Is there any alternatives like docker buildx imagetools ?

[rhatdan]

Discussed in #20972

^{Originally posted by abcfy2 December 11, 2023}
Hi there. Docker cli has a useful docker buildx imagetools could show remote image informations, like supported platforms and sha256.

# docker buildx imagetools inspect python
Name:      docker.io/library/python:latest
MediaType: application/vnd.docker.distribution.manifest.list.v2+json
Digest:    sha256:6d7fa2d5653e1d0eb464a672ded01f973e49e4a7ded59703c7bdcf6b92eac736
           
Manifests: 
  Name:      docker.io/library/python:latest@sha256:c50322f5f9b2a3b7ac68dc3cf03e5b29d7f51faa58b8321d975f028eb0c00a73
  MediaType: application/vnd.docker.distribution.manifest.v2+json
  Platform:  linux/amd64
             
  Name:      docker.io/library/python:latest@sha256:037769815b6dd0308f753f767a8c342bc19352e11dc90ce9d626de91418a3484
  MediaType: application/vnd.docker.distribution.manifest.v2+json
  Platform:  linux/arm/v5
             
  Name:      docker.io/library/python:latest@sha256:470bd7fc3c9a7c210117b0817d43b99edd20b7f00d3e786f9f3c15400646957f
  MediaType: application/vnd.docker.distribution.manifest.v2+json
  Platform:  linux/arm/v7
             
  Name:      docker.io/library/python:latest@sha256:988ea4571fd487040a1da82cb35e043de818440a311ddc90f2b9f8dbac54895c
  MediaType: application/vnd.docker.distribution.manifest.v2+json
  Platform:  linux/arm64/v8
             
  Name:      docker.io/library/python:latest@sha256:5640f12b97e7adb328d974a8e7f7f646d0f1ae8c7e2dd37a870c5b66672c744c
  MediaType: application/vnd.docker.distribution.manifest.v2+json
  Platform:  linux/386
             
  Name:      docker.io/library/python:latest@sha256:ae51250796ac9e55dab64c7b9dbae8294059ce4eb043e7695efb3f1f423f5253
  MediaType: application/vnd.docker.distribution.manifest.v2+json
  Platform:  linux/ppc64le
             
  Name:      docker.io/library/python:latest@sha256:bab5712f7ee4c9ea067db88c9b0314b7e808b2e33d078a284cef9e2bec78cbc0
  MediaType: application/vnd.docker.distribution.manifest.v2+json
  Platform:  linux/s390x
             
  Name:      docker.io/library/python:latest@sha256:33684f884e422f87e4a47a182d96b4d7c15b93781ce1627ef067dd46b980ad5e
  MediaType: application/vnd.docker.distribution.manifest.v2+json
  Platform:  windows/amd64
  OSVersion: 10.0.20348.2113
             
  Name:      docker.io/library/python:latest@sha256:a13d5420b7c208547f949dcb6c46353020421859c76066b562f35ab1ecdf2a5e
  MediaType: application/vnd.docker.distribution.manifest.v2+json
  Platform:  windows/amd64
  OSVersion: 10.0.17763.5122

Is there any alternatives in podman ?

Thanks.

[vrothberg]

Let's discuss in #20972 first whether this should be done.

[github-actions]

A friendly reminder that this issue had no activity for 30 days.

[pixelsoccupied]

Hello! Would love build this feature if no one is else working on it :)

• Basically you would like two cmds i.e podman imagetools inspect ... and podman imagetools create ...? Maybe i'll start with inspect first?
• I can grab the data from skopeo inspect just like it's been suggesting in the Discussions thread? Do you think i could just exec call skopeo? Or maybe there's a way import skopeo funcs?

Any tips/tricks/suggestions appreciated!

[vrothberg]

Hello! Would love build this feature if no one is else working on it :)

Thanks!

* Basically you would like two cmds i.e `podman imagetools inspect ...` and `podman imagetools create ...`? Maybe i'll start with `inspect` first?

I leave that up to you :) podman image inspect already exists but it works only on images in the local storage; not with images on a remote registry.

