Add image_to_install cli option - #314
Conversation
e5d43c2 to
6e9f5f1
Compare
We bind mount host container storage into an ephemeral VM in order to create a base disk. This has the unfortunate effect of changing the manifest digest of the final image. bootc-dev#313 tried to address this by first exporting to OCI dir, then installing, but that too changes the final manifest digest. With the `image_to_install` option, we can pass `docker://quay.io/...` as the image to be installed which will have the correct manifest digest as we are pulling directly from the registry. Also, we might need networking to pull an image from a registry, so we pass `--net=host` to the podman command if the transport is registry We do depend on skopeo with this change as we can't use podman to query remote registry image manifests Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>
6e9f5f1 to
5a9f1eb
Compare
|
Tests running into some user ns issue on Github CI. Possibly something to do with skopeo interaction with containers storage |
5a9f1eb to
6a70aaa
Compare
| let image_to_install = opts | ||
| .image_to_install | ||
| .as_ref() | ||
| .unwrap_or(&opts.source_image) |
There was a problem hiding this comment.
When --composefs-backend is used without --image-to-install, the source falls back to containers-storage: which still produces the wrong manifest digest
There was a problem hiding this comment.
Which is okay I think, as we use the image for upgrade op anyway. This is for a niche use case in bink CI
There was a problem hiding this comment.
Fair. Would be nice have some warning when --composefs-backend is set without --image-to-install but it's not a blocker.
There was a problem hiding this comment.
I guess the cli opt wasn't required after all, see #307 (comment)
I still think the option is a pretty good addition, and with this I don't think we need a warning
|
Every |
df4552c to
2f36cef
Compare
Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>
Was using for the `Transport` enum, but it has some linux specific functions which breaks MacOs builds Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>
skopeo inspect requires unshare which fails in unprivileged CI environments. For local images (from containers-storage), use podman image inspect instead, and only fall back to skopeo for remote transports like docker:// Also, fix `libvirt to-disk` command by making sure image has a transport attached to it as now we're passing `--source-imgref` to bootc install Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>
Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>
Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>
2f36cef to
2a833df
Compare
I don't think we should justify this change because of digests. Again, this is something to fix in bootc. That aside, yes we should make it easier to support (And rather than simulating we should make it easier to actually do anaconda installs w/bcvk I think) |
3 participants
We bind mount host container storage into an ephemeral VM in order to
create a base disk. This has the unfortunate effect of changing the
manifest digest of the final image.
#313 tried to address this by
first exporting to OCI dir, then installing, but that too changes the
final manifest digest.
With the
image_to_installoption, we can passdocker://quay.io/...as the image to be installed which will have the correct manifest digest
as we are pulling directly from the registry.
Also, we might need networking to pull an image from a registry, so we
pass
--net=hostto the podman command if the transport is registryWe do depend on skopeo with this change as we can't use podman to query
remote registry image manifests
Fixes: #307