Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

crane rebase and mutate.Rebase set empty-valued platform fields #751

Closed
micahyoung opened this issue Aug 3, 2020 · 4 comments
Closed

crane rebase and mutate.Rebase set empty-valued platform fields #751

micahyoung opened this issue Aug 3, 2020 · 4 comments

Comments

@micahyoung
Copy link
Contributor

After rebasing, the rebased image has platform fields with empty values ("os":"", "architecture":"", "os.version":"", etc.) though the input images contained these fields with valid values.

Docker and k8s Linux containers allow pulling and running these platform-less images by adding their own platform but Windows containers fail to pull or run (which is how I noticed this issue).

It appears this is mostly implemented already in mutate.Time though some optional fields are missed (os.features, variant, features from platform struct).

I feel the expected behavior would be to copy all platform fields with values (spec'd under platform) from the new_base image to the rebased image.

I'll add a PR assuming there's no objection to the proposed behavior.

Repro:

# Local registry
docker run -p 5000:5000 -d --rm registry:2

# Tags to be used
original_image="localhost:5000/my-original-image"
rebased_image="localhost:5000/my-rebased-image"
old_base_image="alpine:3.11"
new_base_image="alpine:3.12"

# Build and push the original image
docker build . --tag ${original_image} -f <(cat <<EOF
FROM ${old_base_image}
RUN echo bar > /foo
EOF
)
docker push ${original_image}
docker rmi -f ${original_image}

# Rebase onto new base
crane rebase \
  --original ${original_image} \
  --old_base ${old_base_image} \
  --new_base ${new_base_image} \
  --rebased ${rebased_image}

# See missing fields on rebased image
crane config ${rebased_image} | jq ".os,.architecture"
## Output
""
""

# See existing platform fields on original and old base images
crane config ${original_image} | jq ".os,.architecture"
crane config ${old_base_image} | jq ".os,.architecture"
crane config ${new_base_image} | jq ".os,.architecture"
## Output
"linux"
"amd64"
"linux"
"amd64"
"linux"
"amd64"
@imjasonh
Copy link
Collaborator

imjasonh commented Aug 3, 2020

This seems reasonable to me. @jonjohnsonjr wdyt?

@jonjohnsonjr
Copy link
Collaborator

I'm surprised that we're dropping any fields -- we should be preserving everything and just updating the things that need to change.

Agree this is a bug.

@micahyoung
Copy link
Contributor Author

Thanks for the quick response! Would a PR from me be useful? I realize there might be some shared behavior between mutate.Time. And while it would not negatively affect projects I know of, are there any backward compatibility concerns with adding these fields back?

@jonjohnsonjr
Copy link
Collaborator

jonjohnsonjr commented Aug 3, 2020

Would a PR from me be useful?

Definitely. Happy to merge a quick fix.

Ultimately I'd like to understand why we're dropping these fields, I don't think it's intentional. Doing what mutate.Time does by selectively adding them back to the config file seems error-prone, since we might miss something, but for now I think it's fine to get this unbroken.

And while it would not negatively affect projects I know of, are there any backward compatibility concerns with adding these fields back?

I think this is an uncontroversial change and wouldn't worry about backward compatibility.

micahyoung pushed a commit to micahyoung/go-containerregistry that referenced this issue Aug 4, 2020
* Quick fix for missing os/architecture properties, required by config spec (https://github.com/opencontainers/image-spec/blob/master/config.md#properties)
* Also include unspec'd os.version property which is required for Windows images to run on Windows containers.
* This implementation takes these three properties from newBase as it most accurately defines the new rebased image's format. If the properties were taken from original, it would prevent reuse of ABI-compatible top layers from differing old and new base images (i.e. data-only top layers, Windows minor version upgrades).

Fixes [google#751]

Signed-off-by: Micah Young <ymicah@vmware.com>
micahyoung pushed a commit to micahyoung/go-containerregistry that referenced this issue Aug 4, 2020
* Quick fix for missing `os` and `architecture` config properties, required by config spec [1]

* Also include unspec'd `os.version` property which is required for Windows images to run on Windows containers [2]

This implementation takes these three properties from newBase, which most accurately defines the newly rebased image's os/architecture. If the properties were taken from original, it would prevent reuse of de-facto ABI-compatible top layers with differing old and new base images (i.e. data-only top layers rebased from amd64 to arm, Windows os.version upgrades).

This does not address additional, optional config properties that are currently being omitted during rebase such as `author` and `created`.

Fixes [google#751]

Signed-off-by: Micah Young <ymicah@vmware.com>

[1]: https://github.com/opencontainers/image-spec/blob/master/config.md#properties
[2]: https://docs.microsoft.com/en-us/virtualization/windowscontainers/deploy-containers/version-compatibility?tabs=windows-server-2004%2Cwindows-10-2004#revision-number-patching

Signed-off-by: Micah Young <ymicah@vmware.com>
micahyoung pushed a commit to micahyoung/go-containerregistry that referenced this issue Aug 4, 2020
* Quick fix for missing `os` and `architecture` config properties, required by config spec [1]

* Also include unspec'd `os.version` property which is required for Windows images to run on Windows containers [2]

This implementation takes these three properties from newBase, which most accurately defines the newly rebased image's os/architecture. If the properties were taken from original, it would prevent reuse of de-facto ABI-compatible top layers with differing old and new base images (i.e. data-only top layers rebased from amd64 to arm, Windows os.version upgrades).

This does not address additional, optional config properties that are currently being omitted during rebase such as `author` and `created`.

Fixes [google#751]

[1]: https://github.com/opencontainers/image-spec/blob/master/config.md#properties
[2]: https://docs.microsoft.com/en-us/virtualization/windowscontainers/deploy-containers/version-compatibility#matching-container-host-version-with-container-image-versions

Signed-off-by: Micah Young <ymicah@vmware.com>
jonjohnsonjr pushed a commit that referenced this issue Aug 5, 2020
* Quick fix for missing `os` and `architecture` config properties, required by config spec [1]

* Also include unspec'd `os.version` property which is required for Windows images to run on Windows containers [2]

This implementation takes these three properties from newBase, which most accurately defines the newly rebased image's os/architecture. If the properties were taken from original, it would prevent reuse of de-facto ABI-compatible top layers with differing old and new base images (i.e. data-only top layers rebased from amd64 to arm, Windows os.version upgrades).

This does not address additional, optional config properties that are currently being omitted during rebase such as `author` and `created`.

Fixes [#751]

[1]: https://github.com/opencontainers/image-spec/blob/master/config.md#properties
[2]: https://docs.microsoft.com/en-us/virtualization/windowscontainers/deploy-containers/version-compatibility#matching-container-host-version-with-container-image-versions

Signed-off-by: Micah Young <ymicah@vmware.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants