docker run with sha

[johanneswuerbach]

Description

docker run fails to run images by digest without the sha256: prefix with version 20.10.0-beta1.

Steps to reproduce the issue:

1. New behaviour

$ docker version
20.10.0-beta1
$ docker build --pull -q . -f-<<EOF
FROM busybox
CMD echo "hello world"
EOF
sha256:9b3cf996b8a64e68ab6b9342b7cda274f63085ac303d9d55e33a3349dcff8f36
$ docker run --rm 9b3cf996b8a64e68ab6b9342b7cda274f63085ac303d9d55e33a3349dcff8f36
docker: Error response from daemon: invalid repository name (9b3cf996b8a64e68ab6b9342b7cda274f63085ac303d9d55e33a3349dcff8f36), cannot specify 64-byte hexadecimal strings.

2. Previous behaviour

$ docker version
19.03.12
$ docker build --pull -q . -f-<<EOF
FROM busybox
CMD echo "hello world"
EOF
sha256:1c1941709ada55146ea0b49b18a59b463feeb9f4de0acedb0620e6f034b54bd9
$ docker run --rm 1c1941709ada55146ea0b49b18a59b463feeb9f4de0acedb0620e6f034b54bd9
hello world

Reading the docs it isn't fully clear to me whether this way to run was supported https://docs.docker.com/engine/reference/commandline/run/, but it is also not listed as breaking change in https://github.com/docker/docker-ce/blob/0fc7084265b3786a5867ec311d3f916af7bf7a23/CHANGELOG.md

This change was likely introduced in #1498 where the image is pulled now before being created, while it was just created before.

[tianon]

This is an interesting one, and is definitely in dockerd (not in the CLI):

$ /usr/bin/docker version
Client: Docker Engine - Community
 Version:           19.03.12
 API version:       1.40
 Go version:        go1.13.10
 Git commit:        48a66213fe
 Built:             Mon Jun 22 15:45:50 2020
 OS/Arch:           linux/amd64
 Experimental:      false

Server: Docker Engine - Community
 Engine:
  Version:          20.10.0-beta1
  API version:      1.41 (minimum version 1.12)
  Go version:       go1.13.15
  Git commit:       9c15e82
  Built:            Tue Oct 13 18:17:18 2020
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          v1.4.1
  GitCommit:        c623d1b36f09f8ef6536a057bd658b3aa8632828
 runc:
  Version:          1.0.0-rc92
  GitCommit:        ff819c7e9184c13b7c2607fe6c30ae19403a7aff
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

$ /usr/bin/docker pull bash
Using default tag: latest
latest: Pulling from library/bash
Digest: sha256:01fad26fa8ba21bce6e8c47222acfdb54649957f1e86d53a0c8e03360271abf6
Status: Image is up to date for bash:latest
docker.io/library/bash:latest

$ /usr/bin/docker images --no-trunc bash
REPOSITORY          TAG                 IMAGE ID                                                                  CREATED             SIZE
bash                latest              sha256:39a95ac320110ef1a6ec21e7751ad39952fdad619fe15725b182cb2e34f92fe4   3 weeks ago         13.1MB

$ /usr/bin/docker run --rm 39a95ac320110ef1a6ec21e7751ad39952fdad619fe15725b182cb2e34f92fe4
docker: Error response from daemon: invalid repository name (39a95ac320110ef1a6ec21e7751ad39952fdad619fe15725b182cb2e34f92fe4), cannot specify 64-byte hexadecimal strings.

It works successfully if I remove even one character (because it then becomes a "short ID").

[tonistiigi]

I bisected this and it was already fixed with moby/moby#41641 in master @thaJeztah @cpuguy83

[thaJeztah]

Thanks @tonistiigi ! (and thanks for reporting @johanneswuerbach 👍)

[cpuguy83]

Nice, glad I could unknowingly fix that!