CI pushes to tea.ahmza.com/ahmza/blog-ahmza-com, not ghcr.io, and a bare reference could resolve to the non-runnable :buildcache tag. Pin the image to tea.ahmza.com/ahmza/blog-ahmza-com:latest so docker compose pulls the actual runnable image.