Skip to content

fixbug: blob for schemav1 could be uncompressed#2263

Merged
estesp merged 1 commit intocontainerd:masterfrom
alibaba-archive:fix_no_gzip
Jul 30, 2018
Merged

fixbug: blob for schemav1 could be uncompressed#2263
estesp merged 1 commit intocontainerd:masterfrom
alibaba-archive:fix_no_gzip

Conversation

@yyb196
Copy link
Copy Markdown
Contributor

@yyb196 yyb196 commented Apr 2, 2018

blob for schemav1 could be uncompressed, which can be pulled by docker but cannot pull by ctr, because when docker downloading a blob layer it will check if it is compressed or not.

in our company we have a image registry which use schemaV1 and has uncompressed layers, these layers can be download by docker but cannot download by ctr, after dig a while i found that maybe we should check the downloading stream in advance, and if it is uncompressed we don't use the gzip reader to decompress it.

PTAL, and thanks.

Signed-off-by: frank yang [email protected]

@codecov-io
Copy link
Copy Markdown

codecov-io commented Apr 2, 2018

Codecov Report

Merging #2263 into master will increase coverage by 3.72%.
The diff coverage is 60%.

Impacted file tree graph

@@            Coverage Diff             @@
##           master    #2263      +/-   ##
==========================================
+ Coverage   41.26%   44.98%   +3.72%     
==========================================
  Files          66       92      +26     
  Lines        7850     9400    +1550     
==========================================
+ Hits         3239     4229     +990     
- Misses       4103     4488     +385     
- Partials      508      683     +175
Flag Coverage Δ
#linux 49.22% <60%> (?)
#windows 41.25% <60%> (-0.02%) ⬇️
Impacted Files Coverage Δ
archive/compression/compression.go 42.64% <60%> (-1.3%) ⬇️
services/server/server_linux.go 0% <0%> (ø)
oci/spec_opts_unix.go 21.77% <0%> (ø)
content/local/store_unix.go 75% <0%> (ø)
sys/socket_unix.go 0% <0%> (ø)
oci/spec_unix.go 98.37% <0%> (ø)
archive/tar_unix.go 54.54% <0%> (ø)
snapshots/btrfs/btrfs.go 57.39% <0%> (ø)
cio/io_unix.go 74.71% <0%> (ø)
mount/temp_unix.go 0% <0%> (ø)
... and 24 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 63522d9...046536c. Read the comment docs.

Comment thread remotes/docker/schema1/converter.go Outdated
Copy link
Copy Markdown
Member

@stevvooe stevvooe Apr 2, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

log.G(ctx).WithError(err).Errorf("failed to fetch blob %v", desc.Digest)

@stevvooe
Copy link
Copy Markdown
Member

stevvooe commented Apr 2, 2018

For schema1, uncompressed blobs wasn't really ever well supported, but it does work in docker.

I would say this change is fine as long as the following steps are taken:

  1. We only do autodetection for schema1 (this PR follows that convention).
  2. Once the compression is detected, the converted manifest should reflect that in the media types. In this case, the gzip needs to be dropped.

cc @dmcgowan

@dmcgowan
Copy link
Copy Markdown
Member

dmcgowan commented Apr 2, 2018

Change looks reasonable, please use the decompression code in github.com/containerd/containerd/archive/compression

@yyb196
Copy link
Copy Markdown
Contributor Author

yyb196 commented Apr 3, 2018

@stevvooe @dmcgowan thanks for your advice, i have changed and commit as your suggestion, PTAL.

I donn't real know what does this suggestion mean "Once the compression is detected, the converted manifest should reflect that in the media types. In this case, the gzip needs to be dropped." , if this step is a must ,please give me more tips, appreciate your help.

@dmcgowan
Copy link
Copy Markdown
Member

dmcgowan commented Apr 3, 2018

Once the compression is detected, the converted manifest should reflect that in the media types. In this case, the gzip needs to be dropped.

The issue is that after the conversion takes place, a manifest is created which has layers described as having the media type application/vnd.oci.image.layer.v1.tar+gzip, but the actual media type is application/vnd.oci.image.layer.v1.tar. If this created OCI manifest is then pushed to a registry, it could later fail on pull, and we will not support invalid OCI manifests for this case. There is 2 possible solutions, one is discard the manifest and layers after pulling so the converted manifest cannot be directly pushed, or change the media type to the uncompressed media type.

