compatability with 'docker inspect' - .ContainerConfig vs .Config

[ansemjo]

Is this a BUG REPORT or FEATURE REQUEST?:
kind bug

Description

A while ago I tried to transition from Docker to podman for building and pushing images to a Flynn cluster. The Flynn CLI runs docker inspect before pushing and looks at .Config to get some metadata about the image. Since the {{ .Config }} field is empty in podman inspect's output I originally thought to patch the Flynn CLI, since Docker also provides a .ContainerConfig field --> flynn/flynn#4466

However, it seems that .Config and .ContainerConfig are different things in Docker? I am not entirely sure of the difference but @lmars provided an example in flynn/flynn#4466 (comment) showing the difference. It seems that if podman aims for compatability with docker it should provide identical output during podman inspect?

Steps to reproduce the issue:

1. Build an image configtest from this Dockerfile:

FROM busybox
ENTRYPOINT ["/bin/echo"]
CMD ["hello world"]
ENV FOO BAR
RUN /bin/echo image command

2. Compare {docker,podman} inspect -f '{{ json {.Config,.ContainerConfig} }}' configtest output:

$ podman inspect -f '{{ json .Config }}' configtest | jq '{ Entrypoint: .Entrypoint, Cmd: .Cmd, Env: .Env }'
<no output>

$ podman inspect -f '{{ json .ContainerConfig }}' configtest | jq '{ Entrypoint: .Entrypoint, Cmd: .Cmd, Env: .Env }'
{
  "Entrypoint": [
    "/bin/echo"
  ],
  "Cmd": [
    "hello world"
  ],
  "Env": [
    "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
    "FOO=BAR"
  ]
}

$ docker inspect -f '{{ json .ContainerConfig }}' configtest | jq '{ Entrypoint: .Entrypoint, Cmd: .Cmd, Env: .Env }'
{
  "Entrypoint": null,
  "Cmd": [
    "/bin/sh",
    "-c",
    "/bin/echo image command"
  ],
  "Env": [
    "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
    "FOO=BAR"
  ]
}

$ docker inspect -f '{{ json .Config }}' configtest | jq '{ Entrypoint: .Entrypoint, Cmd: .Cmd, Env: .Env }'
{
  "Entrypoint": [
    "/bin/echo"
  ],
  "Cmd": [
    "hello world"
  ],
  "Env": [
    "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
    "FOO=BAR"
  ]
}

Describe the results you received:

See above, podman/.ContainerConfig is identical to docker/.Config but podman/.Config is entirely empty.

Describe the results you expected:

I would expect podman inspect -f '{{ json .Config }}' configtest to provide identical output to docker inspect -f '{{ json .Config }}' configtest.

Additional information you deem important (e.g. issue happens only occasionally):

Issue #305 and pull request #306 seem to be related to this?

Output of podman version:

$ podman version
Version:       0.12.1.1
Go Version:    go1.11.2
Git Commit:    "d244410cec702abc8db331025169ed5c83c3f9c7"
Built:         Tue Dec 11 23:00:19 2018
OS/Arch:       linux/amd64

Output of podman info:

$ podman info
host:
  BuildahVersion: 1.6-dev
  Conmon:
    package: Unknown
    path: /usr/libexec/crio/conmon
    version: 'conmon version 1.13.0, commit: e8a2525c2e7f5ab057d5a2b5f1950be5643d8053-dirty'
  Distribution:
    distribution: arch
    version: unknown
  MemFree: 902705152
  MemTotal: 8259219456
  OCIRuntime:
    package: Unknown
    path: /usr/bin/runc
    version: |-
      runc version 1.0.0-rc5+dev
      commit: 079817cc26ec5292ac375bb9f47f373d33574949
      spec: 1.0.1-dev
  SwapFree: 4288671744
  SwapTotal: 4294963200
  arch: amd64
  cpus: 4
  hostname: thinkmett
  kernel: 4.19.8-arch1-1-ARCH
  os: linux
  rootless: true
  uptime: 50h 58m 42.94s (Approximately 2.08 days)
insecure registries:
  registries: []
registries:
  registries:
  - docker.io
  - registry.fedoraproject.org
  - quay.io
  - registry.access.redhat.com
  - registry.centos.org
store:
  ContainerStore:
    number: 0
  GraphDriverName: overlay
  GraphOptions:
  - overlay.mount_program=/usr/bin/fuse-overlayfs
  GraphRoot: /home/ansemjo/.local/share/containers/storage
  GraphStatus:
    Backing Filesystem: btrfs
    Native Overlay Diff: "false"
    Supports d_type: "true"
  ImageStore:
    number: 12
  RunRoot: /run/user/1000

Additional environment details (AWS, VirtualBox, physical, etc.):

[baude]

@rhatdan wdyt?

[rhatdan]

@ansemjo Could you verify that we are comparing apples to apples.
You might be comparing a OCI image to a Docker image.

Could you see if this works better with

podman build --format docker ...

Which should cause podman to build a docker image.

[ansemjo]

Building the configtest image from the above Dockerfile with $ podman build --format docker -t configtest . yields the same results:

$ podman inspect -f '{{ json .Config }}' configtest | jq '{ Entrypoint: .Entrypoint, Cmd: .Cmd, Env: .Env }'
$ podman inspect -f '{{ json .ContainerConfig }}' configtest | jq '{ Entrypoint: .Entrypoint, Cmd: .Cmd, Env: .Env }'
{
  "Entrypoint": [
    "/bin/echo"
  ],
  "Cmd": [
    "hello world"
  ],
  "Env": [
    "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
    "FOO=BAR"
  ]
}

There simply is no .Config section in podman inspect's output.

---

Exporting the image from Docker and reimporting it in podman does not yield any different results either:

$ docker save -o configtest.tar configtest
$ podman rmi -f configtest
$ podman load -i configtest.tar
$ podman inspect -f '{{ json .Config }}' configtest
<no output>

---

There is one when actually running though:

$ podman run configtest
hello world
$ podman inspect -l -f '{{ json .Config }}' | jq .
{
  ...
  "Cmd": [
    "/bin/echo",
    "hello world"
  ],
  "Image": "localhost/configtest:latest",
  ...
}

This is different from but consistent with (in that it exists and contains all the expected keys) the output of docker inspect on a stopped container. In this case both podman and docker do not contain any .ContainerConfig section anymore, which is expected I guess.

[rhatdan]

Ok, seems like a fairly big bug. @baude could you look at this.

[rhatdan]

This should be fixed in upstream podman.