Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: update kaniko fork to fix BLOB_UNKNOWN errors #410

Merged
merged 6 commits into from
Nov 20, 2024
Merged

fix: update kaniko fork to fix BLOB_UNKNOWN errors #410

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
ac450a6
fix: avoid BLOB_UNKNOWN by not enabling ForceBuildMetadata
mafredri Nov 7, 2024
9df56fc
dbg
mafredri Nov 7, 2024
4b71b24
update fork and add test
mafredri Nov 20, 2024
9347b30
Commentary
mafredri Nov 20, 2024
d72eaff
fork you very much
mafredri Nov 20, 2024
e32de98
Merge branch 'main' into mafredri/fix-push-unknown-blob
mafredri Nov 20, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,7 +67,7 @@ test-registry-container: .registry-cache

# Pulls images referenced in integration tests and pushes them to the local cache.
.PHONY: test-images-push
test-images-push: .registry-cache/docker/registry/v2/repositories/envbuilder-test-alpine .registry-cache/docker/registry/v2/repositories/envbuilder-test-ubuntu .registry-cache/docker/registry/v2/repositories/envbuilder-test-codercom-code-server
test-images-push: .registry-cache/docker/registry/v2/repositories/envbuilder-test-alpine .registry-cache/docker/registry/v2/repositories/envbuilder-test-ubuntu .registry-cache/docker/registry/v2/repositories/envbuilder-test-codercom-code-server .registry-cache/docker/registry/v2/repositories/envbuilder-test-blob-unknown

.PHONY: test-images-pull
test-images-pull:
Expand All @@ -77,6 +77,7 @@ test-images-pull:
docker tag ubuntu:latest localhost:5000/envbuilder-test-ubuntu:latest
docker pull codercom/code-server:latest
docker tag codercom/code-server:latest localhost:5000/envbuilder-test-codercom-code-server:latest
docker build -t localhost:5000/envbuilder-test-blob-unknown:latest -f integration/testdata/blob-unknown/Dockerfile integration/testdata/blob-unknown

.registry-cache:
mkdir -p .registry-cache && chmod -R ag+w .registry-cache
Expand All @@ -89,3 +90,6 @@ test-images-pull:

.registry-cache/docker/registry/v2/repositories/envbuilder-test-codercom-code-server:
docker push localhost:5000/envbuilder-test-codercom-code-server:latest

.registry-cache/docker/registry/v2/repositories/envbuilder-test-blob-unknown:
docker push localhost:5000/envbuilder-test-blob-unknown:latest
10 changes: 10 additions & 0 deletions envbuilder.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -583,6 +583,16 @@ func run(ctx context.Context, opts options.Options, execArgs *execArgsInfo) erro
endStage("🏗️ Built image!")
if opts.PushImage {
endStage = startStage("🏗️ Pushing image...")

// To debug registry issues, enable logging:
//
// import (
// stdlog "log"
// reglogs "github.com/google/go-containerregistry/pkg/logs"
// )
// reglogs.Debug = stdlog.New(os.Stderr, "", 0)
// reglogs.Warn = stdlog.New(os.Stderr, "", 0)
// reglogs.Progress = stdlog.New(os.Stderr, "", 0)
Comment on lines +587 to +595
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

non-blocking potential follow-up: we could conditionally enable this?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I thought about it, but was too tired to think of how to expose it 😄. I'd also not use os.Stderr but instead wrap the logger we have.

I don't think we want to enable this with ENVBUILDER_VERBOSE=1, we'd probably want to introduce debug/trace.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yup, but we can worry about that later!

if err := executor.DoPush(image, kOpts); err == nil {
endStage("🏗️ Pushed image!")
} else if !opts.ExitOnPushFailure {
Expand Down
2 changes: 1 addition & 1 deletion go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ go 1.22.4

// There are a few options we need added to Kaniko!
// See: https://github.com/GoogleContainerTools/kaniko/compare/main...coder:kaniko:main
replace github.com/GoogleContainerTools/kaniko => github.com/coder/kaniko v0.0.0-20241028054616-350cbb820e05
replace github.com/GoogleContainerTools/kaniko => github.com/coder/kaniko v0.0.0-20241120132148-131d6094d781

// Required to import codersdk due to gvisor dependency.
replace tailscale.com => github.com/coder/tailscale v1.1.1-0.20240702054557-aa558fbe5374
Expand Down
4 changes: 2 additions & 2 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -171,8 +171,8 @@ github.com/cockroachdb/errors v1.2.4/go.mod h1:rQD95gz6FARkaKkQXUksEje/d9a6wBJoC
github.com/cockroachdb/logtags v0.0.0-20190617123548-eb05cc24525f/go.mod h1:i/u985jwjWRlyHXQbwatDASoW0RMlZ/3i9yJHE2xLkI=
github.com/coder/coder/v2 v2.10.1-0.20240704130443-c2d44d16a352 h1:L/EjCuZxs5tOcqqCaASj/nu65TRYEFcTt8qRQfHZXX0=
github.com/coder/coder/v2 v2.10.1-0.20240704130443-c2d44d16a352/go.mod h1:P1KoQSgnKEAG6Mnd3YlGzAophty+yKA9VV48LpfNRvo=
github.com/coder/kaniko v0.0.0-20241028054616-350cbb820e05 h1:KZc6vG/WnSWG8RtUevGrCdZbF7XJaaZ32ocig6sZLQk=
github.com/coder/kaniko v0.0.0-20241028054616-350cbb820e05/go.mod h1:3rM/KOQ4LgF8mE+O1P6pLDa/E57mzxIxNdUOMKi1qpg=
github.com/coder/kaniko v0.0.0-20241120132148-131d6094d781 h1:/4SMdrjLQL1BseLSnMd9nYQSI+E63CXcyFGC7ZHHj8I=
github.com/coder/kaniko v0.0.0-20241120132148-131d6094d781/go.mod h1:3rM/KOQ4LgF8mE+O1P6pLDa/E57mzxIxNdUOMKi1qpg=
github.com/coder/pretty v0.0.0-20230908205945-e89ba86370e0 h1:3A0ES21Ke+FxEM8CXx9n47SZOKOpgSE1bbJzlE4qPVs=
github.com/coder/pretty v0.0.0-20230908205945-e89ba86370e0/go.mod h1:5UuS2Ts+nTToAMeOjNlnHFkPahrtDkmpydBen/3wgZc=
github.com/coder/quartz v0.1.0 h1:cLL+0g5l7xTf6ordRnUMMiZtRE8Sq5LxpghS63vEXrQ=
Expand Down
41 changes: 38 additions & 3 deletions integration/integration_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,9 +57,10 @@ import (
)

const (
testContainerLabel = "envbox-integration-test"
testImageAlpine = "localhost:5000/envbuilder-test-alpine:latest"
testImageUbuntu = "localhost:5000/envbuilder-test-ubuntu:latest"
testContainerLabel = "envbox-integration-test"
testImageAlpine = "localhost:5000/envbuilder-test-alpine:latest"
testImageUbuntu = "localhost:5000/envbuilder-test-ubuntu:latest"
testImageBlobUnknown = "localhost:5000/envbuilder-test-blob-unknown:latest"

// nolint:gosec // Throw-away key for testing. DO NOT REUSE.
testSSHKey = `-----BEGIN OPENSSH PRIVATE KEY-----
Expand Down Expand Up @@ -2354,6 +2355,38 @@ USER devalot
}
require.Fail(t, "expected pid 1 to be running as devalot")
})

t.Run("PushDuplicateLayersNoBlobUnknown", func(t *testing.T) {
t.Parallel()

srv := gittest.CreateGitServer(t, gittest.Options{
Files: map[string]string{
".devcontainer/Dockerfile": fmt.Sprintf(`FROM %s
USER root
RUN echo "hi i r empty"
RUN echo "who u"
`, testImageBlobUnknown),
".devcontainer/devcontainer.json": `{
"name": "Test",
"build": {
"dockerfile": "Dockerfile"
},
}`,
},
})

// NOTE(mafredri): The in-memory registry doesn't catch this error so we
// have to use registry:2.
ref, err := name.ParseReference(fmt.Sprintf("localhost:5000/test-blob-unknown-%s", uuid.NewString()))
require.NoError(t, err)
opts := []string{
envbuilderEnv("GIT_URL", srv.URL),
envbuilderEnv("CACHE_REPO", ref.String()),
envbuilderEnv("VERBOSE", "1"),
}

_ = pushImage(t, ref, nil, opts...)
})
}

func TestChownHomedir(t *testing.T) {
Expand Down Expand Up @@ -2532,6 +2565,8 @@ func getCachedImage(ctx context.Context, t *testing.T, cli *client.Client, env .
}

func startContainerFromRef(ctx context.Context, t *testing.T, cli *client.Client, ref name.Reference) container.CreateResponse {
t.Helper()

// Ensure that we can pull the image.
rc, err := cli.ImagePull(ctx, ref.String(), image.PullOptions{})
require.NoError(t, err)
Expand Down
7 changes: 7 additions & 0 deletions integration/testdata/blob-unknown/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
FROM alpine:latest

# This will produce an empty layer via Docker. It will allow us to test for a
# conflicting empty layer produced by Kaniko. This is to check against the
# BLOB_UNKNOWN error when trying to upload the built image to a registry and
# Kaniko having overwritten this blob with its own.
WORKDIR /home