Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

podman manifest inspect fails with Error: unable to load manifest list: unsupported format "application/vnd.docker.distribution.manifest.v2+json": manifest type not supported #12729

Closed
adelton opened this issue Jan 2, 2022 · 3 comments · Fixed by containers/common#878
Closed

podman manifest inspect fails with Error: unable to load manifest list: unsupported format "application/vnd.docker.distribution.manifest.v2+json": manifest type not supported #12729

adelton opened this issue Jan 2, 2022 · 3 comments · Fixed by containers/common#878
Labels
kind/bug Categorizes issue or PR as related to a bug. locked - please file new issue/PR Assist humans wanting to comment on an old issue or PR with locked comments.

Comments

@adelton
Copy link
Contributor

adelton commented Jan 2, 2022

Is this a BUG REPORT or FEATURE REQUEST? (leave only one on its own line)

/kind bug

Description

The podman manifest inspect seems like a reasonable alternative to calling curl to get information about remote manifest lists and manifests. However, it sometimes fails with

Error: unable to load manifest list: unsupported format "application/vnd.docker.distribution.manifest.v2+json": manifest type not supported

even if it processes another manifest with the same format / type just fine.

Steps to reproduce the issue:

  1. Inspect Fedora 35, it happens to be a manifest list:
$ podman manifest inspect registry.fedoraproject.org/fedora:35
{
    "schemaVersion": 2,
    "mediaType": "application/vnd.docker.distribution.manifest.list.v2+json",
    "manifests": [
        {
            "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
            "size": 429,
            "digest": "sha256:90bd0861ab68bcd5af83f0dad80ddaa8ffff2a82cb45be05e7877e945b600047",
            "platform": {
                "architecture": "arm64",
                "os": "linux"
            }
        },
        {
            "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
            "size": 429,
            "digest": "sha256:bc3c3ea948bb5cf187f8cfbe31b2c95f629bd489401172af05b908a6d118e4ee",
            "platform": {
                "architecture": "armhfp",
                "os": "linux"
            }
        },
        {
            "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
            "size": 429,
            "digest": "sha256:af44b415bf02cc12574a28d38eba7a8ffb33d4daca409b2839df4807a9be21c3",
            "platform": {
                "architecture": "ppc64le",
                "os": "linux"
            }
        },
        {
            "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
            "size": 429,
            "digest": "sha256:558e0e31794c285b076efc864cf8438af5959f6cbd3b77818c908d0f78954394",
            "platform": {
                "architecture": "s390x",
                "os": "linux"
            }
        },
        {
            "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
            "size": 429,
            "digest": "sha256:c2dabcec02da4ba2d867ab0fdb6cfd7d9a16c7b11fc1f74b3270711e584afe02",
            "platform": {
                "architecture": "amd64",
                "os": "linux"
            }
        }
    ]
}
  1. Inspect the first manifest, of platform arm64, via its SHA256:
$ podman manifest inspect registry.fedoraproject.org/fedora@sha256:90bd0861ab68bcd5af83f0dad80ddaa8ffff2a82cb45be05e7877e945b600047
WARN[0001] Warning! The manifest type application/vnd.docker.distribution.manifest.v2+json is not a manifest list but a single image. 
{
    "schemaVersion": 2,
    "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
    "config": {
        "mediaType": "application/vnd.docker.container.image.v1+json",
        "size": 1316,
        "digest": "sha256:b74713569c6a1d2fcaf5cb535d19491974d165a18194b527a3d92fac902dc9c5"
    },
    "layers": [
        {
            "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
            "size": 57483131,
            "digest": "sha256:73333db80aa9f76e1ed26dcdf52e4d3ab82f90e926417e0f2ad6c4ba843a3030"
        }
    ]
}
  1. Inspect the last manifest, of platform amd64, via its SHA256:
$ podman manifest inspect registry.fedoraproject.org/fedora@sha256:c2dabcec02da4ba2d867ab0fdb6cfd7d9a16c7b11fc1f74b3270711e584afe02

Describe the results you received:

Error: unable to load manifest list: unsupported format "application/vnd.docker.distribution.manifest.v2+json": manifest type not supported

Describe the results you expected:

Just display the manifest.

Since sha256:90bd0861ab68bcd5af83f0dad80ddaa8ffff2a82cb45be05e7877e945b600047 was application/vnd.docker.distribution.manifest.v2+json as well, podman even WARNed about it, I don't see why the other manifest should cause that error.

Additional information you deem important (e.g. issue happens only occasionally):

Deterministic.

Output of podman version:

Version:      3.4.4
API Version:  3.4.4
Go Version:   go1.16.8
Built:        Wed Dec  8 22:45:07 2021
OS/Arch:      linux/amd64

Output of podman info --debug:

