[registry api incompatibility] older nginx (v1 image schema) example error about kbld HOT 5 CLOSED

that's wild that it's returning different digest every time instead of failing but yeah it is related to image being v1 schema [1]. im guessing v1 schema did not have a "stable" digest that was being returned, so api is doing some magic.

as you said later versions of nginx (that do not use v1 schema) are ok. (e.g. echo "image: nginx:1.17.8" | kbld -f- results in consistent digest)

in general kbld is built on go-containerregistry library and does not support v1 schema images.

i wonder if it's worth for kbld to resolve each image twice to make sure that digest is being returned correctly, and fail if it's not.

[1] Image docker.io/library/nginx:1.7.9 uses outdated schema1 manifest format. Please upgrade to a schema2 image for better future compatibility. More information at https://docs.docker.com/registry/spec/deprecated-schema-v1/

from kbld.

ImageOverride is your friend (https://github.com/k14s/kbld/blob/develop/docs/config.md#imageoverrides) if you want to preresolve the image to whatever you want (ie have kbld ignore it).

from kbld.

made kbld double check returned digest: 91a5653. available in 0.14.0.

from kbld.

Also of note, when performing the following command:

watch kbld -f k8s/

where the file for the nginx deployment is:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
  labels:
    app: nginx
spec:
  replicas: 3
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:1.7.9
        ports:
        - containerPort: 80

The sha digets changes upon every iteration of watch. For example, on first iteration

resolve | final: nginx:1.7.9 -> index.docker.io/library/nginx@sha256:2d190f022cf883acd41f475f461b1e28320ebe826a9358b4d3f98fab8c9b8af3

and on second iteration

resolve | final: nginx:1.7.9 -> index.docker.io/library/nginx@sha256:25931ac2fa92c76f5b4e5465cae87c8d87c8f201e6ace9e0427c53b8da65c35d

from kbld.

Wow, very interesting. Yes, I agree, if the digest is not consistent, it would make sense to fail since the API is maybe trying to do it's best. Thanks for looking into this!

from kbld.