docker_cli_by_digest_test.go 27 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693
  1. package main
  2. import (
  3. "encoding/json"
  4. "fmt"
  5. "os"
  6. "path/filepath"
  7. "regexp"
  8. "strings"
  9. "github.com/docker/distribution/digest"
  10. "github.com/docker/distribution/manifest/schema1"
  11. "github.com/docker/distribution/manifest/schema2"
  12. "github.com/docker/docker/pkg/integration/checker"
  13. "github.com/docker/docker/pkg/stringutils"
  14. "github.com/docker/engine-api/types"
  15. "github.com/go-check/check"
  16. )
  17. var (
  18. remoteRepoName = "dockercli/busybox-by-dgst"
  19. repoName = fmt.Sprintf("%s/%s", privateRegistryURL, remoteRepoName)
  20. pushDigestRegex = regexp.MustCompile("[\\S]+: digest: ([\\S]+) size: [0-9]+")
  21. digestRegex = regexp.MustCompile("Digest: ([\\S]+)")
  22. )
  23. func setupImage(c *check.C) (digest.Digest, error) {
  24. return setupImageWithTag(c, "latest")
  25. }
  26. func setupImageWithTag(c *check.C, tag string) (digest.Digest, error) {
  27. containerName := "busyboxbydigest"
  28. dockerCmd(c, "run", "-e", "digest=1", "--name", containerName, "busybox")
  29. // tag the image to upload it to the private registry
  30. repoAndTag := repoName + ":" + tag
  31. out, _, err := dockerCmdWithError("commit", containerName, repoAndTag)
  32. c.Assert(err, checker.IsNil, check.Commentf("image tagging failed: %s", out))
  33. // delete the container as we don't need it any more
  34. err = deleteContainer(containerName)
  35. c.Assert(err, checker.IsNil)
  36. // push the image
  37. out, _, err = dockerCmdWithError("push", repoAndTag)
  38. c.Assert(err, checker.IsNil, check.Commentf("pushing the image to the private registry has failed: %s", out))
  39. // delete our local repo that we previously tagged
  40. rmiout, _, err := dockerCmdWithError("rmi", repoAndTag)
  41. c.Assert(err, checker.IsNil, check.Commentf("error deleting images prior to real test: %s", rmiout))
  42. matches := pushDigestRegex.FindStringSubmatch(out)
  43. c.Assert(matches, checker.HasLen, 2, check.Commentf("unable to parse digest from push output: %s", out))
  44. pushDigest := matches[1]
  45. return digest.Digest(pushDigest), nil
  46. }
  47. func testPullByTagDisplaysDigest(c *check.C) {
  48. testRequires(c, DaemonIsLinux)
  49. pushDigest, err := setupImage(c)
  50. c.Assert(err, checker.IsNil, check.Commentf("error setting up image"))
  51. // pull from the registry using the tag
  52. out, _ := dockerCmd(c, "pull", repoName)
  53. // the pull output includes "Digest: <digest>", so find that
  54. matches := digestRegex.FindStringSubmatch(out)
  55. c.Assert(matches, checker.HasLen, 2, check.Commentf("unable to parse digest from pull output: %s", out))
  56. pullDigest := matches[1]
  57. // make sure the pushed and pull digests match
  58. c.Assert(pushDigest.String(), checker.Equals, pullDigest)
  59. }
  60. func (s *DockerRegistrySuite) TestPullByTagDisplaysDigest(c *check.C) {
  61. testPullByTagDisplaysDigest(c)
  62. }
  63. func (s *DockerSchema1RegistrySuite) TestPullByTagDisplaysDigest(c *check.C) {
  64. testPullByTagDisplaysDigest(c)
  65. }
  66. func testPullByDigest(c *check.C) {
  67. testRequires(c, DaemonIsLinux)
  68. pushDigest, err := setupImage(c)
  69. c.Assert(err, checker.IsNil, check.Commentf("error setting up image"))
  70. // pull from the registry using the <name>@<digest> reference
  71. imageReference := fmt.Sprintf("%s@%s", repoName, pushDigest)
  72. out, _ := dockerCmd(c, "pull", imageReference)
  73. // the pull output includes "Digest: <digest>", so find that
  74. matches := digestRegex.FindStringSubmatch(out)
  75. c.Assert(matches, checker.HasLen, 2, check.Commentf("unable to parse digest from pull output: %s", out))
  76. pullDigest := matches[1]
  77. // make sure the pushed and pull digests match
  78. c.Assert(pushDigest.String(), checker.Equals, pullDigest)
  79. }
  80. func (s *DockerRegistrySuite) TestPullByDigest(c *check.C) {
  81. testPullByDigest(c)
  82. }
  83. func (s *DockerSchema1RegistrySuite) TestPullByDigest(c *check.C) {
  84. testPullByDigest(c)
  85. }
  86. func testPullByDigestNoFallback(c *check.C) {
  87. testRequires(c, DaemonIsLinux)
  88. // pull from the registry using the <name>@<digest> reference
  89. imageReference := fmt.Sprintf("%s@sha256:ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff", repoName)
  90. out, _, err := dockerCmdWithError("pull", imageReference)
  91. c.Assert(err, checker.NotNil, check.Commentf("expected non-zero exit status and correct error message when pulling non-existing image"))
  92. c.Assert(out, checker.Contains, "manifest unknown", check.Commentf("expected non-zero exit status and correct error message when pulling non-existing image"))
  93. }
  94. func (s *DockerRegistrySuite) TestPullByDigestNoFallback(c *check.C) {
  95. testPullByDigestNoFallback(c)
  96. }
  97. func (s *DockerSchema1RegistrySuite) TestPullByDigestNoFallback(c *check.C) {
  98. testPullByDigestNoFallback(c)
  99. }
  100. func (s *DockerRegistrySuite) TestCreateByDigest(c *check.C) {
  101. pushDigest, err := setupImage(c)
  102. c.Assert(err, checker.IsNil, check.Commentf("error setting up image"))
  103. imageReference := fmt.Sprintf("%s@%s", repoName, pushDigest)
  104. containerName := "createByDigest"
  105. dockerCmd(c, "create", "--name", containerName, imageReference)
  106. res := inspectField(c, containerName, "Config.Image")
  107. c.Assert(res, checker.Equals, imageReference)
  108. }
  109. func (s *DockerRegistrySuite) TestRunByDigest(c *check.C) {
  110. pushDigest, err := setupImage(c)
  111. c.Assert(err, checker.IsNil)
  112. imageReference := fmt.Sprintf("%s@%s", repoName, pushDigest)
  113. containerName := "runByDigest"
  114. out, _ := dockerCmd(c, "run", "--name", containerName, imageReference, "sh", "-c", "echo found=$digest")
  115. foundRegex := regexp.MustCompile("found=([^\n]+)")
  116. matches := foundRegex.FindStringSubmatch(out)
  117. c.Assert(matches, checker.HasLen, 2, check.Commentf("unable to parse digest from pull output: %s", out))
  118. c.Assert(matches[1], checker.Equals, "1", check.Commentf("Expected %q, got %q", "1", matches[1]))
  119. res := inspectField(c, containerName, "Config.Image")
  120. c.Assert(res, checker.Equals, imageReference)
  121. }
  122. func (s *DockerRegistrySuite) TestRemoveImageByDigest(c *check.C) {
  123. digest, err := setupImage(c)
  124. c.Assert(err, checker.IsNil, check.Commentf("error setting up image"))
  125. imageReference := fmt.Sprintf("%s@%s", repoName, digest)
  126. // pull from the registry using the <name>@<digest> reference
  127. dockerCmd(c, "pull", imageReference)
  128. // make sure inspect runs ok
  129. inspectField(c, imageReference, "Id")
  130. // do the delete
  131. err = deleteImages(imageReference)
  132. c.Assert(err, checker.IsNil, check.Commentf("unexpected error deleting image"))
  133. // try to inspect again - it should error this time
  134. _, err = inspectFieldWithError(imageReference, "Id")
  135. //unexpected nil err trying to inspect what should be a non-existent image
  136. c.Assert(err, checker.NotNil)
  137. c.Assert(err.Error(), checker.Contains, "No such image")
  138. }
  139. func (s *DockerRegistrySuite) TestBuildByDigest(c *check.C) {
  140. digest, err := setupImage(c)
  141. c.Assert(err, checker.IsNil, check.Commentf("error setting up image"))
  142. imageReference := fmt.Sprintf("%s@%s", repoName, digest)
  143. // pull from the registry using the <name>@<digest> reference
  144. dockerCmd(c, "pull", imageReference)
  145. // get the image id
  146. imageID := inspectField(c, imageReference, "Id")
  147. // do the build
  148. name := "buildbydigest"
  149. _, err = buildImage(name, fmt.Sprintf(
  150. `FROM %s
  151. CMD ["/bin/echo", "Hello World"]`, imageReference),
  152. true)
  153. c.Assert(err, checker.IsNil)
  154. // get the build's image id
  155. res := inspectField(c, name, "Config.Image")
  156. // make sure they match
  157. c.Assert(res, checker.Equals, imageID)
  158. }
  159. func (s *DockerRegistrySuite) TestTagByDigest(c *check.C) {
  160. digest, err := setupImage(c)
  161. c.Assert(err, checker.IsNil, check.Commentf("error setting up image"))
  162. imageReference := fmt.Sprintf("%s@%s", repoName, digest)
  163. // pull from the registry using the <name>@<digest> reference
  164. dockerCmd(c, "pull", imageReference)
  165. // tag it
  166. tag := "tagbydigest"
  167. dockerCmd(c, "tag", imageReference, tag)
  168. expectedID := inspectField(c, imageReference, "Id")
  169. tagID := inspectField(c, tag, "Id")
  170. c.Assert(tagID, checker.Equals, expectedID)
  171. }
  172. func (s *DockerRegistrySuite) TestListImagesWithoutDigests(c *check.C) {
  173. digest, err := setupImage(c)
  174. c.Assert(err, checker.IsNil, check.Commentf("error setting up image"))
  175. imageReference := fmt.Sprintf("%s@%s", repoName, digest)
  176. // pull from the registry using the <name>@<digest> reference
  177. dockerCmd(c, "pull", imageReference)
  178. out, _ := dockerCmd(c, "images")
  179. c.Assert(out, checker.Not(checker.Contains), "DIGEST", check.Commentf("list output should not have contained DIGEST header"))
  180. }
  181. func (s *DockerRegistrySuite) TestListImagesWithDigests(c *check.C) {
  182. // setup image1
  183. digest1, err := setupImageWithTag(c, "tag1")
  184. c.Assert(err, checker.IsNil, check.Commentf("error setting up image"))
  185. imageReference1 := fmt.Sprintf("%s@%s", repoName, digest1)
  186. c.Logf("imageReference1 = %s", imageReference1)
  187. // pull image1 by digest
  188. dockerCmd(c, "pull", imageReference1)
  189. // list images
  190. out, _ := dockerCmd(c, "images", "--digests")
  191. // make sure repo shown, tag=<none>, digest = $digest1
  192. re1 := regexp.MustCompile(`\s*` + repoName + `\s*<none>\s*` + digest1.String() + `\s`)
  193. c.Assert(re1.MatchString(out), checker.True, check.Commentf("expected %q: %s", re1.String(), out))
  194. // setup image2
  195. digest2, err := setupImageWithTag(c, "tag2")
  196. //error setting up image
  197. c.Assert(err, checker.IsNil)
  198. imageReference2 := fmt.Sprintf("%s@%s", repoName, digest2)
  199. c.Logf("imageReference2 = %s", imageReference2)
  200. // pull image1 by digest
  201. dockerCmd(c, "pull", imageReference1)
  202. // pull image2 by digest
  203. dockerCmd(c, "pull", imageReference2)
  204. // list images
  205. out, _ = dockerCmd(c, "images", "--digests")
  206. // make sure repo shown, tag=<none>, digest = $digest1
  207. c.Assert(re1.MatchString(out), checker.True, check.Commentf("expected %q: %s", re1.String(), out))
  208. // make sure repo shown, tag=<none>, digest = $digest2
  209. re2 := regexp.MustCompile(`\s*` + repoName + `\s*<none>\s*` + digest2.String() + `\s`)
  210. c.Assert(re2.MatchString(out), checker.True, check.Commentf("expected %q: %s", re2.String(), out))
  211. // pull tag1
  212. dockerCmd(c, "pull", repoName+":tag1")
  213. // list images
  214. out, _ = dockerCmd(c, "images", "--digests")
  215. // make sure image 1 has repo, tag, <none> AND repo, <none>, digest
  216. reWithDigest1 := regexp.MustCompile(`\s*` + repoName + `\s*tag1\s*` + digest1.String() + `\s`)
  217. c.Assert(reWithDigest1.MatchString(out), checker.True, check.Commentf("expected %q: %s", reWithDigest1.String(), out))
  218. // make sure image 2 has repo, <none>, digest
  219. c.Assert(re2.MatchString(out), checker.True, check.Commentf("expected %q: %s", re2.String(), out))
  220. // pull tag 2
  221. dockerCmd(c, "pull", repoName+":tag2")
  222. // list images
  223. out, _ = dockerCmd(c, "images", "--digests")
  224. // make sure image 1 has repo, tag, digest
  225. c.Assert(reWithDigest1.MatchString(out), checker.True, check.Commentf("expected %q: %s", reWithDigest1.String(), out))
  226. // make sure image 2 has repo, tag, digest
  227. reWithDigest2 := regexp.MustCompile(`\s*` + repoName + `\s*tag2\s*` + digest2.String() + `\s`)
  228. c.Assert(reWithDigest2.MatchString(out), checker.True, check.Commentf("expected %q: %s", reWithDigest2.String(), out))
  229. // list images
  230. out, _ = dockerCmd(c, "images", "--digests")
  231. // make sure image 1 has repo, tag, digest
  232. c.Assert(reWithDigest1.MatchString(out), checker.True, check.Commentf("expected %q: %s", reWithDigest1.String(), out))
  233. // make sure image 2 has repo, tag, digest
  234. c.Assert(reWithDigest2.MatchString(out), checker.True, check.Commentf("expected %q: %s", reWithDigest2.String(), out))
  235. // make sure busybox has tag, but not digest
  236. busyboxRe := regexp.MustCompile(`\s*busybox\s*latest\s*<none>\s`)
  237. c.Assert(busyboxRe.MatchString(out), checker.True, check.Commentf("expected %q: %s", busyboxRe.String(), out))
  238. }
  239. func (s *DockerRegistrySuite) TestListDanglingImagesWithDigests(c *check.C) {
  240. // setup image1
  241. digest1, err := setupImageWithTag(c, "dangle1")
  242. c.Assert(err, checker.IsNil, check.Commentf("error setting up image"))
  243. imageReference1 := fmt.Sprintf("%s@%s", repoName, digest1)
  244. c.Logf("imageReference1 = %s", imageReference1)
  245. // pull image1 by digest
  246. dockerCmd(c, "pull", imageReference1)
  247. // list images
  248. out, _ := dockerCmd(c, "images", "--digests")
  249. // make sure repo shown, tag=<none>, digest = $digest1
  250. re1 := regexp.MustCompile(`\s*` + repoName + `\s*<none>\s*` + digest1.String() + `\s`)
  251. c.Assert(re1.MatchString(out), checker.True, check.Commentf("expected %q: %s", re1.String(), out))
  252. // setup image2
  253. digest2, err := setupImageWithTag(c, "dangle2")
  254. //error setting up image
  255. c.Assert(err, checker.IsNil)
  256. imageReference2 := fmt.Sprintf("%s@%s", repoName, digest2)
  257. c.Logf("imageReference2 = %s", imageReference2)
  258. // pull image1 by digest
  259. dockerCmd(c, "pull", imageReference1)
  260. // pull image2 by digest
  261. dockerCmd(c, "pull", imageReference2)
  262. // list images
  263. out, _ = dockerCmd(c, "images", "--digests", "--filter=\"dangling=true\"")
  264. // make sure repo shown, tag=<none>, digest = $digest1
  265. c.Assert(re1.MatchString(out), checker.True, check.Commentf("expected %q: %s", re1.String(), out))
  266. // make sure repo shown, tag=<none>, digest = $digest2
  267. re2 := regexp.MustCompile(`\s*` + repoName + `\s*<none>\s*` + digest2.String() + `\s`)
  268. c.Assert(re2.MatchString(out), checker.True, check.Commentf("expected %q: %s", re2.String(), out))
  269. // pull dangle1 tag
  270. dockerCmd(c, "pull", repoName+":dangle1")
  271. // list images
  272. out, _ = dockerCmd(c, "images", "--digests", "--filter=\"dangling=true\"")
  273. // make sure image 1 has repo, tag, <none> AND repo, <none>, digest
  274. reWithDigest1 := regexp.MustCompile(`\s*` + repoName + `\s*dangle1\s*` + digest1.String() + `\s`)
  275. c.Assert(reWithDigest1.MatchString(out), checker.False, check.Commentf("unexpected %q: %s", reWithDigest1.String(), out))
  276. // make sure image 2 has repo, <none>, digest
  277. c.Assert(re2.MatchString(out), checker.True, check.Commentf("expected %q: %s", re2.String(), out))
  278. // pull dangle2 tag
  279. dockerCmd(c, "pull", repoName+":dangle2")
  280. // list images, show tagged images
  281. out, _ = dockerCmd(c, "images", "--digests")
  282. // make sure image 1 has repo, tag, digest
  283. c.Assert(reWithDigest1.MatchString(out), checker.True, check.Commentf("expected %q: %s", reWithDigest1.String(), out))
  284. // make sure image 2 has repo, tag, digest
  285. reWithDigest2 := regexp.MustCompile(`\s*` + repoName + `\s*dangle2\s*` + digest2.String() + `\s`)
  286. c.Assert(reWithDigest2.MatchString(out), checker.True, check.Commentf("expected %q: %s", reWithDigest2.String(), out))
  287. // list images, no longer dangling, should not match
  288. out, _ = dockerCmd(c, "images", "--digests", "--filter=\"dangling=true\"")
  289. // make sure image 1 has repo, tag, digest
  290. c.Assert(reWithDigest1.MatchString(out), checker.False, check.Commentf("unexpected %q: %s", reWithDigest1.String(), out))
  291. // make sure image 2 has repo, tag, digest
  292. c.Assert(reWithDigest2.MatchString(out), checker.False, check.Commentf("unexpected %q: %s", reWithDigest2.String(), out))
  293. }
  294. func (s *DockerRegistrySuite) TestInspectImageWithDigests(c *check.C) {
  295. digest, err := setupImage(c)
  296. c.Assert(err, check.IsNil, check.Commentf("error setting up image"))
  297. imageReference := fmt.Sprintf("%s@%s", repoName, digest)
  298. // pull from the registry using the <name>@<digest> reference
  299. dockerCmd(c, "pull", imageReference)
  300. out, _ := dockerCmd(c, "inspect", imageReference)
  301. var imageJSON []types.ImageInspect
  302. err = json.Unmarshal([]byte(out), &imageJSON)
  303. c.Assert(err, checker.IsNil)
  304. c.Assert(imageJSON, checker.HasLen, 1)
  305. c.Assert(imageJSON[0].RepoDigests, checker.HasLen, 1)
  306. c.Assert(stringutils.InSlice(imageJSON[0].RepoDigests, imageReference), checker.Equals, true)
  307. }
  308. func (s *DockerRegistrySuite) TestPsListContainersFilterAncestorImageByDigest(c *check.C) {
  309. digest, err := setupImage(c)
  310. c.Assert(err, checker.IsNil, check.Commentf("error setting up image"))
  311. imageReference := fmt.Sprintf("%s@%s", repoName, digest)
  312. // pull from the registry using the <name>@<digest> reference
  313. dockerCmd(c, "pull", imageReference)
  314. // build an image from it
  315. imageName1 := "images_ps_filter_test"
  316. _, err = buildImage(imageName1, fmt.Sprintf(
  317. `FROM %s
  318. LABEL match me 1`, imageReference), true)
  319. c.Assert(err, checker.IsNil)
  320. // run a container based on that
  321. dockerCmd(c, "run", "--name=test1", imageReference, "echo", "hello")
  322. expectedID, err := getIDByName("test1")
  323. c.Assert(err, check.IsNil)
  324. // run a container based on the a descendant of that too
  325. dockerCmd(c, "run", "--name=test2", imageName1, "echo", "hello")
  326. expectedID1, err := getIDByName("test2")
  327. c.Assert(err, check.IsNil)
  328. expectedIDs := []string{expectedID, expectedID1}
  329. // Invalid imageReference
  330. out, _ := dockerCmd(c, "ps", "-a", "-q", "--no-trunc", fmt.Sprintf("--filter=ancestor=busybox@%s", digest))
  331. // Filter container for ancestor filter should be empty
  332. c.Assert(strings.TrimSpace(out), checker.Equals, "")
  333. // Valid imageReference
  334. out, _ = dockerCmd(c, "ps", "-a", "-q", "--no-trunc", "--filter=ancestor="+imageReference)
  335. checkPsAncestorFilterOutput(c, out, imageReference, expectedIDs)
  336. }
  337. func (s *DockerRegistrySuite) TestDeleteImageByIDOnlyPulledByDigest(c *check.C) {
  338. pushDigest, err := setupImage(c)
  339. c.Assert(err, checker.IsNil, check.Commentf("error setting up image"))
  340. // pull from the registry using the <name>@<digest> reference
  341. imageReference := fmt.Sprintf("%s@%s", repoName, pushDigest)
  342. dockerCmd(c, "pull", imageReference)
  343. // just in case...
  344. dockerCmd(c, "tag", imageReference, repoName+":sometag")
  345. imageID := inspectField(c, imageReference, "Id")
  346. dockerCmd(c, "rmi", imageID)
  347. _, err = inspectFieldWithError(imageID, "Id")
  348. c.Assert(err, checker.NotNil, check.Commentf("image should have been deleted"))
  349. }
  350. func (s *DockerRegistrySuite) TestDeleteImageWithDigestAndTag(c *check.C) {
  351. pushDigest, err := setupImage(c)
  352. c.Assert(err, checker.IsNil, check.Commentf("error setting up image"))
  353. // pull from the registry using the <name>@<digest> reference
  354. imageReference := fmt.Sprintf("%s@%s", repoName, pushDigest)
  355. dockerCmd(c, "pull", imageReference)
  356. imageID := inspectField(c, imageReference, "Id")
  357. repoTag := repoName + ":sometag"
  358. repoTag2 := repoName + ":othertag"
  359. dockerCmd(c, "tag", imageReference, repoTag)
  360. dockerCmd(c, "tag", imageReference, repoTag2)
  361. dockerCmd(c, "rmi", repoTag2)
  362. // rmi should have deleted only repoTag2, because there's another tag
  363. inspectField(c, repoTag, "Id")
  364. dockerCmd(c, "rmi", repoTag)
  365. // rmi should have deleted the tag, the digest reference, and the image itself
  366. _, err = inspectFieldWithError(imageID, "Id")
  367. c.Assert(err, checker.NotNil, check.Commentf("image should have been deleted"))
  368. }
  369. func (s *DockerRegistrySuite) TestDeleteImageWithDigestAndMultiRepoTag(c *check.C) {
  370. pushDigest, err := setupImage(c)
  371. c.Assert(err, checker.IsNil, check.Commentf("error setting up image"))
  372. repo2 := fmt.Sprintf("%s/%s", repoName, "repo2")
  373. // pull from the registry using the <name>@<digest> reference
  374. imageReference := fmt.Sprintf("%s@%s", repoName, pushDigest)
  375. dockerCmd(c, "pull", imageReference)
  376. imageID := inspectField(c, imageReference, "Id")
  377. repoTag := repoName + ":sometag"
  378. repoTag2 := repo2 + ":othertag"
  379. dockerCmd(c, "tag", imageReference, repoTag)
  380. dockerCmd(c, "tag", imageReference, repoTag2)
  381. dockerCmd(c, "rmi", repoTag)
  382. // rmi should have deleted repoTag and image reference, but left repoTag2
  383. inspectField(c, repoTag2, "Id")
  384. _, err = inspectFieldWithError(imageReference, "Id")
  385. c.Assert(err, checker.NotNil, check.Commentf("image digest reference should have been removed"))
  386. _, err = inspectFieldWithError(repoTag, "Id")
  387. c.Assert(err, checker.NotNil, check.Commentf("image tag reference should have been removed"))
  388. dockerCmd(c, "rmi", repoTag2)
  389. // rmi should have deleted the tag, the digest reference, and the image itself
  390. _, err = inspectFieldWithError(imageID, "Id")
  391. c.Assert(err, checker.NotNil, check.Commentf("image should have been deleted"))
  392. }
  393. // TestPullFailsWithAlteredManifest tests that a `docker pull` fails when
  394. // we have modified a manifest blob and its digest cannot be verified.
  395. // This is the schema2 version of the test.
