Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Pants fails to parse Docker Image ID for BuildKit builds with attestations disabled #21729

Closed
davidparsson opened this issue Dec 6, 2024 · 0 comments · Fixed by #21735
Closed
Assignees
Labels

Comments

@davidparsson
Copy link

Describe the bug
Pants fails to parse Docker Image ID for BuildKit builds with provenance attestations disabled, since exporting manifest list is not present in Docker's build log.

This is an example build log using BuildKit v0.18 with containerd-snapshotter output, but without provenance attestations:

#15 exporting to image
#15 exporting layers done
#15 preparing layers for inline cache 0.0s done
#15 exporting manifest sha256:0bc80e5cd7fde8722d6d3349bea82c4c4f2ac5a0ec1e02cd46e3557bf3ccf68a done
#15 exporting config sha256:1ce45471d2d286c01b80d7fd1d1d3b991e938495dda695a48027e3ed2fa0af32 done
#15 naming to my-image:latest done
#15 DONE 0.0s

The current parser looks for exporting manifest list, which is not present in my log.

Pants version
2.21.2, but the issue currently remains on the main branch.

OS
MacOS (ARM64)

Additional info
Docker BuildKit v0.11+ by default adds provenance attestations to built images, but AWS Lambda does not yet support them.

When using an ARM64 Mac to build Docker images that are to be used in AWS Lambdas, provenance attestations must be disabled. This can be achieved by setting the following environment variable: BUILDX_NO_DEFAULT_ATTESTATIONS=1. This alters Docker's build log which makes pants unable to detect the Docker Image ID.

Pants outputs Docker image ID: <unknown>

@tobni tobni self-assigned this Dec 8, 2024
tobni added a commit that referenced this issue Dec 9, 2024
Related reading as to why attestations can be disabled by users:
aws/aws-cdk#30258,
https://stackoverflow.com/questions/77207485/why-are-there-extra-untagged-images-in-amazon-ecr-after-doing-docker-push

In short, upstream tooling is not really ready for buildx + docker
desktop default outputs, and when disabling these we get a stdout which
current pants parsing code was not ready for.

Fixes #21729
tobni added a commit that referenced this issue Dec 10, 2024
…ry-pick of #21735) (#21738)

Related reading as to why attestations can be disabled by users:
aws/aws-cdk#30258,
https://stackoverflow.com/questions/77207485/why-are-there-extra-untagged-images-in-amazon-ecr-after-doing-docker-push

In short, upstream tooling is not really ready for buildx + docker
desktop default outputs, and when disabling these we get a stdout which
current pants parsing code was not ready for.

Fixes #21729

Co-authored-by: Tobias Nilsson <[email protected]>
tobni added a commit that referenced this issue Dec 10, 2024
…ry-pick of #21735) (#21737)

Related reading as to why attestations can be disabled by users:
aws/aws-cdk#30258,
https://stackoverflow.com/questions/77207485/why-are-there-extra-untagged-images-in-amazon-ecr-after-doing-docker-push

In short, upstream tooling is not really ready for buildx + docker
desktop default outputs, and when disabling these we get a stdout which
current pants parsing code was not ready for.

Fixes #21729

Co-authored-by: Tobias Nilsson <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants