Docker PS filter by ancestor image does not match tagged images if image tag is omitted from filter

[jstangroome]

Output of docker version:

Client:
 Version:      1.11.1
 API version:  1.23
 Go version:   go1.5.4
 Git commit:   5604cbe
 Built:        Tue Apr 26 23:30:23 2016
 OS/Arch:      linux/amd64

Server:
 Version:      1.11.1
 API version:  1.23
 Go version:   go1.5.4
 Git commit:   5604cbe
 Built:        Tue Apr 26 23:30:23 2016
 OS/Arch:      linux/amd64

Output of docker info:

Containers: 3
 Running: 2
 Paused: 0
 Stopped: 1
Images: 147
Server Version: 1.11.1
Storage Driver: aufs
 Root Dir: /var/lib/docker/aufs
 Backing Filesystem: extfs
 Dirs: 119
 Dirperm1 Supported: false
Logging Driver: json-file
Cgroup Driver: cgroupfs
Plugins:
 Volume: local
 Network: null host bridge
Kernel Version: 3.13.0-85-generic
Operating System: Ubuntu 14.04.4 LTS
OSType: linux
Architecture: x86_64
CPUs: 1
Total Memory: 1.955 GiB
Name: vagrant
ID: 6CBX:BOQV:BMIC:BUAQ:5KLV:NSCL:ODPP:FEE3:DCOG:5TJE:Y3MU:3BFN
Docker Root Dir: /var/lib/docker
Debug mode (client): false
Debug mode (server): false
Registry: https://index.docker.io/v1/
WARNING: No swap limit support

Additional environment details (AWS, VirtualBox, physical, etc.):

Ubuntu 14.04 running inside Virtualbox 5

Steps to reproduce the issue:

1. docker run --detach ubuntu:16.04 /bin/sh -c 'sleep 86400'
2. docker ps --filter=ancestor=ubuntu:16.04
3. docker ps --filter=ancestor=ubuntu

Describe the results you received:

Step 2 returned the newly started container.
Step 3 returned no results.

Describe the results you expected:

Step 3 should have returned the same container as Step 2 did.

Or at the very least there should be a syntax for filtering by ancestor which allows matching on image name with varying tags. The documentation suggests this is possible by defining the :tag component of the ancestor image filter as optional.

Additional information you deem important (e.g. issue happens only occasionally):

Repeatable every time.

[thaJeztah]

This is most likely because your ubuntu:latest image is not up to date. I was able to reproduce in this situation, but not after the ubuntu image was updated;

Situation 1 (ubuntu:latest out of date):

$ docker images

REPOSITORY                         TAG                 IMAGE ID            CREATED             SIZE
ubuntu                             16.04                                                 cf62323fa025        5 days ago          125 MB
....
ubuntu                             latest                                                c5f1cf30c96b        10 weeks ago        120.8 MB

$ docker run -dit ubuntu:16.04
ef296d58096d187c61ba2725b3f6064d0731c9d2e808bd49bc0e64a233ddd97a

$docker ps --filter=ancestor=ubuntu:16.04

CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS              PORTS               NAMES
ef296d58096d        ubuntu:16.04        "/bin/bash"         10 seconds ago      Up 9 seconds                            prickly_lichterman

$ docker ps --filter=ancestor=ubuntu
CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS              PORTS               NAMES

However, after updating the ubuntu:latest image, it works;

$ docker pull ubuntu:latest
latest: Pulling from library/ubuntu
Digest: sha256:ba1688fec34f66d8a7ff5b42e6971625d8232c72bf0e38ad06dda10cad157293
Status: Downloaded newer image for ubuntu:latest

$docker ps --filter=ancestor=ubuntu:16.04

CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS              PORTS               NAMES
ef296d58096d        ubuntu:16.04        "/bin/bash"         10 seconds ago      Up 9 seconds                            prickly_lichterman

$ docker ps --filter=ancestor=ubuntu

CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS              PORTS               NAMES
ef296d58096d        ubuntu:16.04        "/bin/bash"         34 seconds ago      Up 33 seconds                           prickly_lichterman

As far as I can see, there's no bug, so I'm closing this, but feel free to comment after I closed

[jstangroome]

Hi @thaJeztah,

I had incorrectly assumed that omitting the tag from the filter would return all containers using that image with any tag. I have confirmed since that the documentation does indeed state this, but I missed it.

