ggcr: Docker 25.0 breaks image handling #1870
Comments
|
I can't reproduce this. |
Minimal repro: $ docker save hello-world@sha256:4bd78111b6914a99dbc560e6a20eab57ff6655aea4a80c50b0c5491968cbc2e6 > hello-world-v25.tar
$ crane validate --tarball hello-world-v25.tar
FAIL: hello-world-v25.tar: validating layers: unknown blob sha256:3a124446045bb36fb69dc556a1816f475a2c9b0258ae260c7bd517f9031e7d3d
Error: validating layers: unknown blob sha256:3a124446045bb36fb69dc556a1816f475a2c9b0258ae260c7bd517f9031e7d3d$ tar xvf hello-world-v25.tar
blobs/
blobs/sha256/
blobs/sha256/ac28800ec8bb38d5c35b49d45a6ac4777544941199075dff8c4eb63e093aa81e
blobs/sha256/b02b598d5d3b77e7c53873d60cb439e05fa547335b5d1a26b66bf0684657d3a8
blobs/sha256/c55c4ab38c73b5b59d76afd01083be207b1897142fee10222e56d1fd708efb62
blobs/sha256/d2c94e258dcb3c5ac2798d32e1249e42ef01cba4841c2234249495f87264ac5a
index.json
manifest.json
oci-layout
$ jq . < manifest.json
[
{
"Config": "blobs/sha256/d2c94e258dcb3c5ac2798d32e1249e42ef01cba4841c2234249495f87264ac5a",
"RepoTags": null,
"Layers": [
"blobs/sha256/ac28800ec8bb38d5c35b49d45a6ac4777544941199075dff8c4eb63e093aa81e"
],
"LayerSources": {
"sha256:ac28800ec8bb38d5c35b49d45a6ac4777544941199075dff8c4eb63e093aa81e": {
"mediaType": "application/vnd.oci.image.layer.v1.tar",
"size": 14848,
"digest": "sha256:ac28800ec8bb38d5c35b49d45a6ac4777544941199075dff8c4eb63e093aa81e"
}
}
}
]
$ file blobs/sha256/ac28800ec8bb38d5c35b49d45a6ac4777544941199075dff8c4eb63e093aa81e
blobs/sha256/ac28800ec8bb38d5c35b49d45a6ac4777544941199075dff8c4eb63e093aa81e: POSIX tar archiveLooks like crane is confused by |
Here's minimal standalone code repro: package main
import (
"fmt"
"github.com/google/go-containerregistry/pkg/name"
"github.com/google/go-containerregistry/pkg/v1/daemon"
)
func main() {
ref := name.MustParseReference("hello-world")
img, _ := daemon.Image(ref)
ls, _ := img.Layers()
for _, l := range ls {
d, _ := l.Digest()
_, err := img.LayerByDigest(d)
fmt.Println(err)
}
}When run in this environment (as reported by the code above outputs When run in this environment (note the downgraded server engine version): the code outputs |
|
The problem seems to be that, as used by partial.BlobToDiff(), partial.FSLayers() is supposed to return blob hashes as opposed to DiffIDs. In turn, The actual code that populates the On Docker < 25.0 this type assertion fails, so |
|
We also cannot push images exported from Docker 25.0. The two tar files are straightforward scratch containers with a text file in them. One built and saved with Docker 24.0.7, the other is the same container having been loaded to and saved from a host running Docker 25.0.0. |
Wait until a fix for google/go-containerregistry#1870 is available.
|
Ah, when I tried to upgrade docker, it failed and I didn't notice, so I was on an old version. I'll look into this. Edit: Been staring at this for ~10 minutes, I'm not sure if it will ever complete: Edit2: Yeah seems unlikely: Edit3: Alright I've reinstalled everything and managed to get an up to date docker desktop version. I'll fix this Monday. |
|
Turning on the containerd image store fixes everything, as far as I can tell. If you're blocked by this and can turn that on, I'd recommend it. But without that... this is really interesting behavior. The image I'm saving (hello-world) looks like this in the registry: {
"schemaVersion": 2,
"mediaType": "application/vnd.oci.image.manifest.v1+json",
"config": {
"mediaType": "application/vnd.oci.image.config.v1+json",
"digest": "sha256:ee301c921b8aadc002973b2e0c3da17d701dcd994b606769a7e6eaa100b81d44",
"size": 581
},
"layers": [
{
"mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
"digest": "sha256:478afc9190022e867bb857b1a25cc5abc7678287af6cb930562ec25be709f1b7",
"size": 3195
}
],
"annotations": {
"org.opencontainers.image.revision": "3fb6ebca4163bf5b9cc496ac3e8f11cb1e754aee",
"org.opencontainers.image.source": "https://github.com/docker-library/hello-world.git#3fb6ebca4163bf5b9cc496ac3e8f11cb1e754aee:arm64v8/hello-world",
"org.opencontainers.image.url": "https://hub.docker.com/_/hello-world",
"org.opencontainers.image.version": "linux"
}
}The output of {
"schemaVersion": 2,
"mediaType": "application/vnd.oci.image.manifest.v1+json",
"config": {
"mediaType": "application/vnd.oci.image.config.v1+json",
"digest": "sha256:ee301c921b8aadc002973b2e0c3da17d701dcd994b606769a7e6eaa100b81d44",
"size": 581,
"platform": {
"architecture": "arm64",
"os": "linux"
}
},
"layers": [
{
"mediaType": "application/vnd.oci.image.layer.v1.tar",
"digest": "sha256:12660636fe55438cc3ae7424da7ac56e845cdb52493ff9cf949c47a7f57f8b43",
"size": 10752
}
]
}Notable differences: We've got a There's a weird |
|
Without containerd integration docker pull doesn't really store the manifest from the registry. The manifest is decomposed into the image config and individual uncompressed layers which are stored in the graphdriver-backend image store. When you do |
Not exactly -- they also added an uncompressed local layer to
Not exactly -- the |
|
i also got the weird |
|
The |
Describe the bug
With Docker 25.0,
daemon.imageis broken and does not allowLayerByDigest()To Reproduce
This code prints
<nil>s if the host is running Docker 24.0.7 or earlier, andunknown blob sha256:whatevers in the host is running Docker 25.0.Expected behavior
Behavior should not differ between Docker 24 and Docker 25.
Additional context
Reproduced on 0.18.0.
The text was updated successfully, but these errors were encountered: