ggcr: Docker with Containerd snapshotter gives wrong config name

[phillebaba]

Describe the bug

I have observed that an image loaded from the Docker daemon gives different results depending if Containerd snapshotter is enabled or not.

https://docs.docker.com/storage/containerd/

Without it the correct value is given, but when it is enabled the wrong value is given. The wrong value will be the index digest instead of the config digest. This has impact when for example writing the image to disk as the file name is derived from the config name.

I have determined that the problem comes from the method config name is fetched. The current implementation assumes that the image id returned from the Docker client is the config digest. This is the case for Docker due to historical reasons. It is not the case in Containerd.

go-containerregistry/pkg/v1/daemon/image.go

Lines 177 to 181 in 3764db2

	res, _, err := i.opener.client.ImageInspectWithRaw(i.opener.ctx, i.ref.String())
	if err != nil {
	return v1.Hash{}, err
	}
	return v1.NewHash(res.ID)

To Reproduce

package main

import (
	"fmt"

	"github.com/google/go-containerregistry/pkg/name"
	"github.com/google/go-containerregistry/pkg/v1/daemon"
)

func main() {
	err := run()
	if err != nil {
		panic(err)
	}
}

func run() error {
	ref, err := name.ParseReference("docker.io/library/alpine:latest@sha256:77726ef6b57ddf65bb551896826ec38bc3e53f75cdde31354fbffb4f25238ebd")
	if err != nil {
		return err
	}
	img, err := daemon.Image(ref)
	if err != nil {
		return err
	}
	configName, err := img.ConfigName()
	if err != nil {
		return err
	}
	fmt.Println("config name", configName)
	return nil
}

Expected behavior

Running without Containerd snapshotter we get the right result.

config name sha256:1d34ffeaf190be23d3de5a8de0a436676b758f48f835c3a2d4768b798c15a7f1

Running with Containerd snapshotter we get the wrong result.

config name sha256:77726ef6b57ddf65bb551896826ec38bc3e53f75cdde31354fbffb4f25238ebd

Additional context

More details is given in zarf-dev/zarf#2584.