Use digests when pulling mkimage images.

[rn]

With DOCKER_CONTENT_TRUST=1 docker run :
the docker command will print on stdout something like:

Tagging with ... on the first pull which then ends
up the in the output image.

Pulling with digest stops that message

Signed-off-by: Rolf Neugebauer rolf.neugebauer@docker.com

[ijc]

This seems OK as a workaround for now, but this shouldn't be needed -- I think it is a moby bug if it is logging to stdout when it is not a tty, since it breaks the docker run image:tag cat foo use case. Shall we have a moby/moby or moby/cli bug to go with it?

[ijc]

Hrm. should we be using --attach=STDIN rather than -i? Maybe this is our fault?

[rn]

I’m on a bus to an airport so can’t test. But if you have a better fix that would be great

…

On 20 Oct 2017, at 15:59, Ian Campbell ***@***.***> wrote: Hrm. should we be using --attach=STDIN rather than -i? Maybe this is our fault? — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub, or mute the thread.

[ijc]

I'm having a play now.

[ijc]

I can't seem to repro the behaviour seen in linuxkit/linuxkit#2612 with 17.09 or 17.10, either with moby tool with

moby build -format gcp linuxkit.yml

or manually with:

$ moby build -format tar-kernel-initrd linuxkit.yml
$ cat linuxkit-initrd.tar |  docker run --network=none --rm -i linuxkit/mkimage-gcp:d1883809d212ce048f60beb0308a4d2b14c256af  > bar

Maybe it is related to the version of docker? I'll try some older versions.

[ijc]

I needed to docker rmi more thoroughly to provoke the pull and print. I can now reproduce with 17.06 and 17.10.

[ijc]

Using --attach=stdin --attach=stdout doesn't work at all. Combining with -i doesn't avoid the issue seen here, which is due to https://github.com/docker/cli/blob/master/cli/command/image/trust.go#L358.

Doing the pull separately first does avoid the issue, which might be better than having to mess around with digests until Docker CLI can be fixed, it's slightly racy in that someone could delete the image between the pull and the run, but that seems unlikely...

[ijc]

Reported at docker/cli#631.

I have an alternative workaround at #171.

[justincormack]

Closing as merged #171