docker relay: can't use docker.io as source

[xelalexv]

docker relay: can't use docker.io as source

[xelalexv]

@voje Great find! Thanks for taking the time to investigate & report this!

Workaround: use registry.hub.docker.com instead of docker.io. This does not get shortened.

For the issue itself, I'm afraid it is a bit more involved: Image references from docker.io/library are even shortened to just the image name, e.g. docker.io/library/busybox, is shortened to just busybox. I think the more or less cleanest way to fix this would be to canonicalize image references in the match function in docker.go:

--- a/internal/pkg/relays/docker/docker.go
+++ b/internal/pkg/relays/docker/docker.go
@@ -13,6 +13,7 @@ import (
        "strings"
        "time"
 
+       "github.com/docker/distribution/reference"
        "github.com/docker/docker/api/types"
        "github.com/docker/docker/client"
        "github.com/docker/docker/pkg/jsonmessage"
@@ -146,7 +147,11 @@ func (dc *dockerClient) listImages(ref string) ([]*image, error) {
                for _, img := range imgs {
                        var i *image
                        for _, rt := range img.RepoTags {
-                               if match(fRepo, fPath, fTag, rt) {
+                               matched, err := match(fRepo, fPath, fTag, rt)
+                               if err != nil {
+                                       return ret, err
+                               }
+                               if matched {
                                        repo, path, tag := SplitRef(rt)
                                        if i == nil {
                                                i = &image{
@@ -168,11 +173,15 @@ func (dc *dockerClient) listImages(ref string) ([]*image, error) {
 }
 
 //
-func match(filterRepo, filterPath, filterTag, ref string) bool {
-       repo, path, tag := SplitRef(ref)
+func match(filterRepo, filterPath, filterTag, ref string) (bool, error) {
+       refCanon, err := reference.ParseAnyReference(ref)
+       if err != nil {
+               return false, fmt.Errorf("malformed image ref: %v\n", err)
+       }
+       repo, path, tag := SplitRef(refCanon.String())
        return (filterRepo == "" || filterRepo == repo) &&
                (filterPath == "" || filterPath == path) &&
-               (filterTag == "" || filterTag == tag)
+               (filterTag == "" || filterTag == tag), nil
 }
 
 //

However, there is a caveat: It is impossible to distinguish between a shortened docker.io image ref and the ref to a purely local image. E.g. if you build a local image busybox, then that would get canonicalized to docker.io/library/busybox, and clash with the genuine image. Currently, I don't see any solution for this, other than adding an according notice in the documentation, e.g. "don't use your Docker relay for building local images". Given that I'm thinking about deprecating the Docker relay anyway (Skopeo is the better relay), that may be appropriate. Any thoughts?

BTW, the Skopeo relay is not affected by this issue.

[voje]

I see the problem with local images.
I'm mainly using the Skopeo relay, but wanted to have a safe backup with no dependencies (apart from Docker) and the Docker relay offers exactly that.

Your fix is clearly better than mine, so I'm closing the pull request.

[xelalexv]

@voje If you have the time, could you validate the fix? I would then close the issue. Thanks again for reporting this!

[xelalexv]

I haven't encountered any further problems with this, so closing. Please reopen if any issues remain.