Merge pull request #45592 from vvoland/dangling-image-repotagsdigests-test

integration: Add TestImageInspectEmptyTagsAndDigests

Dockerfile.e2e

@@ -71,8 +71,8 @@ RUN apk --no-cache add \
     tar \
     xz
 
-COPY hack/test/e2e-run.sh       /scripts/run.sh
-COPY hack/make/.ensure-emptyfs  /scripts/ensure-emptyfs.sh
+COPY hack/test/e2e-run.sh           /scripts/run.sh
+COPY hack/make/.build-empty-images  /scripts/build-empty-images.sh
 
 COPY integration/testdata       /tests/integration/testdata
 COPY integration/build/testdata /tests/integration/build/testdata

hack/make/.build-empty-images

@@ -1,7 +1,12 @@
 #!/usr/bin/env bash
 set -e
 
-if ! docker image inspect emptyfs > /dev/null; then
+function imageNotPresent {
+	local img="$1"
+	! docker image inspect "$img" > /dev/null 2> /dev/null
+}
+
+if imageNotPresent "emptyfs"; then
 	# build a "docker save" tarball for "emptyfs"
 	# see https://github.com/docker/docker/pull/5262
 	# and also https://github.com/docker/docker/issues/4242
@@ -24,3 +29,27 @@ if ! docker image inspect emptyfs > /dev/null; then
 	)
 	rm -rf "$dir"
 fi
+
+# without c8d image store, image id is the config's id
+dangling_cfg=0df1207206e5288f4a989a2f13d1f5b3c4e70467702c1d5d21dfc9f002b7bd43
+# with c8d image store, image id is the id of manifest/manifest list.
+dangling_mfst=16d365089e5c10e1673ee82ab5bba38ade9b763296ad918bd24b42a1156c5456
+if imageNotPresent "$dangling_cfg" && imageNotPresent "$dangling_mfst"; then
+	dir="$DEST/dangling"
+	mkdir -p "$dir"
+	(
+		cd "$dir"
+		printf '{"schemaVersion":2,"manifests":[{"mediaType":"application/vnd.docker.distribution.manifest.v2+json","digest":"sha256:16d365089e5c10e1673ee82ab5bba38ade9b763296ad918bd24b42a1156c5456","size":264,"annotations":{"org.opencontainers.image.created":"2023-05-19T08:00:44Z"},"platform":{"architecture":"amd64","os":"linux"}}]}' > index.json
+		printf '[{"Config":"blobs/sha256/0df1207206e5288f4a989a2f13d1f5b3c4e70467702c1d5d21dfc9f002b7bd43","RepoTags":null,"Layers":null}]' > manifest.json
+		mkdir -p blobs/sha256
+		printf '{"schemaVersion":2,"mediaType":"application/vnd.docker.distribution.manifest.v2+json","config":{"mediaType":"application/vnd.docker.container.image.v1+json","digest":"sha256:0df1207206e5288f4a989a2f13d1f5b3c4e70467702c1d5d21dfc9f002b7bd43","size":390},"layers":[]}' > blobs/sha256/$dangling_mfst
+		printf '{"architecture":"amd64","config":{"Env":["PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"],"WorkingDir":"/","Labels":{"org.mobyproject.test.specialimage":"1"},"OnBuild":null},"created":null,"history":[{"created_by":"LABEL org.mobyproject.test.specialimage=1","comment":"buildkit.dockerfile.v0","empty_layer":true}],"os":"linux","rootfs":{"type":"layers","diff_ids":null}}' > blobs/sha256/$dangling_cfg
+		tar -cf layer.tar --files-from /dev/null
+	)
+	(
+		[ -n "$TESTDEBUG" ] && set -x
+		tar -cC "$dir" . | docker load
+	)
+	rm -rf "$dir"
+
+fi

hack/make/.integration-daemon-setup

@@ -3,5 +3,5 @@ set -e
 
 source "$MAKEDIR/.detect-daemon-osarch"
 if [ "$DOCKER_ENGINE_GOOS" != "windows" ]; then
-	bundle .ensure-emptyfs
+	bundle .build-empty-images
 fi

hack/test/e2e-run.sh

@@ -81,5 +81,5 @@ set_platform_timeout() {
 	fi
 }
 
-sh /scripts/ensure-emptyfs.sh
+sh /scripts/build-empty-images.sh
 run_test_integration

integration/image/inspect_test.go

@@ -0,0 +1,41 @@
+package image
+
+import (
+	"context"
+	"encoding/json"
+	"testing"
+
+	"github.com/docker/docker/testutil/environment"
+	"gotest.tools/v3/assert"
+	is "gotest.tools/v3/assert/cmp"
+	"gotest.tools/v3/skip"
+)
+
+// Regression test for: https://github.com/moby/moby/issues/45556
+func TestImageInspectEmptyTagsAndDigests(t *testing.T) {
+	skip.If(t, testEnv.OSType == "windows", "build-empty-images is not called on Windows")
+	defer setupTest(t)()
+
+	client := testEnv.APIClient()
+	ctx := context.Background()
+
+	danglingId := environment.DanglingImageIdGraphDriver
+	if testEnv.UsingSnapshotter() {
+		danglingId = environment.DanglingImageIdSnapshotter
+	}
+
+	inspect, raw, err := client.ImageInspectWithRaw(ctx, danglingId)
+	assert.NilError(t, err)
+
+	// Must be a zero length array, not null.
+	assert.Check(t, is.Len(inspect.RepoTags, 0))
+	assert.Check(t, is.Len(inspect.RepoDigests, 0))
+
+	var rawJson map[string]interface{}
+	err = json.Unmarshal(raw, &rawJson)
+	assert.NilError(t, err)
+
+	// Check if the raw json is also an array, not null.
+	assert.Check(t, is.Len(rawJson["RepoTags"], 0))
+	assert.Check(t, is.Len(rawJson["RepoDigests"], 0))
+}

testutil/environment/clean.go

@@ -98,6 +98,9 @@ func deleteAllImages(t testing.TB, apiclient client.ImageAPIClient, protectedIma
 	ctx := context.Background()
 	for _, image := range images {
 		tags := tagsFromImageSummary(image)
+		if _, ok := protectedImages[image.ID]; ok {
+			continue
+		}
 		if len(tags) == 0 {
 			removeImage(ctx, t, apiclient, image.ID)
 			continue

testutil/environment/environment.go

@@ -193,6 +193,13 @@ func (e *Execution) IsUserNamespaceInKernel() bool {
 	return true
 }
 
+// UsingSnapshotter returns whether containerd snapshotters are used for the
+// tests by checking if the "TEST_INTEGRATION_USE_SNAPSHOTTER" is set to a
+// non-empty value.
+func (e *Execution) UsingSnapshotter() bool {
+	return os.Getenv("TEST_INTEGRATION_USE_SNAPSHOTTER") != ""
+}
+
 // HasExistingImage checks whether there is an image with the given reference.
 // Note that this is done by filtering and then checking whether there were any
 // results -- so ambiguous references might result in false-positives.

testutil/environment/protect.go

@@ -95,6 +95,7 @@ func ProtectImages(t testing.TB, testEnv *Execution) {
 		images = append(images, frozenImages...)
 	}
 	testEnv.ProtectImage(t, images...)
+	testEnv.ProtectImage(t, DanglingImageIdGraphDriver, DanglingImageIdSnapshotter)
 }
 
 func getExistingImages(t testing.TB, testEnv *Execution) []string {

testutil/environment/special_images.go

@@ -0,0 +1,7 @@
+package environment
+
+// Graph driver image store identifies images by the ID of their config.
+const DanglingImageIdGraphDriver = "sha256:0df1207206e5288f4a989a2f13d1f5b3c4e70467702c1d5d21dfc9f002b7bd43"
+
+// The containerd image store identifies images by the ID of their manifest/manifest list.
+const DanglingImageIdSnapshotter = "sha256:16d365089e5c10e1673ee82ab5bba38ade9b763296ad918bd24b42a1156c5456"