[20.10 backport] docker pull: warn when pulled single-arch image does not match --platform#42633
Conversation
…form This takes the same approach as was implemented on `docker build`, where a warning is printed if `FROM --platform=...` is used (added in 3996953) Before: docker rmi armhf/busybox docker pull --platform=linux/s390x armhf/busybox Using default tag: latest latest: Pulling from armhf/busybox d34a655120f5: Pull complete Digest: sha256:8e51389cdda2158935f2b231cd158790c33ae13288c3106909324b061d24d6d1 Status: Downloaded newer image for armhf/busybox:latest docker.io/armhf/busybox:latest With this change: docker rmi armhf/busybox docker pull --platform=linux/s390x armhf/busybox Using default tag: latest latest: Pulling from armhf/busybox d34a655120f5: Pull complete Digest: sha256:8e51389cdda2158935f2b231cd158790c33ae13288c3106909324b061d24d6d1 Status: Downloaded newer image for armhf/busybox:latest WARNING: image with reference armhf/busybox was found but does not match the specified platform: wanted linux/s390x, actual: linux/arm64 docker.io/armhf/busybox:latest And daemon logs print: WARN[2021-04-26T11:19:37.153572667Z] ignoring platform mismatch on single-arch image error="image with reference armhf/busybox was found but does not match the specified platform: wanted linux/s390x, actual: linux/arm64" image=armhf/busybox When pulling without specifying `--platform, no warning is currently printed (but we can add a warning in future); docker rmi armhf/busybox docker pull armhf/busybox Using default tag: latest latest: Pulling from armhf/busybox d34a655120f5: Pull complete Digest: sha256:8e51389cdda2158935f2b231cd158790c33ae13288c3106909324b061d24d6d1 Status: Downloaded newer image for armhf/busybox:latest docker.io/armhf/busybox:latest Signed-off-by: Sebastiaan van Stijn <[email protected]> (cherry picked from commit 424c0eb) Signed-off-by: Sebastiaan van Stijn <[email protected]>
|
@tianon @samuelkarp ptal |
tonistiigi
left a comment
tonistiigi
left a comment
There was a problem hiding this comment.
SGTM. If possible we should look into how to avoid double warning on default docker run that does implicit pull.
|
Is this actually working? I don't get any warnings on which surely is not meant to run on arch |
|
@ppp0 Thanks for asking (and for the example). Hmm... so, it works... docker pull --platform=linux/s390x arm32v6/bash
...
WARNING: image with reference arm32v6/bash was found but does not match the specified platform: wanted linux/s390x, actual: linux/arm/v6
docker.io/arm32v6/bash:latest..but I suspect your example may be hitting another (sigh) backward-compatibility condition (will have to check). What I suspect could be the case;
I know we had some stricter checks at some point, but there were many (single-arch) images built using cross-compilation tools; for those images, the image metadata did not match the image's actual architecture. If those images are part of a multi-arch image (manifest index), then the manifest index would contain the "correct" os/arch, but when pulled directly (not as part of a multi-arch image), such images would be rejected, causing quite some issues, so validation was relaxed for those. So, I think a combination of the above is happening, causing the warning to not be printed. Note that this warning is a bit of a "best effort" attempt to make these cases visible, because of the aforementioned relaxation of the validation when we had to implement. That said; it would definitely be good (if possible) to also print a warning for these. |
5 participants
backport of #42325
addresses docker/for-mac#5625
Minor "conflict" due to adjacent line changes in imports (because 7a50fe8 is not in the 20.10 branch)
This takes the same approach as was implemented on
docker build, where a warningis printed if
FROM --platform=...is used (added in 3996953)Before:
With this change:
And daemon logs print:
WARN[2021-04-26T11:19:37.153572667Z] ignoring platform mismatch on single-arch image error="image with reference armhf/busybox was found but does not match the specified platform: wanted linux/s390x, actual: linux/arm64" image=armhf/busybox
When pulling without specifying `--platform, no warning is currently printed (but we can add a warning in future);
Signed-off-by: Sebastiaan van Stijn [email protected]
(cherry picked from commit 424c0eb)
Signed-off-by: Sebastiaan van Stijn [email protected]
- What I did
- How I did it
- How to verify it
- Description for the changelog
- A picture of a cute animal (not mandatory but encouraged)