host:
  arch: amd64
  buildahVersion: 1.23.1
  cgroupControllers:
  - memory
  - pids
  cgroupManager: systemd
  cgroupVersion: v2
  conmon:
    package: conmon-2.0.30-2.fc35.x86_64
    path: /usr/bin/conmon
    version: 'conmon version 2.0.30, commit: '
  cpus: 8
  distribution:
    distribution: fedora
    version: "35"
  eventLogger: journald
  hostname: machine.example.com
  idMappings:
    gidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 100000
      size: 65536
    uidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 100000
      size: 65536
  kernel: 5.15.11-200.fc35.x86_64
  linkmode: dynamic
  logDriver: journald
  memFree: 1566195712
  memTotal: 16537960448
  ociRuntime:
    name: crun
    package: crun-1.3-1.fc35.x86_64
    path: /usr/bin/crun
    version: |-
      crun version 1.3
      commit: 8e5757a4e68590326dafe8a8b1b4a584b10a1370
      spec: 1.0.0
      +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +YAJL
  os: linux
  remoteSocket:
    path: /run/user/1000/podman/podman.sock
  security:
    apparmorEnabled: false
    capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: true
    seccompEnabled: true
    seccompProfilePath: /usr/share/containers/seccomp.json
    selinuxEnabled: true
  serviceIsRemote: false
  slirp4netns:
    executable: /usr/bin/slirp4netns
    package: slirp4netns-1.1.12-2.fc35.x86_64
    version: |-
      slirp4netns version 1.1.12
      commit: 7a104a101aa3278a2152351a082a6df71f57c9a3
      libslirp: 4.6.1
      SLIRP_CONFIG_VERSION_MAX: 3
      libseccomp: 2.5.3
  swapFree: 12856057856
  swapTotal: 12884893696
  uptime: 21h 11m 38.23s (Approximately 0.88 days)
plugins:
  log:
  - k8s-file
  - none
  - journald
  network:
  - bridge
  - macvlan
  volume:
  - local
registries:
  search:
  - registry.fedoraproject.org
  - registry.access.redhat.com
  - docker.io
  - quay.io
store:
  configFile: /home/user/.config/containers/storage.conf
  containerStore:
    number: 0
    paused: 0
    running: 0
    stopped: 0
  graphDriverName: overlay
  graphOptions: {}
  graphRoot: /var/lib/containers/user/storage
  graphStatus:
    Backing Filesystem: extfs
    Native Overlay Diff: "true"
    Supports d_type: "true"
    Using metacopy: "false"
  imageStore:
    number: 311
  runRoot: /run/user/1000/containers
  volumePath: /var/lib/containers/user/storage/volumes
version:
  APIVersion: 3.4.4
  Built: 1638999907
  BuiltTime: Wed Dec  8 22:45:07 2021
  GitCommit: ""
  GoVersion: go1.16.8
  OsArch: linux/amd64
  Version: 3.4.4

Package info (e.g. output of rpm -q podman or apt list podman):

podman-3.4.4-1.fc35.x86_64

Have you tested with the latest version of Podman and have you checked the Podman Troubleshooting Guide? (https://github.com/containers/podman/blob/master/troubleshooting.md)

No

Additional environment details (AWS, VirtualBox, physical, etc.):

This is a physical machine.
@openshift-ci openshift-ci bot added the kind/bug Categorizes issue or PR as related to a bug. label Jan 2, 2022
@adelton
Copy link
Contributor Author

adelton commented Jan 2, 2022

When trying to figure out what the difference might be between those arm64 and amd64 manifests, it occurred to me that I have that amd64 one pulled locally. So the reproducer might as well be:

  1. Start with not having registry.fedoraproject.org/fedora:35 pulled on x86_64 machine.
  2. Check that podman manifest inspect works:
$ podman manifest inspect registry.fedoraproject.org/fedora@sha256:c2dabcec02da4ba2d867ab0fdb6cfd7d9a16c7b11fc1f74b3270711e584afe02
WARN[0001] Warning! The manifest type application/vnd.docker.distribution.manifest.v2+json is not a manifest list but a single image. 
{
    "schemaVersion": 2,
    "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
    "config": {
        "mediaType": "application/vnd.docker.container.image.v1+json",
        "size": 1316,
        "digest": "sha256:3059bef432ebb91a6a51d8f5cf20b033041dbddb3cab79628c1eb3412cbde0ae"
    },
    "layers": [
        {
            "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
            "size": 58934522,
            "digest": "sha256:4545346f2a492b62d5a82682efe19b0e8e7583d5c19f75a74c81d62ec536c32d"
        }
    ]
}
  1. Pull the image:
$ podman pull registry.fedoraproject.org/fedora:35
Trying to pull registry.fedoraproject.org/fedora:35...
Getting image source signatures
Copying blob 4545346f2a49 done  
Copying config 3059bef432 done  
Writing manifest to image destination
Storing signatures
3059bef432ebb91a6a51d8f5cf20b033041dbddb3cab79628c1eb3412cbde0ae
  1. See podman manifest inspect broken:
$ podman manifest inspect registry.fedoraproject.org/fedora@sha256:c2dabcec02da4ba2d867ab0fdb6cfd7d9a16c7b11fc1f74b3270711e584afe02
Error: unable to load manifest list: unsupported format "application/vnd.docker.distribution.manifest.v2+json": manifest type not supported

@rhatdan
Copy link
Member

rhatdan commented Jan 2, 2022

@vrothberg PTAL

vrothberg added a commit to vrothberg/common that referenced this issue Jan 10, 2022
@vrothberg
image lookup: apply checks for matching digest
93f48f5 
When looking up an image by digest, make sure that the matching image is
also subject to further attribute checks (e.g., manifest list checks) as
specified by the user.

Fixes: containers/podman/issues/12729
Signed-off-by: Valentin Rothberg <[email protected]>
@vrothberg vrothberg mentioned this issue Jan 10, 2022
Merged
@vrothberg
Copy link
Member

Back from PTO. Here's a fix: containers/common#878

@github-actions github-actions bot added the locked - please file new issue/PR Assist humans wanting to comment on an old issue or PR with locked comments. label Sep 21, 2023
@github-actions github-actions bot locked as resolved and limited conversation to collaborators Sep 21, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
kind/bug Categorizes issue or PR as related to a bug. locked - please file new issue/PR Assist humans wanting to comment on an old issue or PR with locked comments.
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

image lookup: apply checks for matching digest vrothberg/common
3 participants
@rhatdan @adelton @vrothberg