docker: Fix skopeo push (#25790)

Signed-off-by: Ryan Northey <[email protected]>
envoyproxy · Feb 28, 2023 · ec65343 · ec65343
1 parent 0d0341e
commit ec65343
Show file tree

Hide file tree

Showing 9 changed files with 86 additions and 73 deletions.
diff --git a/ci/docker_ci.sh b/ci/docker_ci.sh
@@ -20,6 +20,7 @@ set -e
 # AZP_BRANCH=refs/tags/v1.77.3
 ##
 
+
 function is_windows() {
     [[ -n "$DOCKER_FAKE_WIN" ]]  || [[ "$(uname -s)" == *NT* ]]
 }
@@ -197,6 +198,11 @@ build_and_maybe_push_image () {
     docker_image_tarball="${ENVOY_DOCKER_IMAGE_DIRECTORY}/envoy${image_type}.tar"
 
     if ! is_windows; then
+        # `--sbom` and `--provenance` args added for skopeo 1.5.0 compat,
+        # can probably be removed for later versions.
+        args+=(
+            "--sbom=false"
+            "--provenance=false")
         if [[ "${image_type}" =~ debug ]]; then
             # For linux if its the debug image then push immediately for release branches,
             # otherwise just test the build
@@ -283,12 +289,19 @@ push_image_from_tarball () {
     # dest="oci-archive:${docker_image_tarball2}"
 
     echo ">> PUSH: ${src} -> ${dest}"
-    echo "> skopeo copy --multi-arch all ${src} ${dest}"
+    echo "> skopeo copy --all ${src} ${dest}"
 
     if [[ -n "$DOCKER_CI_DRYRUN" ]]; then
         return
     fi
-    skopeo copy --multi-arch all "${src}" "${dest}"
+
+    # NB: this command works with skopeo 1.5.0, later versions may require
+    #   different flags, eg `--multi-arch all`
+    skopeo copy --all "${src}" "${dest}"
+
+    # Test specific versions using a container, eg
+    # docker run -v "${HOME}/.docker:/root/.docker" -v "${PWD}/build_images:/build_images" --rm -it \
+    #    quay.io/skopeo/stable:v1.5.0 copy --all "${src}" "${dest}"
 }
 
