Pack build command not picking the run image

[tppalani]

Summary

Just having one question about pack command: if somebody could help, it would be really helpful, or if this is not the right channel, please guide me on how to reach the right people to get it addressed.
When I'm running the pack build command with the --run-image argument, the pack command does not pick a specific run image version based on my command instruction.
After building an image, when I'm doing the pack inspect command with the app image, I can only see the latest run image. Can you please help me on this?

---

`pack inspect app-1.0-release
Inspecting image: app-1.0-release

REMOTE:
(not present)

LOCAL:

Stack: io.buildpacks.stacks.jammy

Base Image:
Reference: 945a5e4052d9b9b024f69bf89f8cf8bd72bc727882ab0b78df9592b37119a31c
Top Layer: sha256:be9eb0a7d50b0438c62376a29b5557f85496a55ae83d41a49f934160ffa09421

Run Images:
index.docker.io/paketobuildpacks/run-jammy-base:latest`

Reproduction

Steps

1. passed run-image flag inside the pack command
2. updated /cnb/buildpacks/run.toml run image version and created custom image and pushed to personal docker registry.
3. used custom image while running pack build command with custom image name.

Current behavior

pack build command always referring latest run image.

Expected behavior

pack build command not referring old run which we are passing via --run-image command during the build

---

Environment

pack info

$ pack report
Pack:
Version: 0.29.0+git-95c8060.build-4209
OS/Arch: windows/amd64

Default Lifecycle Version: 0.15.2

Supported Platform APIs: 0.3, 0.4, 0.5, 0.6, 0.7, 0.8, 0.9, 0.10

Config:
default-registry = "buildpack"
experimental = true

[[registries]]
name = "[REDACTED]"
type = "github"
url = "[REDACTED]"

[[registries]]
name = "[REDACTED]"
type = "github"
url = "[REDACTED]"

docker info

version:
APIVersion: 4.7.0
Built: 1695839078
BuiltTime: Wed Sep 27 23:54:38 2023
GitCommit: ""
GoVersion: go1.20.8
Os: linux
OsArch: linux/amd64
Version: 4.7.0

[jjbustamante]

Hi @tppalani

I tried to research a little bit about this, here are my thoughts:

1. Are you just checking your final image using pack inspect?, I asked because I agree with @natalieparellano, I think --run-image doesn’t override the toml files used by the pack inspect command to show the information.
2. I see you are running pack (0.29.0) on windows machine.
3. I did a quick test on my local machine using our samples java app and the paketo base builder.

# Build 1
pack build -B paketobuildpacks/builder-jammy-base -p ./java-maven java-app-1

# Build 2
pack build -B paketobuildpacks/builder-jammy-base -p ./java-maven  --run-image paketobuildpacks/run-jammy-base:0.0.2  java-app-2

After running these commands, I checked the metadata saved on my daemon for both images:

docker inspect java-app-1  | jq '.[] | .Config.Labels | ."io.buildpacks.lifecycle.metadata" | fromjson' | jq .

"runImage": {
    "topLayer": "sha256:bc77c4b1ad4be9afa8e29bb1ce4d82db76dc8ae62b867969a2b1f74f947768bd",
    "reference": "e0cd2419edc02b9eed7a041888a92c09ce19f3413ec7faf612b9fa6b4f13372f",
    "image": "index.docker.io/paketobuildpacks/run-jammy-base:latest"
  },
  "stack": {
    "runImage": {
      "image": "index.docker.io/paketobuildpacks/run-jammy-base:latest"
    }
  }

And for the other one, the one overriding the run-image

docker inspect java-app-2  | jq '.[] | .Config.Labels | ."io.buildpacks.lifecycle.metadata" | fromjson' | jq .

"runImage": {
    "topLayer": "sha256:be9eb0a7d50b0438c62376a29b5557f85496a55ae83d41a49f934160ffa09421",
    "reference": "945a5e4052d9b9b024f69bf89f8cf8bd72bc727882ab0b78df9592b37119a31c",
    "image": "index.docker.io/paketobuildpacks/run-jammy-base:latest"
  },
  "stack": {
    "runImage": {
      "image": "index.docker.io/paketobuildpacks/run-jammy-base:latest"
    }
  }

As we can see, the stack.runImage.image metadata is the same, BUT the runImage.topLayer and runImage.reference are different. so the run-image must be changed. To confirm that, I used dive tool to inspect the images layers.

We can see the FROM on both images is different, so the app image is actually using a different run-image

[tppalani]

Hi @juan Bustamante

Good morning.

Thanks for the more detailed information. you mean to say run-image (index.docker.io/paketobuildpacks/run-jammy-base:latest) will be always refer the latest but runImage.topLayer and runImage.reference been changed, for every build.

Reason behind is, I want to proof to my management team how we can pass different run-image over the build or how we can write or create custom run images out of base image.

And also pack rebase - while doing rebase i want to specify two different kind of run images version to find the image vulnerability differentiation between two different run image ( one is old one and another one is most recent which has all the latest vulnerability fixes) in this way dev team as well other team able to understand how the rebase will work without rebuilding application when the image vulnerability are reported.

[loewenstein]

FWIW I can understand if one would consider the current behavior of pack inspect a bug. On the other hand side, I haven't looked closely enough to call it that myself.

🤪

[jjbustamante]

@loewenstein yeah! it looks like a bug in the metadata. We've been talking about it on slack

Some important comments from @natalieparellano:

Juan Jose Bustamante> Happy to help, I will try to research why the metadata is not updated, I agree it is confusing, but I am not sure if it is a bug or it was done by design

Natalie Arellano> It might have just been an oversight
Natalie Arellano> If we’re going to fix it, we should do it in pack by updating the stack.toml / run.toml provided to the build container. It would have the unfortunate side effect of losing mirrors information for the metadata label on the app image
Natalie Arellano> But, if what we’re stamping out now is inaccurate, maybe that’s best

[tppalani]

Hi @natalieparellano

Is that changes has been fixed from your side, if yes how i can test it from my machine ?

[jjbustamante]

Hi @tppalani .

The bug is still open, we'll be glad on getting some help to fix it

[tppalani]

Hi @jjbustamante,

Thanks for the information.

[natalieparellano]

@Pratham1812 is working on this 🙂

[tppalani]

HI @natalieparellano are we good to pass run image using pack command ?

[jjbustamante]

HI @natalieparellano are we good to pass run image using pack command ?

Hi! @tppalani!

it is still not ready, there is a PR open to fix the error but it is still in progress :)

[tppalani]

Thanks for your help and support

[tppalani]

Hi @jjbustamante

just want to follow-up on this, please let me know when the changes has been merged and released

[natalieparellano]

We should help #2022 along - from what I gather it is close, and just needs formatting fixes. I added some code suggestions.