rewrite-timestamp does not work well with COPY --link

[tatsuhiro-t]

It looks like rewrite-timestamp does not work very well with COPY --link.

Here is the reproducer:

Dockerfile

FROM gcr.io/distroless/base-nossl-debian12

COPY --link foo foo

Create file foo with touch foo.

Run builder daemon:

docker buildx create --driver=docker-container --name=dev --driver-opt image=moby/buildkit:master --bootstrap

Build image

docker buildx build --build-arg SOURCE_DATE_EPOCH=0 --output type=docker,rewrite-timestamp=true --builder=dev -t foo .
[+] Building 25.6s (9/9) FINISHED                                                                                                                            docker-container:dev
 => [internal] load build definition from Dockerfile                                                                                                                         0.0s
 => => transferring dockerfile: 101B                                                                                                                                         0.0s
 => [internal] load metadata for gcr.io/distroless/base-nossl-debian12:latest                                                                                                2.2s
 => [internal] load .dockerignore                                                                                                                                            0.0s
 => => transferring context: 2B                                                                                                                                              0.0s
 => [internal] load build context                                                                                                                                            0.1s
 => => transferring context: 24B                                                                                                                                             0.0s
 => [1/2] FROM gcr.io/distroless/base-nossl-debian12:latest@sha256:85b3e2536353e519ab650ade44935a91e83935efef6eb56dff0620a942466a3e                                          0.2s
 => => resolve gcr.io/distroless/base-nossl-debian12:latest@sha256:85b3e2536353e519ab650ade44935a91e83935efef6eb56dff0620a942466a3e                                          0.0s
 => [2/2] COPY --link foo foo                                                                                                                                                0.1s
 => ERROR exporting to docker image format                                                                                                                                   0.0s
 => => exporting layers                                                                                                                                                      0.0s
 => => rewriting layers with source-date-epoch 0 (1970-01-01 00:00:00 +0000 UTC)                                                                                            23.0s
------
 > exporting to docker image format:
------
ERROR: failed to solve: content digest sha256:2369c33f073ae935e1a0a5c3512446e661b865029a2a07941ee6c3c03d99da75: not found

Tried v0.13.0, failed with the same error.

Is this expected behavior? Without --link, it works nicely.

[tonistiigi]

Tentatively for v0.13.1 but needs to be investigated further

[AkihiroSuda]

• Avoid applying SOURCE_DATE_EPOCH to base images #4663

Looks like the base layers are still somehow clobbered