 tag_variants () {

diff --git a/ci/test/docker/linux/dev/main b/ci/test/docker/linux/dev/main
@@ -6,9 +6,9 @@
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-dev:MOCKSHA
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy -o type=oci,dest=/non/existent/test/path/envoy.tar -t envoyproxy/envoy-dev:MOCKSHA .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --sbom=false --provenance=false -o type=oci,dest=/non/existent/test/path/envoy.tar -t envoyproxy/envoy-dev:MOCKSHA .
 >> PUSH: oci-archive:/non/existent/test/path/envoy.tar -> docker://docker.io/envoyproxy/envoy-dev:MOCKSHA
-> skopeo copy --multi-arch all oci-archive:/non/existent/test/path/envoy.tar docker://docker.io/envoyproxy/envoy-dev:MOCKSHA
+> skopeo copy --all oci-archive:/non/existent/test/path/envoy.tar docker://docker.io/envoyproxy/envoy-dev:MOCKSHA
 >> TAG: envoyproxy/envoy-dev:MOCKSHA -> envoyproxy/envoy:dev-MOCKSHA
 > docker buildx imagetools create docker.io/envoyproxy/envoy-dev:MOCKSHA --tag docker.io/envoyproxy/envoy:dev-MOCKSHA
 >> TAG: envoyproxy/envoy-dev:MOCKSHA -> envoyproxy/envoy-dev:latest
@@ -18,7 +18,7 @@
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD+PUSH: envoyproxy/envoy-debug-dev:MOCKSHA
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY_SUFFIX= --push -t envoyproxy/envoy-debug-dev:MOCKSHA .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY_SUFFIX= --sbom=false --provenance=false --push -t envoyproxy/envoy-debug-dev:MOCKSHA .
 >> TAG: envoyproxy/envoy-debug-dev:MOCKSHA -> envoyproxy/envoy:debug-dev-MOCKSHA
 > docker buildx imagetools create docker.io/envoyproxy/envoy-debug-dev:MOCKSHA --tag docker.io/envoyproxy/envoy:debug-dev-MOCKSHA
 >> TAG: envoyproxy/envoy-debug-dev:MOCKSHA -> envoyproxy/envoy-debug-dev:latest
@@ -28,9 +28,9 @@
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-contrib-dev:MOCKSHA
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY=envoy-contrib -o type=oci,dest=/non/existent/test/path/envoy-contrib.tar -t envoyproxy/envoy-contrib-dev:MOCKSHA .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY=envoy-contrib --sbom=false --provenance=false -o type=oci,dest=/non/existent/test/path/envoy-contrib.tar -t envoyproxy/envoy-contrib-dev:MOCKSHA .
 >> PUSH: oci-archive:/non/existent/test/path/envoy-contrib.tar -> docker://docker.io/envoyproxy/envoy-contrib-dev:MOCKSHA
-> skopeo copy --multi-arch all oci-archive:/non/existent/test/path/envoy-contrib.tar docker://docker.io/envoyproxy/envoy-contrib-dev:MOCKSHA
+> skopeo copy --all oci-archive:/non/existent/test/path/envoy-contrib.tar docker://docker.io/envoyproxy/envoy-contrib-dev:MOCKSHA
 >> TAG: envoyproxy/envoy-contrib-dev:MOCKSHA -> envoyproxy/envoy:contrib-dev-MOCKSHA
 > docker buildx imagetools create docker.io/envoyproxy/envoy-contrib-dev:MOCKSHA --tag docker.io/envoyproxy/envoy:contrib-dev-MOCKSHA
 >> TAG: envoyproxy/envoy-contrib-dev:MOCKSHA -> envoyproxy/envoy-contrib-dev:latest
@@ -40,7 +40,7 @@
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD+PUSH: envoyproxy/envoy-contrib-debug-dev:MOCKSHA
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY=envoy-contrib --build-arg ENVOY_BINARY_SUFFIX= --push -t envoyproxy/envoy-contrib-debug-dev:MOCKSHA .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY=envoy-contrib --build-arg ENVOY_BINARY_SUFFIX= --sbom=false --provenance=false --push -t envoyproxy/envoy-contrib-debug-dev:MOCKSHA .
 >> TAG: envoyproxy/envoy-contrib-debug-dev:MOCKSHA -> envoyproxy/envoy:contrib-debug-dev-MOCKSHA
 > docker buildx imagetools create docker.io/envoyproxy/envoy-contrib-debug-dev:MOCKSHA --tag docker.io/envoyproxy/envoy:contrib-debug-dev-MOCKSHA