It would, however, be a very useful feature to be able to filter for all containers based on a named image with any tag variant, something like:

$ docker pull ubuntu:15.04
$ docker pull ubuntu:16.04
$ docker pull ubuntu:latest
$ docker run --detach ubuntu:15.04 /bin/sh -c 'sleep 86400'
$ docker run --detach ubuntu:16.04 /bin/sh -c 'sleep 86400'

$ docker ps --filter=ancestor=ubuntu:*

CONTAINER ID        IMAGE                       COMMAND                  CREATED             STATUS              PORTS                                            NAMES
27f80de9e62f        ubuntu:15.04                "/bin/sh -c 'sleep 86"   12 minutes ago      Up 12 minutes                                                        tiny_saha
1de3647b49af        ubuntu:16.04                "/bin/sh -c 'sleep 86"   13 minutes ago      Up 13 minutes                                                        hopeful_joliot

Thanks for your time.

[SebastianKristof]

Excuse me, but how is this not a bug?

after updating the ubuntu:latest image, it works

Why does it work after updating the latest image? Is it documented anywhere? How is this logical that it should NOT work if the "latest" image is not present on the machine? Maybe I remove the "latest" image tomorrow, does it mean all my scripts should stop working? and you call this a feature not a bug?

I've experienced a tremendous amount of frustration trying to figure this out. At the very least, this should be clearly documented. Thank you in advance for taking another look at it.

[SebastianKristof]

Hi Sebastiaan @thaJeztah,

The solution is not working for me, unfortunately.

I have the latest image (freshly pulled):

docker image ls | grep nats-streaming
nats-streaming                                      latest                                           993a204b5325        5 weeks ago         18.5MB
nats-streaming                                      0.15.1                                           cda16c83dcc1        18 months ago       14.7MB
nats-streaming                                      0.12.0-linux                                     0513030f6df3        22 months ago       12.9MB

The 0.15.1 image is running:

docker ps | grep nats-streaming             
332d4bc1b1ba        nats-streaming:0.15.1                    "/nats-streaming-ser…"   12 days ago         Up 12 days          0.0.0.0:4222->4222/tcp, 0.0.0.0:32816->8222/tcp   focused_pascal

The filter command with a tag works:

docker ps --filter ancestor="nats-streaming:0.15.1"
CONTAINER ID        IMAGE                   COMMAND                  CREATED             STATUS              PORTS                                             NAMES
332d4bc1b1ba        nats-streaming:0.15.1   "/nats-streaming-ser…"   12 days ago         Up 12 days          0.0.0.0:4222->4222/tcp, 0.0.0.0:32816->8222/tcp   focused_pascal

The filter command without a tag still doesn't work:

docker ps --filter ancestor="nats-streaming"
CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS              PORTS               NAMES

Please help.

[thaJeztah]

Does the nats-streaming:0.15.1 have any relation with the nats-streaming:latest image? I think the confusion here is that ancestor=nats-streaming is the equivalent of nats-streaming:latest. The filter checks if the container was started from nats-streaming:latest (or a descendant of that image). At least, that's how I recall the filter was implemented (but it's been a while since I looked at the implementation).

Perhaps instead of using the default :latest, the filter should produce an error that no tag was specified.

[SebastianKristof]

Good question! Ideally I would think that it should support a wildcard for the tag. But the whole "ancestor" thing is fuzzy, because you're right, it could be based on which image was pulled first and then what layers were added later. But all we need is just a "simple" text search.

For context, what I'm trying to do is make sure I stop all instances of certain containers to free up the ports. So in a script I have lines like:

docker stop $(docker ps -a -q  --filter ancestor="nats-streaming")

I could of course do some grep magic but I would have thought that it should be doable with a straight docker command.

Perhaps there are other solutions I'm not thinking of?

Update: the difficulty with grep is that I also have some containers running in kubernetes that I don't want to touch. They are based on custom images but would also match for nats-streaming (in this case). So filtering the running containers by their underlying image would work, but the grep search might find all the images, including the kubernetes ones.

[CharlesB2]

When working with your own images, best workaround I found is to filter by label, provided that all your images have a common one (easy to add).

Example in your docker file (or use the --label switch to docker build:

LABEL com.example.sometag=""

Then match containers running with this image with :

docker ps --filter label=com.example.sometag

Of course this doesn't work for upstream images, if it's the case may want to inspect them and see if they share a label you could use for filter.