-
Notifications
You must be signed in to change notification settings - Fork 393
Add diagnostic logging to updateUID for CI investigation #1151
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Closed
Closed
Changes from 9 commits
Commits
Show all changes
10 commits
Select commit
Hold shift + click to select a range
50ac696
Add diagnostic logging to updateUID for CI investigation
chrmarti 07d6259
Add docker manifest inspect logging
chrmarti f342767
Use buildx imagetools inspect instead of manifest inspect for local i…
chrmarti 2c7b7e8
Read manifest list blob from containerd content store
chrmarti a5966c9
Use docker save to extract manifest list platform annotations
chrmarti 10bece5
Test with BuildKit enabled by default to check manifest list platform…
chrmarti 6045c26
Update Docker to latest before running tests
chrmarti a5e81cb
Add Docker official repo before upgrading
chrmarti 313470a
Add minimal Docker platform bug repro workflow
chrmarti 97e15d4
Add docker version and docker info steps to repro workflow
chrmarti File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,86 @@ | ||
| name: Docker Platform Bug Repro | ||
|
|
||
| on: | ||
| push: | ||
| branches: | ||
| - 'chrmarti/**' | ||
|
|
||
| jobs: | ||
| repro: | ||
| name: Platform Bug Repro | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Update Docker | ||
| run: | | ||
| sudo install -m 0755 -d /etc/apt/keyrings | ||
| sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc | ||
| sudo chmod a+r /etc/apt/keyrings/docker.asc | ||
| echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null | ||
| sudo apt-get update | ||
| sudo apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin | ||
| - name: Setup | ||
| run: | | ||
| docker version | ||
| docker info | grep -E "Storage Driver|driver-type" | ||
| docker run --privileged --rm tonistiigi/binfmt --install all | ||
| - name: Build with platform in Dockerfile only | ||
| run: | | ||
| dir=$(mktemp -d) | ||
| echo 'FROM --platform=linux/arm64 debian:latest' > "$dir/Dockerfile" | ||
| docker buildx build --load -t test-arm64-in-dockerfile "$dir" | ||
| - name: Inspect manifest list (Dockerfile platform) | ||
| run: | | ||
| docker image inspect test-arm64-in-dockerfile --format '{{.Architecture}}' | ||
| digest=$(docker image inspect test-arm64-in-dockerfile --format '{{.Id}}') | ||
| docker save test-arm64-in-dockerfile | tar -xO blobs/sha256/${digest#sha256:} | python3 -c " | ||
| import sys, json | ||
| data = json.load(sys.stdin) | ||
| if 'manifests' in data: | ||
| print('Manifest list found:') | ||
| for m in data['manifests']: | ||
| p = m.get('platform', {}) | ||
| t = m.get('annotations', {}).get('vnd.docker.reference.type', 'image') | ||
| print(f' type={t} arch={p.get(\"architecture\")} os={p.get(\"os\")} variant={p.get(\"variant\", \"\")}') | ||
| else: | ||
| print('No manifest list (single manifest)') | ||
| " | ||
| - name: Build using that image as base with --platform linux/arm64 | ||
| run: | | ||
| dir=$(mktemp -d) | ||
| echo 'FROM test-arm64-in-dockerfile' > "$dir/Dockerfile" | ||
| echo "Expecting this to fail due to manifest list platform mismatch..." | ||
| if docker build --platform linux/arm64 -t test-arm64-rebuild "$dir" 2>&1; then | ||
| echo "BUILD SUCCEEDED (bug may be fixed)" | ||
| else | ||
| echo "BUILD FAILED (bug confirmed)" | ||
| fi | ||
| - name: Build with --platform on CLI | ||
| run: | | ||
| dir=$(mktemp -d) | ||
| echo 'FROM debian:latest' > "$dir/Dockerfile" | ||
| docker buildx build --load --platform linux/arm64 -t test-arm64-on-cli "$dir" | ||
| - name: Inspect manifest list (CLI platform) | ||
| run: | | ||
| docker image inspect test-arm64-on-cli --format '{{.Architecture}}' | ||
| digest=$(docker image inspect test-arm64-on-cli --format '{{.Id}}') | ||
| docker save test-arm64-on-cli | tar -xO blobs/sha256/${digest#sha256:} | python3 -c " | ||
| import sys, json | ||
| data = json.load(sys.stdin) | ||
| if 'manifests' in data: | ||
| print('Manifest list found:') | ||
| for m in data['manifests']: | ||
| p = m.get('platform', {}) | ||
| t = m.get('annotations', {}).get('vnd.docker.reference.type', 'image') | ||
| print(f' type={t} arch={p.get(\"architecture\")} os={p.get(\"os\")} variant={p.get(\"variant\", \"\")}') | ||
| else: | ||
| print('No manifest list (single manifest)') | ||
| " | ||
| - name: Build using CLI-platform image with --platform linux/arm64 | ||
| run: | | ||
| dir=$(mktemp -d) | ||
| echo 'FROM test-arm64-on-cli' > "$dir/Dockerfile" | ||
| if docker build --platform linux/arm64 -t test-arm64-on-cli-rebuild "$dir" 2>&1; then | ||
| echo "BUILD SUCCEEDED (expected)" | ||
| else | ||
| echo "BUILD FAILED (unexpected)" | ||
| fi | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Copilot Autofix
AI 2 months ago
In general, you fix this kind of issue by adding an explicit
permissions:block either at the workflow root (to apply to all jobs) or at the individual job level, granting only the specific scopes required. If a job does not need anyGITHUB_TOKENaccess, you can safely setpermissions: { contents: read }or evenpermissions: {}at the job level to fully disable the token.For this workflow, the
reprojob only installs Docker and runs localdockerandpython3commands, and does not interact with the GitHub API or repository contents viaGITHUB_TOKEN. The safest and clearest fix, without changing existing functionality, is to add a minimal permissions block at the job level. To be maximally restrictive and align with least privilege, we can disable the token entirely for this job usingpermissions: {}underjobs.repro. This documents that the job does not need any token capabilities and ensures that even if repository defaults change in the future, this job will not receive unnecessary permissions.Concretely: in
.github/workflows/docker-platform-bug.yml, underjobs: repro: name: Platform Bug Repro, insert apermissions: {}line (with correct YAML indentation) between thename:andruns-on:lines. No imports or additional methods are needed, since this is purely a YAML configuration change.