[Registry] Invalid docker images?
The job https://gitlab.dune-project.org/joe/pacxx-docker/-/jobs/60007 tries to pull the docker image registry.dune-project.org/joe/pacxx-docker:base-native.ci-refactor-base-images.317
and fail with a crc error when unzipping one of the layers. The pretty-printed manifest for that is:
joe@paranoia:/tmp/problem$ ~/Projekte/registry-cli/bin/registry-cli manifest registry.dune-project.org/joe/pacxx-docker:base-native.ci-refactor-base-images.317
Content-Type: application/vnd.docker.distribution.manifest.v2+json
Docker-Content-Digest: sha256:33db79847cae941706b85666a35bec465caca5803dbe31df4f55fef17d1c0dc1
{
"schemaVersion": 2,
"mediaType": "application/vnd.docker.distribution.manifest.v2+json",
"config": {
"mediaType": "application/vnd.docker.container.image.v1+json",
"size": 6098,
"digest": "sha256:e88793252847c898a103fa02309ff317eec4463133dedfea2cada679cf2dc931"
},
"layers": [
{
"mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
"size": 43252507,
"digest": "sha256:4af816f6d4bd8574b06d4c4831c8723bb2a81d3bc5f60f8603dd64e5381fe80c"
},
[...more layers...]
]
}
I've left only the offending layer in in the above. Downloading that layer (I needed to monkey-patch registry-cli to do that, as it currently pretty-prints the downloaded blob as json...):
joe@paranoia:/tmp/problem$ ~/Projekte/registry-cli/bin/registry-cli blob registry.dune-project.org/joe/pacxx-docker@sha256:4af816f6d4bd8574b06d4c4831c8723bb2a81d3bc5f60f8603dd64e5381fe80c
Content-Type: application/octet-stream
4af816f6d4bd8574b06d4c4831c8723bb2a81d3bc5f60f8603dd64e5381fe80c /tmp/tmp.eVjG0zUtR3/http_data
joe@paranoia:/tmp/problem$ gunzip <result >/dev/null
gzip: stdin: invalid compressed data--crc error
So the layer can be downloaded successfully, and the sha256 digest checks out, and it looks like gzipped data (as it should), but somewhere the file got corrupted.
The same image is available on epic:
joe@epic:~$ docker image ls registry.dune-project.org/joe/pacxx-docker:base-native.ci-refactor-base-images.317
REPOSITORY TAG IMAGE ID CREATED SIZE
registry.dune-project.org/joe/pacxx-docker base-native.ci-refactor-base-images.317 e88793252847 3 days ago 558MB
joe@epic:~$ docker pull registry.dune-project.org/joe/pacxx-docker:base-native.ci-refactor-base-images.317
base-native.ci-refactor-base-images.317: Pulling from joe/pacxx-docker
Digest: sha256:33db79847cae941706b85666a35bec465caca5803dbe31df4f55fef17d1c0dc1
Status: Image is up to date for registry.dune-project.org/joe/pacxx-docker:base-native.ci-refactor-base-images.317
Since this image was created inside a dind container, epic can only have gotten this image by downloading it from the registry, though possibly under a different tag.