Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Ensure image SHA stays consistent when layer contents haven't changed #1032

Merged
merged 5 commits into from
Feb 13, 2020
Merged

Ensure image SHA stays consistent when layer contents haven't changed #1032

merged 5 commits into from
Feb 13, 2020

Conversation

tinkerborg
Copy link
Contributor

@tinkerborg tinkerborg commented Feb 6, 2020

Fixes #900 .

Description

omit uname/gname in tar headers

When using cache, the rootfs may not have been extracted. This prevents uname/gname from resolving as there is no /etc/password or /etc/group. This makes this layer unnecessarily differ from a cached layer which does contain this information. Omitting these should be consistent with Docker's behavior.

sort filesToAdd in TakeSnapshot

filesToAdd is sorted in TakeSnapshotFS, but not here. This makes ordering unpredictable within the layer's tarball, causing the SHA to differ even if layer contents haven't changed

Submitter Checklist

These are the criteria that every PR should meet, please check them off as you
review them:

  • [✔️ ] Includes unit tests
  • Adds integration tests if needed.

See the contribution guide for more details.

Reviewer Notes

  • The code flow looks good.
  • Unit tests and or integration tests added.

filesToAdd is sorted in TakeSnapshotFS, but not here. This makes ordering unpredictable within the layer's tarball,
causing the SHA to differ even if layer contents haven't changed
When using cache, the rootfs may not have been extracted. This prevents uname/gname from resolving
as there is no /etc/password or /etc/group. This makes this layer unnecessarily differ from
a cached layer which does contain this information. Omitting these should be consistent with Docker's
behavior.
@googlebot
Copy link

Thanks for your pull request. It looks like this may be your first contribution to a Google open source project (if not, look below for help). Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

📝 Please visit https://cla.developers.google.com/ to sign.

Once you've signed (or fixed any issues), please reply here with @googlebot I signed it! and we'll verify it.


What to do if you already signed the CLA

Individual signers
Corporate signers

ℹ️ Googlers: Go here for more info.

@googlebot googlebot added the cla: no CLA not signed by all commit authors label Feb 6, 2020
@tinkerborg
Copy link
Contributor Author

@googlebot I signed it!

@googlebot
Copy link

CLAs look good, thanks!

ℹ️ Googlers: Go here for more info.

@googlebot googlebot added cla: yes CLA signed by all commit authors and removed cla: no CLA not signed by all commit authors labels Feb 6, 2020
Copy link
Member

@tejal29 tejal29 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed build issue.
Thanks @tinkerborg I manually verified your PR and it works great!

@tejal29
Copy link
Member

tejal29 commented Feb 6, 2020

Build the same Dockerfile twice with --reproducible flag.


tejaldesai@@test$ container-diff diff image1.tar image.tar 

-----Size-----

Image size difference between image1.tar and image.tar: None
tejaldesai@@test$ 

@tejal29 tejal29 merged commit 2716557 into GoogleContainerTools:master Feb 13, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
cla: yes CLA signed by all commit authors
Projects
None yet
Development

Successfully merging this pull request may close these issues.

--reproducible leads to different layers in resulting image
4 participants