diff --git a/Makefile b/Makefile
index ce079015..14ed5182 100644
--- a/Makefile
+++ b/Makefile
@@ -67,7 +67,7 @@ test-registry-container: .registry-cache
# Pulls images referenced in integration tests and pushes them to the local cache.
.PHONY: test-images-push
-test-images-push: .registry-cache/docker/registry/v2/repositories/envbuilder-test-alpine .registry-cache/docker/registry/v2/repositories/envbuilder-test-ubuntu .registry-cache/docker/registry/v2/repositories/envbuilder-test-codercom-code-server
+test-images-push: .registry-cache/docker/registry/v2/repositories/envbuilder-test-alpine .registry-cache/docker/registry/v2/repositories/envbuilder-test-ubuntu .registry-cache/docker/registry/v2/repositories/envbuilder-test-codercom-code-server .registry-cache/docker/registry/v2/repositories/envbuilder-test-blob-unknown
.PHONY: test-images-pull
test-images-pull:
@@ -77,6 +77,7 @@ test-images-pull:
docker tag ubuntu:latest localhost:5000/envbuilder-test-ubuntu:latest
docker pull codercom/code-server:latest
docker tag codercom/code-server:latest localhost:5000/envbuilder-test-codercom-code-server:latest
+ docker build -t localhost:5000/envbuilder-test-blob-unknown:latest -f integration/testdata/blob-unknown/Dockerfile integration/testdata/blob-unknown
.registry-cache:
mkdir -p .registry-cache && chmod -R ag+w .registry-cache
@@ -89,3 +90,6 @@ test-images-pull:
.registry-cache/docker/registry/v2/repositories/envbuilder-test-codercom-code-server:
docker push localhost:5000/envbuilder-test-codercom-code-server:latest
+
+.registry-cache/docker/registry/v2/repositories/envbuilder-test-blob-unknown:
+ docker push localhost:5000/envbuilder-test-blob-unknown:latest
diff --git a/envbuilder.go b/envbuilder.go
index e6f9c8d4..2d7efec3 100644
--- a/envbuilder.go
+++ b/envbuilder.go
@@ -583,6 +583,16 @@ func run(ctx context.Context, opts options.Options, execArgs *execArgsInfo) erro
endStage("🏗️ Built image!")
if opts.PushImage {
endStage = startStage("🏗️ Pushing image...")
+
+ // To debug registry issues, enable logging:
+ //
+ // import (
+ // stdlog "log"
+ // reglogs "github.com/google/go-containerregistry/pkg/logs"
+ // )
+ // reglogs.Debug = stdlog.New(os.Stderr, "", 0)
+ // reglogs.Warn = stdlog.New(os.Stderr, "", 0)
+ // reglogs.Progress = stdlog.New(os.Stderr, "", 0)
if err := executor.DoPush(image, kOpts); err == nil {
endStage("🏗️ Pushed image!")
} else if !opts.ExitOnPushFailure {
diff --git a/go.mod b/go.mod
index e066b206..00987aa7 100644
--- a/go.mod
+++ b/go.mod
@@ -4,7 +4,7 @@ go 1.22.4
// There are a few options we need added to Kaniko!
// See: https://github.com/GoogleContainerTools/kaniko/compare/main...coder:kaniko:main
-replace github.com/GoogleContainerTools/kaniko => github.com/coder/kaniko v0.0.0-20241028054616-350cbb820e05
+replace github.com/GoogleContainerTools/kaniko => github.com/coder/kaniko v0.0.0-20241120132148-131d6094d781
// Required to import codersdk due to gvisor dependency.
replace tailscale.com => github.com/coder/tailscale v1.1.1-0.20240702054557-aa558fbe5374
diff --git a/go.sum b/go.sum
index 5872942d..1bb43776 100644
--- a/go.sum
+++ b/go.sum
@@ -171,8 +171,8 @@ github.com/cockroachdb/errors v1.2.4/go.mod h1:rQD95gz6FARkaKkQXUksEje/d9a6wBJoC
github.com/cockroachdb/logtags v0.0.0-20190617123548-eb05cc24525f/go.mod h1:i/u985jwjWRlyHXQbwatDASoW0RMlZ/3i9yJHE2xLkI=
github.com/coder/coder/v2 v2.10.1-0.20240704130443-c2d44d16a352 h1:L/EjCuZxs5tOcqqCaASj/nu65TRYEFcTt8qRQfHZXX0=
github.com/coder/coder/v2 v2.10.1-0.20240704130443-c2d44d16a352/go.mod h1:P1KoQSgnKEAG6Mnd3YlGzAophty+yKA9VV48LpfNRvo=
-github.com/coder/kaniko v0.0.0-20241028054616-350cbb820e05 h1:KZc6vG/WnSWG8RtUevGrCdZbF7XJaaZ32ocig6sZLQk=
-github.com/coder/kaniko v0.0.0-20241028054616-350cbb820e05/go.mod h1:3rM/KOQ4LgF8mE+O1P6pLDa/E57mzxIxNdUOMKi1qpg=
+github.com/coder/kaniko v0.0.0-20241120132148-131d6094d781 h1:/4SMdrjLQL1BseLSnMd9nYQSI+E63CXcyFGC7ZHHj8I=
+github.com/coder/kaniko v0.0.0-20241120132148-131d6094d781/go.mod h1:3rM/KOQ4LgF8mE+O1P6pLDa/E57mzxIxNdUOMKi1qpg=
github.com/coder/pretty v0.0.0-20230908205945-e89ba86370e0 h1:3A0ES21Ke+FxEM8CXx9n47SZOKOpgSE1bbJzlE4qPVs=
github.com/coder/pretty v0.0.0-20230908205945-e89ba86370e0/go.mod h1:5UuS2Ts+nTToAMeOjNlnHFkPahrtDkmpydBen/3wgZc=
github.com/coder/quartz v0.1.0 h1:cLL+0g5l7xTf6ordRnUMMiZtRE8Sq5LxpghS63vEXrQ=
diff --git a/integration/integration_test.go b/integration/integration_test.go
index aaa25d16..b7e75438 100644
--- a/integration/integration_test.go
+++ b/integration/integration_test.go
@@ -57,9 +57,10 @@ import (
)
const (
- testContainerLabel = "envbox-integration-test"
- testImageAlpine = "localhost:5000/envbuilder-test-alpine:latest"
- testImageUbuntu = "localhost:5000/envbuilder-test-ubuntu:latest"
+ testContainerLabel = "envbox-integration-test"
+ testImageAlpine = "localhost:5000/envbuilder-test-alpine:latest"
+ testImageUbuntu = "localhost:5000/envbuilder-test-ubuntu:latest"
+ testImageBlobUnknown = "localhost:5000/envbuilder-test-blob-unknown:latest"
// nolint:gosec // Throw-away key for testing. DO NOT REUSE.
testSSHKey = `-----BEGIN OPENSSH PRIVATE KEY-----
@@ -2354,6 +2355,38 @@ USER devalot
}
require.Fail(t, "expected pid 1 to be running as devalot")
})
+
+ t.Run("PushDuplicateLayersNoBlobUnknown", func(t *testing.T) {
+ t.Parallel()
+
+ srv := gittest.CreateGitServer(t, gittest.Options{
+ Files: map[string]string{
+ ".devcontainer/Dockerfile": fmt.Sprintf(`FROM %s
+USER root
+RUN echo "hi i r empty"
+RUN echo "who u"
+`, testImageBlobUnknown),
+ ".devcontainer/devcontainer.json": `{
+ "name": "Test",
+ "build": {
+ "dockerfile": "Dockerfile"
+ },
+ }`,
+ },
+ })
+
+ // NOTE(mafredri): The in-memory registry doesn't catch this error so we
+ // have to use registry:2.
+ ref, err := name.ParseReference(fmt.Sprintf("localhost:5000/test-blob-unknown-%s", uuid.NewString()))
+ require.NoError(t, err)
+ opts := []string{
+ envbuilderEnv("GIT_URL", srv.URL),
+ envbuilderEnv("CACHE_REPO", ref.String()),
+ envbuilderEnv("VERBOSE", "1"),
+ }
+
+ _ = pushImage(t, ref, nil, opts...)
+ })
}
func TestChownHomedir(t *testing.T) {
@@ -2532,6 +2565,8 @@ func getCachedImage(ctx context.Context, t *testing.T, cli *client.Client, env .
}
func startContainerFromRef(ctx context.Context, t *testing.T, cli *client.Client, ref name.Reference) container.CreateResponse {
+ t.Helper()
+
// Ensure that we can pull the image.
rc, err := cli.ImagePull(ctx, ref.String(), image.PullOptions{})
require.NoError(t, err)
diff --git a/integration/testdata/blob-unknown/Dockerfile b/integration/testdata/blob-unknown/Dockerfile
new file mode 100644
index 00000000..fffcc574
--- /dev/null
+++ b/integration/testdata/blob-unknown/Dockerfile
@@ -0,0 +1,7 @@
+FROM alpine:latest
+
+# This will produce an empty layer via Docker. It will allow us to test for a
+# conflicting empty layer produced by Kaniko. This is to check against the
+# BLOB_UNKNOWN error when trying to upload the built image to a registry and
+# Kaniko having overwritten this blob with its own.
+WORKDIR /home