GoogleContainerTools / kaniko

Build Container Images In Kubernetes
Apache License 2.0
14.68k stars 1.43k forks source link

Use filename in cache key to prevent collisions under rename #3203

Open SJrX opened 3 months ago

SJrX commented 3 months ago

Fixes #2241 #1678

Description

Issues #2241 #1678 both point to cases where renames can point to incorrect images being used with caching. This commit adds the path of the file (relative to the build context to the hash).

A different approach would be to change the underlying function in CacheHasher to include the name (and maybe file size), this was avoided for two reasons:

  1. It was unclear whether this would change or break the computed digests outside the context of caching.
  2. The CacheHasher does not know the prefix to strip in the filename to compute the hash.

Submitter Checklist

These are the criteria that every PR should meet, please check them off as you review them:

See the contribution guide for more details.

Reviewer Notes

Release Notes

Describe any changes here so maintainer can include it in the release notes, or delete this block.

Examples of user facing changes:
- kaniko adds a new flag `--registry-repo` to override registry