Puppet downloads new Docker image when running in noop mode

[jethrocarr]

Fault
When running Puppet with --noop it seems that this module will still pull Docker images

Expectation
--noop should be a no-impact mode and should not result in Docker images being pulled.

Reproducing
To reproduce, have a manifest that defines a docker::image, eg:

docker::image { 'ubuntu':
   image_tag => 'latest',
}

Then run puppet with ---noop

[davejrt]

I can't replicate your issue. With the following manifest initially I get docker images as you'd expect

node default {
  include docker
}

root@node-01:~# docker images
REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
root@node-01:~#

If I update the manifest to the following then run with noop I get the following error

node default {
  include docker

 docker::image { 'alpine':
   image_tag => 'latest',
}

root@node-01:/tmp# cat manifests-a11d1078b1b1f2e3bdea27312f6ba513/default.pp
node default {
  include docker

  docker::image {'alpine':
   image_tag => 'latest',
  }
}

root@node-01:/tmp# puppet apply --noop manifests-a11d1078b1b1f2e3bdea27312f6ba513/default.pp --modulepath /tmp/modules
Warning: ModuleLoader: module 'docker' has unresolved dependencies - it will only see those that are resolved. Use 'puppet module list --tree' to see information about modules\n   (file & line not available)
Notice: Compiled catalog for node-01.home in environment production in 0.34 seconds
Notice: /Stage[main]/Main/Node[default]/Docker::Image[alpine]/File[/usr/local/bin/update_docker_image.sh]/ensure: current_value 'absent', should be 'present' (noop)
Error: /Stage[main]/Main/Node[default]/Docker::Image[alpine]/Exec[echo 'Update of alpine:latest complete']: Could not evaluate: Could not find command '/usr/local/bin/update_docker_image.sh'
Notice: Applied catalog in 0.27 seconds
root@node-01:/tmp# docker images
REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
root@node-01:/tmp# puppet apply manifests-a11d1078b1b1f2e3bdea27312f6ba513/default.pp --modulepath /tmp/modules
Warning: ModuleLoader: module 'docker' has unresolved dependencies - it will only see those that are resolved. Use 'puppet module list --tree' to see information about modules\n   (file & line not available)
Notice: Compiled catalog for node-01.home in environment production in 0.31 seconds
Notice: /Stage[main]/Main/Node[default]/Docker::Image[alpine]/File[/usr/local/bin/update_docker_image.sh]/ensure: defined content as '{md5}f1f1282ef2b10ac56c2cc42b67e2999b'
Notice: /Stage[main]/Main/Node[default]/Docker::Image[alpine]/Exec[echo 'Update of alpine:latest complete']/returns: Update of alpine:latest complete
Notice: /Stage[main]/Main/Node[default]/Docker::Image[alpine]/Exec[echo 'Update of alpine:latest complete']/returns: executed successfully
Notice: Applied catalog in 9.53 seconds
root@node-01:/tmp#

[jethrocarr]

hi Dave,

Thanks for taking a look.

I think the key bit is:

Error: /Stage[main]/Main/Node[default]/Docker::Image[alpine]/Exec[echo 'Update of alpine:latest complete']: Could not evaluate: Could not find command '/usr/local/bin/update_docker_image.sh'

Essentially the /usr/local/bin/update_docker_image.sh script is being executed even in noop mode. It didn't trigger in your attempt as it was the first run on a clean system and the script wasn't present on the machine yet.

Try the following instead:

First run a Puppet manifest that sets up an alpine image locally and ensures Docker and all the scripts are installed.

root@testing-docker:~# cat test.pp
include docker

docker::image { 'alpine':
   image_tag => 'latest',
}
root@testing-docker:~# puppet apply test.pp
root@testing-docker:~# docker images
REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
alpine              latest              3fd9065eaf02        4 months ago        4.15MB
root@testing-docker:~#

Now change the manifest to install a different package - eg ubuntu:

root@testing-docker:~# cat test.pp
include docker

docker::image { 'ubuntu':
   image_tag => 'latest',
}
root@testing-docker:~# puppet apply test.pp --noop
Notice: Compiled catalog for testing-docker.localdomain in environment production in 1.56 seconds
Notice: /Stage[main]/Main/Docker::Image[ubuntu]/Exec[echo 'Update of ubuntu:latest complete']/returns: current_value notrun, should be 0 (noop)
Notice: Docker::Image[ubuntu]: Would have triggered 'refresh' from 1 events
Notice: Class[Main]: Would have triggered 'refresh' from 1 events
Notice: Stage[main]: Would have triggered 'refresh' from 1 events
Notice: Applied catalog in 12.28 seconds
root@testing-docker:~# docker images
REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
ubuntu              latest              452a96d81c30        4 weeks ago         79.6MB
alpine              latest              3fd9065eaf02        4 months ago        4.15MB

As you can see from the before/after, although we've only run the Ubuntu docker image manifest in --noop mode, it's still gotten downloaded thanks to /usr/local/bin/update_docker_image.sh being executed even in --noop mode.