Skip to content

Conversation

@philips
Copy link
Contributor

@philips philips commented Jun 16, 2016

This adds a test of the schema compatibility by taking the manifest of
library/docker from the Docker Hub, with sha256 digest verification, and
simply finding/replacing the four constant strings documented in
media-types.md and ensuring that it passes OCI validation.

https://github.com/opencontainers/image-spec/blob/master/media-types.md

This test is functionaly equivalent to downloading a Docker v2.2
manifest into the file docker-manifest:

$ curl -L -H "Authorization: Bearer ..." \
    -H "Accept: application/vnd.docker.distribution.manifest.v2+json" \
    https://registry-1.docker.io/v2/library/docker/manifests/sha256fg:888206c77cd2811ec47e752ba291e5b7734e3ef137dfd222daadaca39a9f17bc > docker-manifest

And then running a regex to change docker.distribution to oci.image
and changing v2 to v1

$ cat docker-manifest | sed -e "s%docker\.distribution%oci\.image%g" -e "s%v2%v1%g" > oci-manifest

And finally testing the manifest with oci-image-tool:

$ oci-image-tool validate oci-manifest
oci-manifest: OK

Signed-off-by: Brandon Philips [email protected]

This adds a test of the schema compatibility by taking the manifest of
library/docker from the docker hub, with sha256 digest verification, and
simply finding/replacing the four constant strings documented in
media-types.md and ensuring that it passes OCI validation.

https://github.com/opencontainers/image-spec/blob/master/media-types.md

This test is functionaly equivalent to downloading a Docker v2.2
manifest into the file `docker-manifest:

```
$ curl -L -H "Authorization: Bearer ..." \
	-H "Accept: application/vnd.docker.distribution.manifest.v2+json" \
	https://registry-1.docker.io/v2/library/docker/manifests/sha256fg:888206c77cd2811ec47e752ba291e5b7734e3ef137dfd222daadaca39a9f17bc > docker-manifest
```

And then running a regex to change `docker.distribution` to `oci.image`
and changing `v2` to `v1`

```
$ cat docker-manifest | sed -e "s%docker\.distribution%oci\.image%g" -e "s%v2%v1%g" > oci-manifest
```

And finally testing the manifest with oci-image-tool:

```
$ oci-image-tool validate oci-manifest
oci-manifest: OK
```

Signed-off-by: Brandon Philips <[email protected]>
@s-urbaniak
Copy link
Collaborator

LGTM

"application/vnd.docker.distribution.manifest.list.v2+json": "application/vnd.oci.image.manifest.list.v1+json",
"application/vnd.docker.distribution.manifest.v2+json": "application/vnd.oci.image.manifest.v1+json",
"application/vnd.docker.image.rootfs.diff.tar.gzip": "application/vnd.oci.image.rootfs.tar.gzip",
"application/vnd.docker.container.image.v1+json": "application/vnd.oci.image.serialization.config.v1+json",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Perhaps some other test cases to exercise this?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

added this type on another PR

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

On 16 June 2016 at 19:21, Brandon Philips [email protected] wrote:

In schema/manifest_backwards_compatibility_test.go
#145 (comment)
:

+import (

  • "crypto/sha256"
  • "encoding/hex"
  • "fmt"
  • "strings"
  • "testing"
  • "github.com/opencontainers/image-spec/schema"
    +)

+var compatMap = map[string]string{

  • "application/vnd.docker.distribution.manifest.list.v2+json": "application/vnd.oci.image.manifest.list.v1+json",
  • "application/vnd.docker.distribution.manifest.v2+json": "application/vnd.oci.image.manifest.v1+json",
  • "application/vnd.docker.image.rootfs.diff.tar.gzip": "application/vnd.oci.image.rootfs.tar.gzip",
  • "application/vnd.docker.container.image.v1+json": "application/vnd.oci.image.serialization.config.v1+json",

added this type on another PR


You are receiving this because you commented.
Reply to this email directly, view it on GitHub
https://github.com/opencontainers/image-spec/pull/145/files/e94aa35aaa324ffc63d567ecb34d4914473702ed#r67387069,
or mute the thread
https://github.com/notifications/unsubscribe/ACewN0gLt2OuGF2Nh0OFUuaYzQ4Hgn6Qks5qMYYfgaJpZM4I3Cyf
.

@jonboulle
Copy link
Contributor

neat! lgtm

@philips
Copy link
Contributor Author

philips commented Jun 16, 2016

@jonboulle can you give this a real LGTM :-P

@jonboulle
Copy link
Contributor

jonboulle commented Jun 16, 2016

LGTM

Approved with PullApprove

@vbatts
Copy link
Member

vbatts commented Jun 17, 2016

LGTM

Approved with PullApprove

@vbatts vbatts merged commit 2a0bfdc into opencontainers:master Jun 17, 2016
wking added a commit to wking/image-spec that referenced this pull request Nov 6, 2016
We probably need to keep application/vnd.oci.image.config.v1+json
untouched, since e94aa35 (schema: add a docker v2.2 backwards compat
test, 2016-06-15, opencontainers#145) and other maintainer activity suggest a goal
of bit-for-bit compatibility with the current Docker schemas
(excepting media types).  However, requiring Docker support doesn't
mean we can't *also* require support for configuration formats that
are easier for image authors to use.

Of course, with the (greatly) increased flexibility comes a lot more
risk.  Image consumers in general, and runtime-spec-based-image
consumers in particular, should use a sanitization tool like [1].

The runtime-spec config also lacks support for diffIDs, but local
image tooling is still welcome to record the digests of uncompressed
layers and use that for local optimizations.  You have to fetch the
compressed layer at least once to perform the uncompression, but you'd
have to do that to verify the old diffID anyway.

[1]: opencontainers/runtime-tools#219

Signed-off-by: W. Trevor King <[email protected]>
wking added a commit to wking/image-spec that referenced this pull request Nov 8, 2016
We probably need to keep application/vnd.oci.image.config.v1+json
untouched, since e94aa35 (schema: add a docker v2.2 backwards compat
test, 2016-06-15, opencontainers#145) and other maintainer activity suggest a goal
of bit-for-bit compatibility with the current Docker schemas
(excepting media types).  However, requiring Docker support doesn't
mean we can't *also* require support for configuration formats that
are easier for image authors to use.

Of course, with the (greatly) increased flexibility comes a lot more
risk.  Image consumers in general, and runtime-spec-based-image
consumers in particular, should use a sanitization tool like [1].

The runtime-spec config also lacks support for diffIDs, but local
image tooling is still welcome to record the digests of uncompressed
layers and use that for local optimizations.  You have to fetch the
compressed layer at least once to perform the uncompression, but you'd
have to do that to verify the old diffID anyway.

[1]: opencontainers/runtime-tools#219

Signed-off-by: W. Trevor King <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants