Open thaJeztah opened 6 years ago
/cc @n4ss @vdemeester @endophage
@tonistiigi Is this still something we need to document? Let me know, and I'll update the docs accordingly. Thanks!
The server side validation is now in docker-ee and is a better approach for this.
Docker Content Trust currently parses Dockerfiles client-side to resolve the image-digest for all images that are used.
However, with the addition of multi-stage builds, and dynamically changing the Dockerfile (
FROM $ARG
), resolving the image is not always possible without evaluating the Dockerfile.Some examples:
Dockerfile with
FROM $ARG
Which produces:
error is:
Dockerfile using names of build-stages
Another case is multi-stage builds:
When using
FROM <something>
in a multi-stage build,<something>
can be ambiguous (if the Dockerfile is not processed correctly):<something>
is found as name of a build-stage, the result of the build-stage is used<something>
is not found as name of a build-stage, it is tried to be resolved as an image referenceDocker content trust will attempt to resolve digests for image names, so in the example below:
Without DCT,
FROM helloworld
is treated as the name of the first build-stage:But with DCT enabled, the Dockerfile is parsed first, and the client will likely attempt to resolve the digest for
helloworld:latest
:Which results in some obscure error:
Error:
What's needed
We should:
FROM $ARG
(and variations thereof) is not supported/cc @gbarr01 for docs