Re: [PATCH v3 1/5] Introduce fetcher from container registries

["'MOESSBAUER, Felix' via isar-users" <isar-users@googlegroups.com>]

On Wed, 2024-07-17 at 18:02 +0200, Jan Kiszka wrote:
> On 17.07.24 13:50, Moessbauer, Felix (T CED OES-DE) wrote:
> > On Tue, 2024-07-16 at 16:18 +0200, Jan Kiszka wrote:
> > > From: Jan Kiszka <jan.kiszka@siemens.com>
> > > 
> > > This bitbake fetcher allows to pull container images from
> > > registries,
> > > store them in the download cache and transfer them into the
> > > workdir
> > > of
> > > recipes requesting the image. The format of the URL is
> > > 
> > > docker://[<host>/]<image>;digest=sha256:...[;tag=<tag>]
> > > 
> > > Fetching without digest is supported but will cause a warning,
> > > just
> > > like
> > > downloading via wget without a checksum.
> > 
> > This is fine, as long as the upstream artifact is expected to be
> > stable.
> > 
> > > 
> > >  If tag is left out, "latest" is
> > > used.
> > 
> > The tag should be mandatory and it should be clear that - even
> > without
> > digest - the artifact needs to be stable. Floating tags create all
> > kinds of issues (w.r.t. the sstate cache and reproducible builds),
> > so I
> > vote for just not allowing this.
> 
> I cannot follow: Leaving out the tag has nothing to do with getting a
> stable image. It may just lead to something being tagged "latest" on
> the
> device that had a different tag (or none) in the registry.

Ok, that means the image is just tagged on the device. Then it should
be fine.

Felix

> 
> > 
> > > 
> > > The fetcher will try to pull all available variants of a multi-
> > > arch
> > > image. If this is not needed, you can also directly specify the
> > > image
> > > digest of a specific architecture.
> > 
> > In most cases this does not make sense. I propose to always limit
> > the
> > fetching to the current architecture. For that, we either need a
> > mapping between the debian architecture and the OCI architectures
> > (what
> > is specified in the application/vnd.oci.image.index.v1+json
> > manifest),
> > or we simply don't support index manifests at all and force people
> > to
> > use image manifests (application/vnd.oci.image.manifest.v1+json).
> 
> Don't worry, I already have ideas of redesigning this into per-arch
> fetches. Background is using less different formats on the build
> system
> and, where possible, even hard-link between them to save space and
> time
> with larger images.
> 
> Jan
> 

-- 
Siemens AG, Technology
Linux Expert Center


-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/isar-users/e082c964a2c3d850566862da82c0c15186fdb55c.camel%40siemens.com.