Repository navigation
Conversation
cdupuis
added a commit
to docker/sandbox-kit-spec
that referenced
this pull request
Oct 26, 2026
Resolve every descriptor manifest through BuildKit ImageBlob so private registry credentials, mirrors, custom CAs, and the builder network are shared with the image pull. Remove the anonymous HTTP fallback and frontend CA bundle. Exercise the boundary with an isolated credential session and a private TLS mirror for both bare manifests and annotated indexes. Full OCI manifest support depends on moby/buildkit#7324; keep the pull request in draft until that prerequisite is available. Signed-off-by: Christian Dupuis <cd@docker.com>
FetchByDigest falls back from blobs to manifests, but its default Accept header is only a wildcard. Distribution rejects OCI manifests and indexes unless their media types are explicitly accepted. Advertise OCI and Docker manifest types while retaining wildcard acceptance for ordinary blobs, so ImageBlob can fetch manifests through the builder registry resolver and authentication session. Signed-off-by: Christian Dupuis <cd@docker.com>
cdupuis
force-pushed
the
fix/imageblob-manifest-negotiation
branch
from
October 26, 2026 16:35
6a852b2 to
251ed49
Compare
cdupuis
added a commit
to docker/sandbox-kit-spec
that referenced
this pull request
Oct 26, 2026
* fix(frontend): resolve published descriptors when composing kit sources Images built FROM another kit and merged sets legitimately carry several staged descriptors. Identify the contribution by matching the published annotation at the image pin, preserving inherited sources and refusing ambiguous matches. Keep the single-source path local, and document the registry-access boundary of the extra metadata lookup. Signed-off-by: Christian Dupuis <cd@docker.com> * fix(frontend): read kit manifests through the builder resolver Resolve every descriptor manifest through BuildKit ImageBlob so private registry credentials, mirrors, custom CAs, and the builder network are shared with the image pull. Remove the anonymous HTTP fallback and frontend CA bundle. Exercise the boundary with an isolated credential session and a private TLS mirror for both bare manifests and annotated indexes. Full OCI manifest support depends on moby/buildkit#7324; keep the pull request in draft until that prerequisite is available. Signed-off-by: Christian Dupuis <cd@docker.com> * fix(frontend): remove inherited descriptors during publication Recipe-built kits inherit their base filesystem without inheriting its declarations. Remove inherited staged descriptors before adding this kit's guidance and sources, while preserving the other inherited files. Set builds retain their members' staged sources as required by the specification. Replace the set-side manifest lookup with publication cleanup so private registries work with current builders and no BuildKit upgrade is required. Published images affected by contrib issue 426 need rebuilding with the updated frontend. Signed-off-by: Christian Dupuis <cd@docker.com> --------- Signed-off-by: Christian Dupuis <cd@docker.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
llb.ImageBlobcan fetch digest-addressed manifests through the builder's authenticated registry resolver, but the underlyingFetchByDigestcall sends onlyAccept: */*. Distribution rejects OCI manifests and indexes without an explicit matching media type, so its manifest fallback fails with a misleading blob HEAD 404 even when the image itself pulls successfully.Advertise OCI image manifest/index and Docker schema 2 manifest/list media types when fetching image blobs. The resolver retains wildcard acceptance for ordinary blob payloads. Credentials, mirror selection, and certificate handling continue through the existing builder resolver and session.
The new regression test reproduces the failure before this change and covers all four manifest types plus an ordinary blob.
go test ./source/containerblob/blobfetch -count=1passes, and the existingsource/containerblobtests pass from a privileged container (their snapshot mounts require privileges).Also verified downstream with the changed daemon: the sandbox-kit frontend's full guidance, cache, and set end-to-end suite passes, including derived workloads, nested sets, bare manifests, annotated indexes, and a private TLS registry accessible only through a builder-configured mirror. The same private-registry regression fails against the stock daemon. No full BuildKit integration suite was run.
This is a prerequisite for removing direct anonymous registry requests from docker/sandbox-kit-spec#143.