 >> TAG: envoyproxy/envoy-contrib-debug-dev:MOCKSHA -> envoyproxy/envoy-contrib-debug-dev:latest
@@ -50,9 +50,9 @@
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-distroless-dev:MOCKSHA
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy-distroless -o type=oci,dest=/non/existent/test/path/envoy-distroless.tar -t envoyproxy/envoy-distroless-dev:MOCKSHA .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy-distroless --sbom=false --provenance=false -o type=oci,dest=/non/existent/test/path/envoy-distroless.tar -t envoyproxy/envoy-distroless-dev:MOCKSHA .
 >> PUSH: oci-archive:/non/existent/test/path/envoy-distroless.tar -> docker://docker.io/envoyproxy/envoy-distroless-dev:MOCKSHA
-> skopeo copy --multi-arch all oci-archive:/non/existent/test/path/envoy-distroless.tar docker://docker.io/envoyproxy/envoy-distroless-dev:MOCKSHA
+> skopeo copy --all oci-archive:/non/existent/test/path/envoy-distroless.tar docker://docker.io/envoyproxy/envoy-distroless-dev:MOCKSHA
 >> TAG: envoyproxy/envoy-distroless-dev:MOCKSHA -> envoyproxy/envoy:distroless-dev-MOCKSHA
 > docker buildx imagetools create docker.io/envoyproxy/envoy-distroless-dev:MOCKSHA --tag docker.io/envoyproxy/envoy:distroless-dev-MOCKSHA
 >> TAG: envoyproxy/envoy-distroless-dev:MOCKSHA -> envoyproxy/envoy-distroless-dev:latest
@@ -62,9 +62,9 @@
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-google-vrp-dev:MOCKSHA
-> docker buildx build --platform linux/amd64 -f ci/Dockerfile-envoy --target envoy-google-vrp -o type=oci,dest=/non/existent/test/path/envoy-google-vrp.tar -t envoyproxy/envoy-google-vrp-dev:MOCKSHA .
+> docker buildx build --platform linux/amd64 -f ci/Dockerfile-envoy --target envoy-google-vrp --sbom=false --provenance=false -o type=oci,dest=/non/existent/test/path/envoy-google-vrp.tar -t envoyproxy/envoy-google-vrp-dev:MOCKSHA .
 >> PUSH: oci-archive:/non/existent/test/path/envoy-google-vrp.tar -> docker://docker.io/envoyproxy/envoy-google-vrp-dev:MOCKSHA
-> skopeo copy --multi-arch all oci-archive:/non/existent/test/path/envoy-google-vrp.tar docker://docker.io/envoyproxy/envoy-google-vrp-dev:MOCKSHA
+> skopeo copy --all oci-archive:/non/existent/test/path/envoy-google-vrp.tar docker://docker.io/envoyproxy/envoy-google-vrp-dev:MOCKSHA
 >> TAG: envoyproxy/envoy-google-vrp-dev:MOCKSHA -> envoyproxy/envoy:google-vrp-dev-MOCKSHA
 > docker buildx imagetools create docker.io/envoyproxy/envoy-google-vrp-dev:MOCKSHA --tag docker.io/envoyproxy/envoy:google-vrp-dev-MOCKSHA
 >> TAG: envoyproxy/envoy-google-vrp-dev:MOCKSHA -> envoyproxy/envoy-google-vrp-dev:latest
@@ -74,9 +74,9 @@
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-tools-dev:MOCKSHA
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy-tools -o type=oci,dest=/non/existent/test/path/envoy-tools.tar -t envoyproxy/envoy-tools-dev:MOCKSHA .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy-tools --sbom=false --provenance=false -o type=oci,dest=/non/existent/test/path/envoy-tools.tar -t envoyproxy/envoy-tools-dev:MOCKSHA .
 >> PUSH: oci-archive:/non/existent/test/path/envoy-tools.tar -> docker://docker.io/envoyproxy/envoy-tools-dev:MOCKSHA
-> skopeo copy --multi-arch all oci-archive:/non/existent/test/path/envoy-tools.tar docker://docker.io/envoyproxy/envoy-tools-dev:MOCKSHA
+> skopeo copy --all oci-archive:/non/existent/test/path/envoy-tools.tar docker://docker.io/envoyproxy/envoy-tools-dev:MOCKSHA
 >> TAG: envoyproxy/envoy-tools-dev:MOCKSHA -> envoyproxy/envoy:tools-dev-MOCKSHA
 > docker buildx imagetools create docker.io/envoyproxy/envoy-tools-dev:MOCKSHA --tag docker.io/envoyproxy/envoy:tools-dev-MOCKSHA
 >> TAG: envoyproxy/envoy-tools-dev:MOCKSHA -> envoyproxy/envoy-tools-dev:latest

diff --git a/ci/test/docker/linux/dev/other b/ci/test/docker/linux/dev/other
@@ -5,28 +5,28 @@
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-dev:MOCKSHA
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy -o type=oci,dest=/non/existent/test/path/envoy.tar -t envoyproxy/envoy-dev:MOCKSHA .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --sbom=false --provenance=false -o type=oci,dest=/non/existent/test/path/envoy.tar -t envoyproxy/envoy-dev:MOCKSHA .
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-debug-dev:MOCKSHA
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY_SUFFIX= -t envoyproxy/envoy-debug-dev:MOCKSHA .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY_SUFFIX= --sbom=false --provenance=false -t envoyproxy/envoy-debug-dev:MOCKSHA .
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-contrib-dev:MOCKSHA
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY=envoy-contrib -o type=oci,dest=/non/existent/test/path/envoy-contrib.tar -t envoyproxy/envoy-contrib-dev:MOCKSHA .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY=envoy-contrib --sbom=false --provenance=false -o type=oci,dest=/non/existent/test/path/envoy-contrib.tar -t envoyproxy/envoy-contrib-dev:MOCKSHA .
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-contrib-debug-dev:MOCKSHA
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY=envoy-contrib --build-arg ENVOY_BINARY_SUFFIX= -t envoyproxy/envoy-contrib-debug-dev:MOCKSHA .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY=envoy-contrib --build-arg ENVOY_BINARY_SUFFIX= --sbom=false --provenance=false -t envoyproxy/envoy-contrib-debug-dev:MOCKSHA .
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-distroless-dev:MOCKSHA
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy-distroless -o type=oci,dest=/non/existent/test/path/envoy-distroless.tar -t envoyproxy/envoy-distroless-dev:MOCKSHA .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy-distroless --sbom=false --provenance=false -o type=oci,dest=/non/existent/test/path/envoy-distroless.tar -t envoyproxy/envoy-distroless-dev:MOCKSHA .
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-google-vrp-dev:MOCKSHA
-> docker buildx build --platform linux/amd64 -f ci/Dockerfile-envoy --target envoy-google-vrp -o type=oci,dest=/non/existent/test/path/envoy-google-vrp.tar -t envoyproxy/envoy-google-vrp-dev:MOCKSHA .
+> docker buildx build --platform linux/amd64 -f ci/Dockerfile-envoy --target envoy-google-vrp --sbom=false --provenance=false -o type=oci,dest=/non/existent/test/path/envoy-google-vrp.tar -t envoyproxy/envoy-google-vrp-dev:MOCKSHA .
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-tools-dev:MOCKSHA
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy-tools -o type=oci,dest=/non/existent/test/path/envoy-tools.tar -t envoyproxy/envoy-tools-dev:MOCKSHA .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy-tools --sbom=false --provenance=false -o type=oci,dest=/non/existent/test/path/envoy-tools.tar -t envoyproxy/envoy-tools-dev:MOCKSHA .
diff --git a/ci/test/docker/linux/dev/release b/ci/test/docker/linux/dev/release
@@ -5,28 +5,28 @@
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-dev:MOCKSHA
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy -o type=oci,dest=/non/existent/test/path/envoy.tar -t envoyproxy/envoy-dev:MOCKSHA .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --sbom=false --provenance=false -o type=oci,dest=/non/existent/test/path/envoy.tar -t envoyproxy/envoy-dev:MOCKSHA .
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-debug-dev:MOCKSHA
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY_SUFFIX= -t envoyproxy/envoy-debug-dev:MOCKSHA .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY_SUFFIX= --sbom=false --provenance=false -t envoyproxy/envoy-debug-dev:MOCKSHA .
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-contrib-dev:MOCKSHA
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY=envoy-contrib -o type=oci,dest=/non/existent/test/path/envoy-contrib.tar -t envoyproxy/envoy-contrib-dev:MOCKSHA .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY=envoy-contrib --sbom=false --provenance=false -o type=oci,dest=/non/existent/test/path/envoy-contrib.tar -t envoyproxy/envoy-contrib-dev:MOCKSHA .
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-contrib-debug-dev:MOCKSHA
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY=envoy-contrib --build-arg ENVOY_BINARY_SUFFIX= -t envoyproxy/envoy-contrib-debug-dev:MOCKSHA .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy --build-arg ENVOY_BINARY=envoy-contrib --build-arg ENVOY_BINARY_SUFFIX= --sbom=false --provenance=false -t envoyproxy/envoy-contrib-debug-dev:MOCKSHA .
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-distroless-dev:MOCKSHA
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy-distroless -o type=oci,dest=/non/existent/test/path/envoy-distroless.tar -t envoyproxy/envoy-distroless-dev:MOCKSHA .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy-distroless --sbom=false --provenance=false -o type=oci,dest=/non/existent/test/path/envoy-distroless.tar -t envoyproxy/envoy-distroless-dev:MOCKSHA .
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-google-vrp-dev:MOCKSHA
-> docker buildx build --platform linux/amd64 -f ci/Dockerfile-envoy --target envoy-google-vrp -o type=oci,dest=/non/existent/test/path/envoy-google-vrp.tar -t envoyproxy/envoy-google-vrp-dev:MOCKSHA .
+> docker buildx build --platform linux/amd64 -f ci/Dockerfile-envoy --target envoy-google-vrp --sbom=false --provenance=false -o type=oci,dest=/non/existent/test/path/envoy-google-vrp.tar -t envoyproxy/envoy-google-vrp-dev:MOCKSHA .
 >> BUILDX: use multi-builder
 > docker buildx use multi-builder
 >> BUILD: envoyproxy/envoy-tools-dev:MOCKSHA
-> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy-tools -o type=oci,dest=/non/existent/test/path/envoy-tools.tar -t envoyproxy/envoy-tools-dev:MOCKSHA .
+> docker buildx build --platform linux/arm64,linux/amd64 -f ci/Dockerfile-envoy --target envoy-tools --sbom=false --provenance=false -o type=oci,dest=/non/existent/test/path/envoy-tools.tar -t envoyproxy/envoy-tools-dev:MOCKSHA .