moby
Using `FROM <image_id>` doesn't work when using `DOCKER_BUILDKIT=1`
If you have a Dockerfile of the form:
FROM sha256:abcdefgxxxxxxxxxxxxxxxx
[...]
Then docker build fails but only if buildkit is in use (tested with DOCKER_BUILDKIT=1 as well as docker buildx):
$ DOCKER_BUILDKIT=0 docker build .
Sending build context to Docker daemon 7.168kB
Step 1/2 : FROM sha256:06017009f887cf12ab636d362e9c0170acac7735a1cc0ee786e720385a37d619
---> 06017009f887
Step 2/2 : LABEL GOODBYE="Have a nice day!"
---> Running in e8772594c7e4
Removing intermediate container e8772594c7e4
---> acc07f1c0296
Successfully built acc07f1c0296
vs
$ DOCKER_BUILDKIT=1 docker build .
[+] Building 1.1s (4/4) FINISHED
=> [internal] load build definition from Dockerfile 0.0s
=> => transferring dockerfile: 33B 0.0s
=> [internal] load .dockerignore 0.0s
=> => transferring context: 2B 0.0s
=> ERROR [internal] load metadata for docker.io/library/sha256:06017009f887cf12ab636d362e9c0170acac7735a1cc0ee786e720385a37d619 1.0s
=> [auth] library/sha256:pull token for registry-1.docker.io 0.0s
------
> [internal] load metadata for docker.io/library/sha256:06017009f887cf12ab636d362e9c0170acac7735a1cc0ee786e720385a37d619:
------
error: failed to solve: rpc error: code = Unknown desc = failed to solve with frontend dockerfile.v0: failed to create LLB definition: pull access denied, repository does not exist or may require authorization: server message: insufficient_scope: authorization failed
Minimal reproduction at https://github.com/bossmc/repro-buildkit-2204.
System information:
$ docker version
Client: Docker Engine - Community
Version: 20.10.7
API version: 1.41
Go version: go1.13.15
Git commit: f0df350
Built: Wed Jun 2 11:56:40 2021
OS/Arch: linux/amd64
Context: tcp
Experimental: true
Server: Docker Engine - Community
Engine:
Version: 20.10.7
API version: 1.41 (minimum version 1.12)
Go version: go1.13.15
Git commit: b0f5bc3
Built: Wed Jun 2 11:54:48 2021
OS/Arch: linux/amd64
Experimental: true
containerd:
Version: 1.4.6
GitCommit: d71fcd7d8303cbf684402823e425e9dd2e99285d
runc:
Version: 1.0.0-rc95
GitCommit: b9ee9c6314599f1b4a7f497e1f1f856fe433d3b7
docker-init:
Version: 0.19.0
GitCommit: de40ad0
@dautovri BuildKit needs to resolve image config to load metadata in Dockerfile frontend. I think that's why it fails because we need a valid image reference here. cc @tonistiigi
I think in this case, the ID / sha is also not the "distribution digest", but the digest of a local image (before it's pushed to a registry). The classic builder could use those to reference images in the local image cache (not sure if BuildKit can do the same?)
I think in this case, the ID /
shais also not the "distribution digest", but the digest of a local image (before it's pushed to a registry). The classic builder could use those to reference images in the local image cache (not sure if BuildKit can do the same?)
It's means we will need to make a local registry, push the image, and after that use it in FROM?
The build works if the local image is tagged and the build references it by the tag - that doesn't create any special registry/"distribution digest" as far as I know though.
Yes, buildkit looks to interpret sha256 as the image name and :<digest> as tag. I think there's a special case in the docker engine code (and classic builder) that checks for sha256: and [a-z0-9]{64} for ID's that are specified without sha256: prefix.
buildkit looks to interpret
sha256as the image name and:<digest>as tag
Not quite. If we use shortened ID, we will get the same result.
$ export BUILD_KIT=1
$ docker pull hello-world
$ ID=$(docker create hello-world)
$ IMG=$(docker commit $ID | tail -c +8 | head -c 14)
$ echo $IMG
2e5a9d259d70a4
$ echo -e "FROM $IMG\nCMD echo $BUILD_KIT"|docker build -f - .
[+] Building 1.5s (3/3) FINISHED
=> [internal] load build definition from Dockerfile
=> => transferring dockerfile: 67B
=> [internal] load .dockerignore
=> => transferring context: 2B
=> ERROR [internal] load metadata for docker.io/library/2e5a9d259d70a4:latest
------
> [internal] load metadata for docker.io/library/2e5a9d259d70a4:latest:
------
failed to solve with frontend dockerfile.v0: failed to create LLB definition: pull access denied, repository does not exist or may require authorization: server message: insufficient_scope: authorization failed
That underlying behaviour is a little different - that's treating the hash as the name of an image stored on dockerhub and guessing latest as the tag (hence the expanded docker.io/library/2e5a9d259d70a4:latest). OTOH this also used to work pre-buildkit so it's effectively the same issue.
Hi, we've come to realize that FROM <image_id> no longer works on Docker 25 without DOCKER_BUILDKIT=0. Any chance of this functionality being restored for buildkit before the legacy builder is removed?
