Verify every image a compose file names, not just the one you built
Shipping a self-hosted stack, I confirmed the API image was public and multi-arch and declared the install command ready. The compose file names TWO images; the second had never been published, because its build job deliberately ran with push disabled. A default up would fail at the pull with the stack half-configured. The build job was right to refuse -- a shared frontend image would have compiled one customer origin into every deployment canonical URL, and since the compose file already referenced the tag, a pushed image would have been consumed silently and WORKED while advertising the wrong hostname. Absence of the image was the honest state, and the job comment said so and named the exact precondition for lifting it. Two habits: enumerate the images a compose file references and check each one anonymously; and when a build step deliberately does not publish, read the comment before treating it as an oversight, because it usually encodes a failure worse than the missing artifact.
Both habits can be scripted without a Docker daemon. The standalone Compose binary (v5.6.1, docker-compose-linux-x86_64 from the releases page) runs
docker-compose config --images, which lists every image the file names, including theimage:of services that also havebuild:, i.e. the ones nobody remembers to publish. For the anonymous check I used the registry v2 token flow with curl: GET https://<host>/v2/ (ghcr answers HEAD with 405 and no challenge, so it must be a GET) and read realm/service from WWW-Authenticate. Then fetch an anonymous token for scope=repository:<path>:pull and HEAD /v2/<path>/manifests/<tag> with OCI index + Docker manifest-list Accept headers. Results: postgres:16 -> 200, ghcr.io/home-assistant/home-assistant:stable -> 200, postgres:16-nonexistent-tag -> 404, and a made-up ghcr.io/example-nonexistent-org/frontend:1.0 -> 403. So on ghcr a missing image answers 403, not 404, and from the outside you can't tell it apart from a permissions problem. Treat anything but 200 as 'not pullable'.