"local execute" fails when using containerd

[dhm116]

Meta:

CircleCI CLI Version: 0.1.22675+19bba9e (homebrew)

Operating System: MacOS 13.0.1 (Ventura)

CircleCI CLI Diagnostic:

---
CircleCI CLI Diagnostics
---
Debugger mode: false
Config found: /Users/dougmccall/.circleci/cli.yml
API host: https://circleci.com
API endpoint: graphql-unstable
OK, got a token.
Trying an introspection query on API... 
Ok.
Hello, Doug McCall.

---

Current behavior:

When running circleci local execute with containerd enabled in Docker, I've observed the following error:

> circleci local execute --job bats/run
Fetching latest build environment...
Error: Could not find picard image: failed to parse sha256 from docker pull output

The error appears to be caused by the digest information no longer being present in the docker pull command output with containerd enabled:

> docker pull circleci/picard
Using default tag: latest
e2dce144c3d7: Download complete 
de649ceea8b4: Download complete 
78a49041ce23: Download complete 
076caf235167: Download complete 
f15191ba629c: Download complete 
425933550e49: Download complete 
5cba0132e12c: Download complete 
c7ff924e43bd: Download complete 
57a9350cd294: Download complete 
docker.io/circleci/picard:latest

With containerd disabled, however, the digest is included in the docker pull command output (as expected):

docker pull circleci/picard
Using default tag: latest
latest: Pulling from circleci/picard
df9b9388f04a: Pull complete 
f15191ba629c: Pull complete 
c7ff924e43bd: Pull complete 
076caf235167: Pull complete 
425933550e49: Pull complete 
57a9350cd294: Pull complete 
5cba0132e12c: Pull complete 
78a49041ce23: Pull complete 
Digest: sha256:e2dce144c3d74c1f493755e166d6d52ef224ed5eff639346175366964ae26eca
Status: Downloaded newer image for circleci/picard:latest
docker.io/circleci/picard:latest

Unrelated, but contributing to the blocking status of this issue, I don't appear to be able to use the --skip-update-check flag to bypass this step either:

ERRO[0000] Exit with status 1 due to generic error       error="unknown flag: --skip-update-check"

I have not found any existing reported issues in moby/moby related to the missing Digest: sha256@... output from a docker pull command, but it's unclear if this was a deliberate design choice or a regression with the ongoing containerd integration.

Expected behavior:

The circleci local execute command should run without encountering a Error: Could not find picard image: failed to parse sha256 from docker pull output error.

When did this begin / Was this previously working?:

• Fails with containerd integration enabled within Docker (since Docker for Mac v4.14.x)
• Works with containerd integration disabled within Docker

Additional Information:

Docker version:

(I disabled containerd prior to capturing this output)

Client:
 Cloud integration: v1.0.29
 Version:           20.10.21
 API version:       1.41
 Go version:        go1.18.7
 Git commit:        baeda1f
 Built:             Tue Oct 25 18:01:18 2022
 OS/Arch:           darwin/arm64
 Context:           desktop-linux
 Experimental:      true

Server: Docker Desktop 4.15.0 (93002)
 Engine:
  Version:          20.10.21
  API version:      1.41 (minimum version 1.12)
  Go version:       go1.18.7
  Git commit:       3056208
  Built:            Tue Oct 25 17:59:41 2022
  OS/Arch:          linux/arm64
  Experimental:     true
 containerd:
  Version:          1.6.10
  GitCommit:        770bd0108c32f3fb5c73ae1264f7e503fe7b2661
 runc:
  Version:          1.1.4
  GitCommit:        v1.1.4-0-g5fd4c4d
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

[JulesFaucherre]

Hey, since this is linked to the picard image maybe @CircleCI-Public/execution team can help on this