return r.status, r.headers, r.read()
+    import time
+    for i in range(RETRY_TRIES):
+        req = urllib.request.Request(url, headers=dict({"User-Agent": UA}, **(headers or {})))
+        try:
+            r = urllib.request.urlopen(req, timeout=60)
+        except urllib.error.HTTPError as e:
+            if e.code == 429 and i < RETRY_TRIES - 1:
+                ra = str((e.headers or {}).get("Retry-After", ""))
+                time.sleep(min(int(ra), 120) if ra.isdigit() else RETRY_BACKOFF_S[min(i, len(RETRY_BACKOFF_S) - 1)])
+                continue
+            return e.code, e.headers, b""
+        if stream:
+            return r.status, r.headers, r
+        return r.status, r.headers, r.read()
 
 
 class Registry: