docker / docker/cli

`docker manifest inspect` never match `docker image inspect` layer hashes

Open
#3,246 2 comments 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

area/manifest
Dominant language
Go
Stars
6.1k
Forks
2.2k
Avg merge
1d 15h
Merged PRs (30d)
43

Description

Description

docker manifest inspect is not reporting the layers I'm expecting...

Steps to reproduce the issue:

  1. Dockerfile:
FROM alpine:latest
RUN echo "hello world" > hello.txt
CMD cat hello.txt
  1. docker-compose.yml:
version: '3.3'
services:
  examplerepo:
    build: . 
    container_name: examplerepo
  1. docker tag examplerepo_examplerepo myregistry/examplerepo:latest
  2. docker push myregistry/examplerepo:latest
  3. docker manifest inspect myregistry/examplerepo:latest

Describe the results you received:

docker image inspect examplerepo_examplerepo -f '{{json .RootFS.Layers}}'
[
  "sha256:bc276c40b172b1c5467277d36db5308a203a48262d5f278766cf083947d05466",
  "sha256:724a5698c31a82f8756d9ffd4320f3d99988f7a4fb8c1b58494845647b1a4972"
]
docker manifest inspect myregistry/examplerepo:latest
{
        "schemaVersion": 2,
        "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
        "config": {
                "mediaType": "application/vnd.docker.container.image.v1+json",
                "size": 1835,
                "digest": "sha256:a5f5d37972c23ed2bf9c4d365c9ef1c031423ef450dacf6e5c073fa604256f95"
        },
        "layers": [
                {
                        "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
                        "size": 2813006,
                        "digest": "sha256:29291e31a76a7e560b9b7ad3cada56e8c18d50a96cca8a2573e4f4689d7aca77"
                },
                {
                        "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
                        "size": 114,
                        "digest": "sha256:1864ea337d9afb159ea54debe4ee6f8dd9a8a67e7bb9ca2103b3b46a78a532c9"
                }
        ]
}

Describe the results you expected:
The layers described in the docker manifest should match the local ones, no?
bc276c40b172b1c5... !== 29291e31a76a7e560...
724a5698c31a82f87... !== 1864ea337d9afb15...

Additional information you deem important (e.g. issue happens only occasionally):
Issue is 100% reproducible.

Output of docker version:

Client:
 Version:           20.10.2
 API version:       1.41
 Go version:        go1.13.8
 Git commit:        20.10.2-0ubuntu1~20.04.2
 Built:             Tue Mar 30 21:24:57 2021
 OS/Arch:           linux/amd64
 Context:           default
 Experimental:      true

Server: Docker Engine - Community
 Engine:
  Version:          20.10.7
  API version:      1.41 (minimum version 1.12)
  Go version:       go1.13.15
  Git commit:       b0f5bc3
  Built:            Wed Jun  2 11:54:58 2021
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.4.6
  GitCommit:        d71fcd7d8303cbf684402823e425e9dd2e99285d
 runc:
  Version:          1.0.0-rc95
  GitCommit:        b9ee9c6314599f1b4a7f497e1f1f856fe433d3b7
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

Output of docker info:

Client:
 Context:    default
 Debug Mode: false
 Plugins:
  buildx: Build with BuildKit (Docker Inc., v0.5.1-docker)
  compose: Docker Compose (Docker Inc., v2.0.0-beta.6)
  scan: Docker Scan (Docker Inc., v0.8.0)
WARNING: Plugin "/usr/libexec/docker/cli-plugins/docker-app" is not valid: failed to fetch metadata: fork/exec /usr/libexec/docker/cli-plugins/docker-app: no such file or directory

Server:
 Containers: 39
  Running: 5
  Paused: 0
  Stopped: 34
 Images: 335
 Server Version: 20.10.7
 Storage Driver: overlay2
  Backing Filesystem: extfs
  Supports d_type: true
  Native Overlay Diff: true
  userxattr: false
 Logging Driver: json-file
 Cgroup Driver: cgroupfs
 Cgroup Version: 1
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
 Swarm: inactive
 Runtimes: runc io.containerd.runc.v2 io.containerd.runtime.v1.linux
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: d71fcd7d8303cbf684402823e425e9dd2e99285d
 runc version: b9ee9c6314599f1b4a7f497e1f1f856fe433d3b7
 init version: de40ad0
 Security Options:
  seccomp
   Profile: default
 Kernel Version: 4.19.104-microsoft-standard
 Operating System: Docker Desktop
 OSType: linux
 Architecture: x86_64
 CPUs: 8
 Total Memory: 24.95GiB
 Name: docker-desktop
 ID: 2425:OVZV:VQ2Q:XKXW:7L4U:IMRJ:CX5X:36QE:RXOE:JLDJ:7COV:SX5A
 Docker Root Dir: /var/lib/docker
 Debug Mode: true
  File Descriptors: 76
  Goroutines: 73
  System Time: 2021-08-11T16:27:28.0945286Z
  EventsListeners: 4
 Registry: https://index.docker.io/v1/
 Labels:
 Experimental: false
 Insecure Registries:
  127.0.0.0/8
 Live Restore Enabled: false

WARNING: No blkio throttle.read_bps_device support
WARNING: No blkio throttle.write_bps_device support
WARNING: No blkio throttle.read_iops_device support
WARNING: No blkio throttle.write_iops_device support
WARNING: bridge-nf-call-iptables is disabled
WARNING: bridge-nf-call-ip6tables is disabled

Additional environment details (AWS, VirtualBox, physical, etc.):

  • Using AWS ECR
  • Building in Windows10 WSL2

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the reported docker manifest inspect and docker image inspect commands using the provided Dockerfile, compose file, registry image, and version details. Compare the manifest layer digests with the local RootFS layer values and determine whether the difference is expected; done means the behavior is explained or corrected with verification for this reproduction.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker
Domain
cli
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.