How can I include the base image's digest in the resulting image?

[kodeknecht]

I'd like to include the base image's digest into the resulting image - preferably as a label. Even after hours of research I was unable to find a solution.

How can I achieve this?

Rational: Here in our company we build dozens of custom base image (based on Red Hat base images) intended for internal use on a bunch of OpenShift clusters. Lately things got a bit messy when Red Hat pushed out new base images in an unprecedented frequency, causing automated builds that overlapped with already running jobs distributing the recently built images to all of our clusters. This triggered some bug in this whole machinery that left us with totally inconsistent image registries on all our clusters.

Cleaning up all that mess was a PITA. It would have been far easier with the information at hand about the exact base image (in our case Red Hat base image) used to build a certain image.

I guess the information is available internally, see 562f718.

[rhatdan]

I see this in my image inspect:

$ cat /tmp/Containerfile 
from quay.io/ramalama/ramalama
run echo hi

$ podman build -t test /tmp
$ podman inspect test
...
          "Annotations": {
               "org.opencontainers.image.base.digest": "sha256:3b3d76f704dd28770dc7740187ba34c7a713ebbc9ac93f96cdd4311fd57a772a",
               "org.opencontainers.image.base.name": "quay.io/ramalama/ramalama:latest"
          },

[rhatdan]

@nalind PTAL

[nalind]

The task (https://hub.tekton.dev/tekton/task/buildah, unless I should be looking elsewhere) uses the quay.io/buildah/stable:v1 image, which as of this writing is 1.38, so it's certainly new enough to be adding the annotation.

The other thing I'd check is if the output format is set to "docker" instead of the default of "oci" when the task is used, as that format doesn't support annotations.

If somewhere in between where it's built and where it's inspected, the built image is being pushed from one location and then pulled from a different location, and the registry doesn't support OCI formats, the image would have been converted to a non-OCI format in order to successfully be pushed.

podman inspect would indicate a "ManifestType" of "application/vnd.oci.image.manifest.v1+json" for OCI, and "application/vnd.docker.distribution.manifest.v2+json" for Docker.

[kodeknecht]

Thank you @nalind for your reply.

The concrete buildah image here used by Tekton (OpenShift Pipelines 1.17.0, Tekton Pipelines 0.65.4) is registry.redhat.io/rhel8/buildah:8.10-9. Not too aged, so shouldn't make a difference IMHO.

Regarding the ManifestType:

I don't see an option to get hold of the image right after it has been built. It gets pushed to OpenShift's internal image registry right away. I'm unable to use podman inspect here in my environment. I hope skopeo inspect run from some Pod within the OpenShift cluster is equivalent.

However, skopeo inspect doesn't yield any ManifestType, ManifestMIMEType or ManifestMediaType. The closest I see is

"MIMEType": "application/vnd.oci.image.layer.v1.tar+gzip"

below LayersData.

Another option to get insight to some image on OpenShift is using oc get istag/xxxxx -o yaml. (Admittedly somewhat mangled.) This produces

dockerImageManifestMediaType: application/vnd.oci.image.manifest.v1+json

So I conclude that we are dealing with an image in OCI format.

[kodeknecht]

After jumping though several hoops I managed to get the image transfered to the local container storage of some other machine where I was able to apply podman inspect. To my surprise, podman inspect and skopeo inspect are NOT equivalent.

podman inspect actually delivers:

         "Annotations": {
              "org.opencontainers.image.base.digest": "sha256:ad869425b8e...e2c3c03d0594",
              "org.opencontainers.image.base.name": "<redacted>"
         },

Conclusion:

Everything is fine on your side. buildah is doing a perfect job. I have to investigate how to get hold of this org.opencontainers.image.base.digest annotation here in my environment.

Thank you very much for your cooperation.

[nalind]

Indeed, the buildah command in registry.redhat.io/rhel8/buildah:8.10-9 at this time identifies itself as 1.33.10, which should be recent enough.

If you're not building for multiple architectures, pointing skopeo inspect --raw at the image in the registry should provide a verbatim copy of the image's manifest, and that's where its annotations are recorded. skopeo inspect --raw --config will do the same for its configuration blob, which is where its labels are recorded.