* I can grab the data from `skopeo inspect` just like it's been suggesting in the Discussions thread? 

That the depends on the goal we decide on; I don't think we decided that yet. In my opinion, I don't think it's sustainable to continue chasing Docker or buildkit. The projects evolve and mature and at some point, Podman should allow itself to diverge. Podman has achieved feature parity in the past, so I think the goal has been met.

That doesn't mean I would block this work. But I want to highlight that there are tradeoffs to effectively chase/copy.

Do you think i could just exec call skopeo? Or maybe there's a way import skopeo funcs?

Skopeo and Podman share the underlying libraries doing all the heavy lifting and work. In the case of images, the common library lives at https://github.com/containers/image. You can follow the code paths of skopeo inspect to see how a remote image is being inspected.

[rhatdan]

We have discussed remote scanning of manifest and manifests list for years and have told people to use skopeo. In another PR we discussed shipping skopeo with podman in a podman machine, but right now think it takes up too much space. In my opinion the proper action is to add this ability to Podman. I think following Docker CLI makes sense if we need and want the feature.

It should be done using containers/image directly rather then execing skopeo.

[vrothberg]

@rhatdan I agree in spirit. But part of this conversation here is to mimic Docker/buildkit. That would imply returning the same data and having to continue chasing down future changes etc.

I am advocating to discuss implementing what we/this community needs. So we may decide to implement remote inspection but rather than copying Docker, we can just make this part of podman image inspect.

[pixelsoccupied]

FWIW as a regular docker user who is looking to migrate/integrate more podman in local env...I usually just replace docker with podman and see if the feature I'm looking for is already there.

In this case i know buildx is docker only so i just drop that and just do podman imagetools inspect python and see what the cli throws back!

maybe I'm doing it wrong? let me know what you think!

[rhatdan]

No makes sense. Podman has some buildx support, in that podman build supports many buildx features. It even has a hidden feature where podman buildx build ends up as podman build More advanced features of buildx are not implemented and are not likely unless they become hugely popular.

[rhatdan]

docker buildx imagetools inspect quay.io/podman/stable
should be something like

podman image inspect --atregistry quay.io/podman/stable

Or something like this.

[pixelsoccupied]

A quick update.

I was able to run the skopeo image and podman locally and played around the code a bit. Checked out how skopeo calls image for all the registry data...which we can bring to podman as well.

Just to confirm...how do would we like the output of podman image inspect --atregistry quay.io/podman/stable look like? Essentially a prettified json dump of docker_client.go's fetchManifest? e.g

# podman image inspect --atregistry quay.io/podman/stable
{
  "schemaVersion": 2,
  "mediaType": "application/vnd.oci.image.index.v1+json",
  "manifests": [
    {
      "mediaType": "application/vnd.oci.image.manifest.v1+json",
      "digest": "sha256:0b486c12d65bbde73df70a938310ace1e79e7164261e946739858224094e865c",
      "size": 2713,
      "platform": {
        "architecture": "arm64",
        "os": "linux"
      }
    },
    {
      "mediaType": "application/vnd.oci.image.manifest.v1+json",
      "digest": "sha256:8d254398aac602ba4e0da48e2e1e29da999babe2aa198128bd3b9585db999caa",
      "size": 2713,
      "platform": {
        "architecture": "amd64",
        "os": "linux"
      }
    },
    {
      "mediaType": "application/vnd.oci.image.manifest.v1+json",
      "digest": "sha256:03d4fb3843463092f91cc23f761f8839ff809942d4116cd3c15b1d27e59c1a7e",
      "size": 2713,
      "platform": {
        "architecture": "s390x",
        "os": "linux"
      }
    },
    {
      "mediaType": "application/vnd.oci.image.manifest.v1+json",
      "digest": "sha256:4c75d83acecf27891517319026127b8abc85329718ed03adedfebe3bda321977",
      "size": 2633,
      "platform": {
        "architecture": "ppc64le",
        "os": "linux"
      }
    }
  ]
}