identifier "<identifier name>" greater than maximum length (76 characters)

[Shubhranshu153]

Description

Some of users of finch are reporting max length of 76 characters, which seems to stem from this validation
https://github.com/containerd/containerd/blob/92900bf7300b4872db2a43e82128fda9cde08a79/pkg/identifiers/validate.go#L58

Seeking some guidance what would be best way to handle it, Should we handle downstream (in finch) or have an implementation to generate UUID in cases length are longer than 76.

Steps to reproduce the issue

No response

Describe the results you received and expected

Handling of longer length identifiers.

What version of nerdctl are you using?

1.7.3

Are you using a variant of nerdctl? (e.g., Rancher Desktop)

Lima

Host information

No response

[apostasie]

Personal opinion: handle downstream (using annotations or labels to do what they want).
Swapping in UUID in certain cases would either cause UX issues or make lookups more complex.

[AkihiroSuda]

Any string supported by Docker should be accepted in nerdctl too.

TODO: figure out regexp used by Docker

[apostasie]

Any string supported by Docker should be accepted in nerdctl too.

TODO: figure out regexp used by Docker

Related: #3115

[Shubhranshu153]

if we are aligning with docker then we can probably remove the validate calls as docker doesnt do that particular check is this an acceptable fix?

Doing any sort of manipulation of the string seem to need a two way conversion and probably a pretty large pr as it needs to take into account most of the commands

[AkihiroSuda]

if we are aligning with docker then we can probably remove the validate calls as docker doesnt do that particular check is this an acceptable fix?

No, docker does some check

$ docker run -it --rm --name "foo bar" alpine
docker: Error response from daemon: Invalid container name (foo bar), only [a-zA-Z0-9][a-zA-Z0-9_.-] are allowed.
See 'docker run --help'.

https://github.com/moby/moby/blob/v27.1.1/daemon/names/names.go

[Shubhranshu153]

i see, i was searching for the validate call. :(
they have different regexp for different calls, we can make it compatible.
Will be working on an pr for it.

[secana]

@Shubhranshu153 any update on this? It currently blocks https://github.com/cross-rs/cross (default solution to compile Rust to different targets) from running with nerdctl, as cross generates some pretty long names. See the issue linked above.

[Shubhranshu153]

@secana picked up this week, will have a pr in the next couple of days.

[apostasie]

Folks, FWIW here is the spec - for image names and tags:

https://github.com/opencontainers/distribution-spec/blob/main/spec.md#pulling-manifests

Note that a tag is at max 128 characters, and an image name overall (domain + port + short image name) should be under 255 chars (without the tag).

Specifically:

Many clients impose a limit of 255 characters on the length of the concatenation of the registry hostname (and optional port), /, and <name> value. If the registry name is registry.example.org:5000, those clients would be limited to a <name> of 229 characters (255 minus 25 for the registry hostname and port and minus 1 for a / separator). For compatibility with those clients, registries should avoid values of <name> that would cause this limit to be exceeded.

Point being: I do not know how long the identifiers can be in your use-case, and of course fixing this here will make the situation better / more compatible with docker - but there will still be some limit, and you might very well still hit it.

[apostasie]

@Shubhranshu153 I assume this is now fixed by your work in #3026 ?

[Shubhranshu153]

yes it is.