Repository navigation
fix(frontend): remove inherited descriptors during publication - #143
Merged
Merged
Conversation
Images built FROM another kit and merged sets legitimately carry several staged descriptors. Identify the contribution by matching the published annotation at the image pin, preserving inherited sources and refusing ambiguous matches. Keep the single-source path local, and document the registry-access boundary of the extra metadata lookup. Signed-off-by: Christian Dupuis <cd@docker.com>
There was a problem hiding this comment.
🟡 Changes recommended
Collision checks omit inherited source roots, allowing outer sets to overwrite inherited kit descriptors.
1 open issue
What changed in this PR
This PR enables set composition from images carrying inherited kit sources or merged sets by matching their published descriptor to a staged source root.
Changes:
- Resolve published metadata at the pinned digest and requested platform while preserving the single-descriptor path.
- Add registry transport support, a frontend CA bundle, and documentation of anonymous-access limitations.
- Add unit and end-to-end coverage for descriptor selection, nested sets, and inherited sources.
| File | Description |
|---|---|
| README.md | Documents descriptor selection and registry-access limitations. |
| Dockerfile | Includes trusted CA certificates for metadata requests. |
| cmd/frontend/set.go | Resolves published identity when multiple descriptors are staged. |
| cmd/frontend/set_e2e_test.go | Covers inherited workloads and nested set composition. |
| cmd/frontend/kit_descriptor.go | Implements pinned metadata lookup and staged descriptor matching. |
| cmd/frontend/kit_descriptor_test.go | Tests identity matching, platform selection, and lookup restrictions. |
Review effort: Balanced
cdupuis
marked this pull request as draft
October 26, 2026 16:19
Resolve every descriptor manifest through BuildKit ImageBlob so private registry credentials, mirrors, custom CAs, and the builder network are shared with the image pull. Remove the anonymous HTTP fallback and frontend CA bundle. Exercise the boundary with an isolated credential session and a private TLS mirror for both bare manifests and annotated indexes. Full OCI manifest support depends on moby/buildkit#7324; keep the pull request in draft until that prerequisite is available. Signed-off-by: Christian Dupuis <cd@docker.com>
Recipe-built kits inherit their base filesystem without inheriting its declarations. Remove inherited staged descriptors before adding this kit's guidance and sources, while preserving the other inherited files. Set builds retain their members' staged sources as required by the specification. Replace the set-side manifest lookup with publication cleanup so private registries work with current builders and no BuildKit upgrade is required. Published images affected by contrib issue 426 need rebuilding with the updated frontend. Signed-off-by: Christian Dupuis <cd@docker.com>
cdupuis
changed the title
cdupuis
marked this pull request as ready for review
October 26, 2026 17:14
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Recipe-built kits can inherit staged descriptors through
FROM. Claude 2.1.310 inherited DHI'ssbx-templates/kit.yaml, so a set build found several descriptors and could not identify the kit being composed (docker/sbx-kits-contrib#426).Before staging a recipe-built kit's own guidance and sources, remove inherited
/usr/share/sandbox/kit/*/kit.yamlfiles. Keep inherited guidance, recipes, and payload files, and leave ordinary bases without staged sources alone. Builds usingkits:skip cleanup and preserve their listed kits' sources, as required by SPEC-v3 §10/merged-set-carries-sources. No descriptor grammar, normative statement, or conformance duty changes.The set reader keeps its existing path. This implementation needs no extra registry requests or BuildKit upgrade; private registries use the builder's existing authentication, mirror, and certificate configuration. Previously published images carrying inherited descriptors must be rebuilt with the updated frontend before they can be listed in a set. This replaces the earlier consumer-side implementation; BuildKit #7324 is no longer a prerequisite.
Regression coverage builds a workload FROM a merged set, publishes bare-manifest and annotated-index variants, then composes them into sets. It checks declaration isolation, create-phase argument expansion, removal of inherited descriptors, preservation of inherited guidance/recipes/payloads, and preservation of member sources in newly published sets. A separate test builds FROM and composes private images through an authenticated TLS mirror, with credentials only in the build session and the CA only in builder configuration. The regression reproduces #426 with cleanup disabled and passes with cleanup enabled on unmodified builders, including Docker's BuildKit v0.33.1.
Validation passed:
task validate,task lint,task test, andtask test:e2e.task kits:devbuilt hello, then stopped while extracting the gh example's Nix base because the Docker daemon ran out of storage.Fixes docker/sbx-kits-contrib#426 after affected images are rebuilt.
Release note