Fix platform image wait ref and binfmt EEXIST handling

Author: cursoragent

lib/instances/create.go

@@ -608,11 +608,18 @@ func resolveImageForCreate(ctx context.Context, imageManager createImageResolver
 		if err != nil {
 			return nil, fmt.Errorf("resolve image %s for platform %s: %w", imageName, platform, err)
 		}
+		resolvedName := img.Name
+		if img.Digest != "" {
+			resolvedName, err = imageDigestRef(img.Name, img.Digest)
+			if err != nil {
+				return nil, fmt.Errorf("build resolved image ref: %w", err)
+			}
+		}
 		if img.Status != images.StatusReady {
-			if err := waitForImagePull(ctx, imageManager, img.Name, log); err != nil {
+			if err := waitForImagePull(ctx, imageManager, resolvedName, log); err != nil {
 				return nil, err
 			}
-			img, err = imageManager.GetImage(ctx, img.Name)
+			img, err = imageManager.GetImage(ctx, resolvedName)
 			if err != nil {
 				return nil, fmt.Errorf("get image after platform resolve: %w", err)
 			}
@@ -648,6 +655,14 @@ func resolveImageForCreate(ctx context.Context, imageManager createImageResolver
 	return img, nil
 }
 
+func imageDigestRef(imageName, digest string) (string, error) {
+	ref, err := images.ParseNormalizedRef(imageName)
+	if err != nil {
+		return "", fmt.Errorf("parse image ref %q: %w", imageName, err)
+	}
+	return ref.Repository() + "@" + digest, nil
+}
+
 func waitForImagePull(ctx context.Context, imageManager createImageResolver, imageName string, log *slog.Logger) error {
 	pullCtx, pullCancel := context.WithTimeout(ctx, 5*time.Second)
 	defer pullCancel()

lib/instances/create_image_test.go

@@ -95,6 +95,67 @@ func TestResolveImageForCreateRejectsResolvedPlatformMismatch(t *testing.T) {
 	}
 }
 
+func TestResolveImageForCreateWithPlatformWaitsOnResolvedDigest(t *testing.T) {
+	t.Parallel()
+
+	const digest = "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+	const tagRef = "docker.io/library/alpine:3.19"
+	const digestRef = "docker.io/library/alpine@" + digest
+
+	waitName := ""
+	getNames := make([]string, 0, 2)
+	resolver := createImageResolverFake{
+		getImage: func(_ context.Context, name string) (*images.Image, error) {
+			getNames = append(getNames, name)
+			switch name {
+			case digestRef:
+				return &images.Image{
+					Name:     tagRef,
+					Digest:   digest,
+					Platform: "linux/amd64",
+					Status:   images.StatusReady,
+				}, nil
+			case tagRef:
+				return &images.Image{
+					Name:     tagRef,
+					Digest:   "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+					Platform: "linux/arm64",
+					Status:   images.StatusReady,
+				}, nil
+			default:
+				t.Fatalf("unexpected GetImage name %q", name)
+				return nil, nil
+			}
+		},
+		createImage: func(_ context.Context, req images.CreateImageRequest) (*images.Image, error) {
+			return &images.Image{
+				Name:     req.Name,
+				Digest:   digest,
+				Platform: "linux/amd64",
+				Status:   images.StatusPending,
+			}, nil
+		},
+		waitReady: func(_ context.Context, name string) error {
+			waitName = name
+			return nil
+		},
+	}
+
+	img, err := resolveImageForCreate(context.Background(), resolver, tagRef, "linux/amd64", slog.Default())
+	if err != nil {
+		t.Fatalf("resolve image: %v", err)
+	}
+	if waitName != digestRef {
+		t.Fatalf("expected WaitForReady on %q, got %q", digestRef, waitName)
+	}
+	if len(getNames) != 1 || getNames[0] != digestRef {
+		t.Fatalf("expected GetImage on %q, got %#v", digestRef, getNames)
+	}
+	if img.Platform != "linux/amd64" {
+		t.Fatalf("expected amd64 image, got %s", img.Platform)
+	}
+}
+
 func TestResolveImageForCreateWithoutPlatformUsesExistingImage(t *testing.T) {
 	t.Parallel()
 

lib/system/init/rosetta.go

@@ -107,7 +107,7 @@ func registerBinfmt(rule string) error {
 // alreadyRegistered reports whether a binfmt_misc register write failed only
 // because a handler of that name already exists (EEXIST).
 func alreadyRegistered(err error) bool {
-	return errors.Is(err, fs.ErrExist)
+	return errors.Is(err, fs.ErrExist) || errors.Is(err, syscall.EEXIST)
 }
 
 // writeBinfmtdConf drops a systemd binfmt.d config that re-registers Rosetta

lib/system/init/rosetta_test.go

@@ -3,6 +3,7 @@ package main
 import (
 	"errors"
 	"io/fs"
+	"os"
 	"strings"
 	"syscall"
 	"testing"
@@ -37,6 +38,7 @@ func TestRosettaAlreadyRegistered(t *testing.T) {
 	// EEXIST means a :rosetta: handler is already registered; treat it as success.
 	assert.True(t, alreadyRegistered(syscall.EEXIST))
 	assert.True(t, alreadyRegistered(fs.ErrExist))
+	assert.True(t, alreadyRegistered(&os.PathError{Op: "write", Path: binfmtRegister, Err: syscall.EEXIST}))
 	// Any other error (or none) is not an "already registered" condition.
 	assert.False(t, alreadyRegistered(nil))
 	assert.False(t, alreadyRegistered(syscall.EACCES))