@yyb196
Copy link
Copy Markdown
Contributor Author

yyb196 commented Apr 8, 2018

@dmcgowan thanks very much for your patient explanation, and i change the media type of layer from application/vnd.docker.image.rootfs.diff.tar.gzip to application/vnd.docker.image.rootfs.diff.tar if found it isn't gzip. PTAL

@yyb196
Copy link
Copy Markdown
Contributor Author

yyb196 commented Apr 18, 2018

@stevvooe @dmcgowan could you guys take a look again? any feed back will be appreciate.

Comment thread archive/compression/compression.go Outdated
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This function should return Compression. Maybe a signature like GetCompression(r. io.Reader) Compression

@dmcgowan dmcgowan added this to the 1.2 milestone Apr 23, 2018
@yyb196
Copy link
Copy Markdown
Contributor Author

yyb196 commented Apr 24, 2018

@dmcgowan thanks for you review, I have change code according to your suggestion.

Comment thread archive/compression/compression.go Outdated
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: break the comment into 2 lines. Also instead of the reader r -> the given reader, the variable name is not relevant to the caller.

Comment thread remotes/docker/schema1/converter.go Outdated
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does the caller not properly handle or log this error?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

you are right, the caller will handle this error, I'll get rid of this log

Comment thread remotes/docker/schema1/converter.go Outdated
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Use WithField here, also the message could be more descriptive
log.G(ctx).WithField("d", desc.Digest).Debuf("changed media type for uncompressed schema1 layer blob")

@dmcgowan
Copy link
Copy Markdown
Member

A few nits, otherwise LGTM

@yyb196
Copy link
Copy Markdown
Contributor Author

yyb196 commented May 3, 2018

@dmcgowan appreciate your advice, all the nits you mentioned has been fixed.

@yyb196
Copy link
Copy Markdown
Contributor Author

yyb196 commented May 29, 2018

@dmcgowan @stevvooe what do you think of this pr.

I found this pr has been tag to milestone 1.2, Since containerd-1.1 has released, can you guys merge this pr or do I need to fix something more.

Comment thread archive/compression/compression.go Outdated
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What if instead readCloseWrapper stored the Compression that was used? Otherwise this will have to be updated in tandem with DecompressStream (Assuming at some point DecompressStream supports more than gzip).

@yyb196
Copy link
Copy Markdown
Contributor Author

yyb196 commented Jun 7, 2018

@cpuguy83 the design you suggested is more elegant, I have change implement according to your suggestion, PTAL

@yyb196
Copy link
Copy Markdown
Contributor Author

yyb196 commented Jun 7, 2018

I think CI fail isn't because of the new commit, is a url cannot be connected.

Err:1 http://mirror.jmu.edu/pub/ubuntu trusty-backports/main amd64 libseccomp2 amd64 2.2.3-2ubuntu1~ubuntu14.04.1
  Could not connect to mirror.jmu.edu:80 (134.126.36.183), connection timed out
Err:2 http://mirror.jmu.edu/pub/ubuntu trusty-backports/main amd64 libseccomp-dev amd64 2.2.3-2ubuntu1~ubuntu14.04.1
  Unable to connect to mirror.jmu.edu:http:
E: Failed to fetch http://mirror.jmu.edu/pub/ubuntu/pool/main/libs/libseccomp/libseccomp2_2.2.3-2ubuntu1~ubuntu14.04.1_amd64.deb  Could not connect to mirror.jmu.edu:80 (134.126.36.183), connection timed out
E: Failed to fetch http://mirror.jmu.edu/pub/ubuntu/pool/main/libs/libseccomp/libseccomp-dev_2.2.3-2ubuntu1~ubuntu14.04.1_amd64.deb  Unable to connect to mirror.jmu.edu:http:
E: Unable to fetch some archives, maybe run apt-get update or try with --fix-missing?

@estesp estesp mentioned this pull request Jun 7, 2018
@AkihiroSuda
Copy link
Copy Markdown
Member

@cpuguy83 PTAL?

@AkihiroSuda
Copy link
Copy Markdown
Member

@stevvooe @dmcgowan LGTY?

@dmcgowan
Copy link
Copy Markdown
Member

LGTM

Copy link
Copy Markdown
Member

@estesp estesp left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@estesp estesp merged commit c55b963 into containerd:master Jul 30, 2018
@allencloud allencloud deleted the fix_no_gzip branch October 17, 2018 13:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

7 participants