dweomer
commented
3 years ago This seems to point at a fundamental flaw in the rudimentary image sync algorithm which merely walks the content in a created/updated image and copies it from the buildkit namespace to the k8s.io namespace.
See https://github.com/rancher/kim/blob/v0.1.0-beta.5/pkg/server/agent_linux.go#L137-L150:
func copyImageContent(ctx context.Context, ctr *containerd.Client, name string, fn func(context.Context, images.Store, images.Image) error) error {
imageStore := ctr.ImageService()
img, err := imageStore.Get(ctx, name)
if err != nil {
return err
}
contentStore := ctr.ContentStore()
toCtx := namespaces.WithNamespace(ctx, "k8s.io")
handler := images.Handlers(images.ChildrenHandler(contentStore), copyImageContentFunc(toCtx, contentStore, img))
if err = images.Walk(ctx, handler, img.Target); err != nil {
return err
}
return fn(toCtx, imageStore, img)
}See https://github.com/rancher/kim/blob/v0.1.0-beta.5/pkg/server/agent_linux.go#L152-L182:
func copyImageContentFunc(toCtx context.Context, contentStore content.Store, img images.Image) images.HandlerFunc {
return func(fromCtx context.Context, desc ocispec.Descriptor) (children []ocispec.Descriptor, err error) {
logrus.Debugf("copy-image-content: media-type=%v, digest=%v", desc.MediaType, desc.Digest)
info, err := contentStore.Info(fromCtx, desc.Digest)
if err != nil {
return children, err
}
ra, err := contentStore.ReaderAt(fromCtx, desc)
if err != nil {
return children, err
}
defer ra.Close()
wopts := []content.WriterOpt{content.WithRef(img.Name)}
if _, err := contentStore.Info(toCtx, desc.Digest); errdefs.IsNotFound(err) {
// if the image does not already exist in the target namespace we supply the descriptor here so as to
// ensure that it is created with proper size information. if the image already exist the size for the digest
// for the to-be updated image is sourced from what is passed to content.Copy
wopts = append(wopts, content.WithDescriptor(desc))
}
w, err := contentStore.Writer(toCtx, wopts...)
if err != nil {
return children, err
}
defer w.Close()
err = content.Copy(toCtx, w, content.NewReader(ra), desc.Size, desc.Digest, content.WithLabels(info.Labels))
if err != nil && errdefs.IsAlreadyExists(err) {
return children, nil
}
return children, err
}
}
Originally reported in the Rancher Users Slack: https://rancher-users.slack.com/archives/C01RSL4GQN8/p1630483761016500
When using a very light/simple Dockerfile, the built image does not show up via
kim image ls -a:kim build -f Dockerfile.test --tag dweomer/percona:test --progress=plain .kim image ls -akubectl logs -n kube-image ds/builder -c agent(subsequent build attempts)