  396. func (s *DockerRegistrySuite) TestPullFailsWithAlteredManifest(c *check.C) {
  397. testRequires(c, DaemonIsLinux)
  398. manifestDigest, err := setupImage(c)
  399. c.Assert(err, checker.IsNil, check.Commentf("error setting up image"))
  400. // Load the target manifest blob.
  401. manifestBlob := s.reg.readBlobContents(c, manifestDigest)
  402. var imgManifest schema2.Manifest
  403. err = json.Unmarshal(manifestBlob, &imgManifest)
  404. c.Assert(err, checker.IsNil, check.Commentf("unable to decode image manifest from blob"))
  405. // Change a layer in the manifest.
  406. imgManifest.Layers[0].Digest = digest.Digest("sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef")
  407. // Move the existing data file aside, so that we can replace it with a
  408. // malicious blob of data. NOTE: we defer the returned undo func.
  409. undo := s.reg.tempMoveBlobData(c, manifestDigest)
  410. defer undo()
  411. alteredManifestBlob, err := json.MarshalIndent(imgManifest, "", " ")
  412. c.Assert(err, checker.IsNil, check.Commentf("unable to encode altered image manifest to JSON"))
  413. s.reg.writeBlobContents(c, manifestDigest, alteredManifestBlob)
  414. // Now try pulling that image by digest. We should get an error about
  415. // digest verification for the manifest digest.
  416. // Pull from the registry using the <name>@<digest> reference.
  417. imageReference := fmt.Sprintf("%s@%s", repoName, manifestDigest)
  418. out, exitStatus, _ := dockerCmdWithError("pull", imageReference)
  419. c.Assert(exitStatus, checker.Not(check.Equals), 0)
  420. expectedErrorMsg := fmt.Sprintf("manifest verification failed for digest %s", manifestDigest)
  421. c.Assert(out, checker.Contains, expectedErrorMsg)
  422. }
  423. // TestPullFailsWithAlteredManifest tests that a `docker pull` fails when
  424. // we have modified a manifest blob and its digest cannot be verified.
  425. // This is the schema1 version of the test.
  426. func (s *DockerSchema1RegistrySuite) TestPullFailsWithAlteredManifest(c *check.C) {
  427. testRequires(c, DaemonIsLinux)
  428. manifestDigest, err := setupImage(c)
  429. c.Assert(err, checker.IsNil, check.Commentf("error setting up image"))
  430. // Load the target manifest blob.
  431. manifestBlob := s.reg.readBlobContents(c, manifestDigest)
  432. var imgManifest schema1.Manifest
  433. err = json.Unmarshal(manifestBlob, &imgManifest)
  434. c.Assert(err, checker.IsNil, check.Commentf("unable to decode image manifest from blob"))
  435. // Change a layer in the manifest.
  436. imgManifest.FSLayers[0] = schema1.FSLayer{
  437. BlobSum: digest.Digest("sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"),
  438. }
  439. // Move the existing data file aside, so that we can replace it with a
  440. // malicious blob of data. NOTE: we defer the returned undo func.
  441. undo := s.reg.tempMoveBlobData(c, manifestDigest)
  442. defer undo()
  443. alteredManifestBlob, err := json.MarshalIndent(imgManifest, "", " ")
  444. c.Assert(err, checker.IsNil, check.Commentf("unable to encode altered image manifest to JSON"))
  445. s.reg.writeBlobContents(c, manifestDigest, alteredManifestBlob)
  446. // Now try pulling that image by digest. We should get an error about
  447. // digest verification for the manifest digest.
  448. // Pull from the registry using the <name>@<digest> reference.
  449. imageReference := fmt.Sprintf("%s@%s", repoName, manifestDigest)
  450. out, exitStatus, _ := dockerCmdWithError("pull", imageReference)
  451. c.Assert(exitStatus, checker.Not(check.Equals), 0)
  452. expectedErrorMsg := fmt.Sprintf("image verification failed for digest %s", manifestDigest)
  453. c.Assert(out, checker.Contains, expectedErrorMsg)
  454. }
  455. // TestPullFailsWithAlteredLayer tests that a `docker pull` fails when
  456. // we have modified a layer blob and its digest cannot be verified.
  457. // This is the schema2 version of the test.
  458. func (s *DockerRegistrySuite) TestPullFailsWithAlteredLayer(c *check.C) {
  459. testRequires(c, DaemonIsLinux)
  460. manifestDigest, err := setupImage(c)
  461. c.Assert(err, checker.IsNil)
  462. // Load the target manifest blob.
  463. manifestBlob := s.reg.readBlobContents(c, manifestDigest)
  464. var imgManifest schema2.Manifest
  465. err = json.Unmarshal(manifestBlob, &imgManifest)
  466. c.Assert(err, checker.IsNil)
  467. // Next, get the digest of one of the layers from the manifest.
  468. targetLayerDigest := imgManifest.Layers[0].Digest
  469. // Move the existing data file aside, so that we can replace it with a
  470. // malicious blob of data. NOTE: we defer the returned undo func.
  471. undo := s.reg.tempMoveBlobData(c, targetLayerDigest)
  472. defer undo()
  473. // Now make a fake data blob in this directory.
  474. s.reg.writeBlobContents(c, targetLayerDigest, []byte("This is not the data you are looking for."))
  475. // Now try pulling that image by digest. We should get an error about
  476. // digest verification for the target layer digest.
  477. // Remove distribution cache to force a re-pull of the blobs
  478. if err := os.RemoveAll(filepath.Join(dockerBasePath, "image", s.d.storageDriver, "distribution")); err != nil {
  479. c.Fatalf("error clearing distribution cache: %v", err)
  480. }
  481. // Pull from the registry using the <name>@<digest> reference.
  482. imageReference := fmt.Sprintf("%s@%s", repoName, manifestDigest)
  483. out, exitStatus, _ := dockerCmdWithError("pull", imageReference)
  484. c.Assert(exitStatus, checker.Not(check.Equals), 0, check.Commentf("expected a non-zero exit status"))
  485. expectedErrorMsg := fmt.Sprintf("filesystem layer verification failed for digest %s", targetLayerDigest)
  486. c.Assert(out, checker.Contains, expectedErrorMsg, check.Commentf("expected error message in output: %s", out))
  487. }
  488. // TestPullFailsWithAlteredLayer tests that a `docker pull` fails when
  489. // we have modified a layer blob and its digest cannot be verified.
  490. // This is the schema1 version of the test.
  491. func (s *DockerSchema1RegistrySuite) TestPullFailsWithAlteredLayer(c *check.C) {
  492. testRequires(c, DaemonIsLinux)
  493. manifestDigest, err := setupImage(c)
  494. c.Assert(err, checker.IsNil)
  495. // Load the target manifest blob.
  496. manifestBlob := s.reg.readBlobContents(c, manifestDigest)
  497. var imgManifest schema1.Manifest
  498. err = json.Unmarshal(manifestBlob, &imgManifest)
  499. c.Assert(err, checker.IsNil)
  500. // Next, get the digest of one of the layers from the manifest.
  501. targetLayerDigest := imgManifest.FSLayers[0].BlobSum
  502. // Move the existing data file aside, so that we can replace it with a
  503. // malicious blob of data. NOTE: we defer the returned undo func.
  504. undo := s.reg.tempMoveBlobData(c, targetLayerDigest)
  505. defer undo()
  506. // Now make a fake data blob in this directory.
  507. s.reg.writeBlobContents(c, targetLayerDigest, []byte("This is not the data you are looking for."))
  508. // Now try pulling that image by digest. We should get an error about
  509. // digest verification for the target layer digest.
  510. // Remove distribution cache to force a re-pull of the blobs
  511. if err := os.RemoveAll(filepath.Join(dockerBasePath, "image", s.d.storageDriver, "distribution")); err != nil {
  512. c.Fatalf("error clearing distribution cache: %v", err)
  513. }
  514. // Pull from the registry using the <name>@<digest> reference.
  515. imageReference := fmt.Sprintf("%s@%s", repoName, manifestDigest)
  516. out, exitStatus, _ := dockerCmdWithError("pull", imageReference)
  517. c.Assert(exitStatus, checker.Not(check.Equals), 0, check.Commentf("expected a non-zero exit status"))
  518. expectedErrorMsg := fmt.Sprintf("filesystem layer verification failed for digest %s", targetLayerDigest)
  519. c.Assert(out, checker.Contains, expectedErrorMsg, check.Commentf("expected error message in output: %s", out))
  520. }