Output correct image ID when using Docker with the containerd-snapshotter.

Prior to this change, the following command emits the wrong image ID when buildx
uses the "docker-container" driver and Docker is configured with the
containerd-snapshotter.

$ docker buildx build --load --iidfile=img.txt

$ docker run --rm "$(cat img.txt)" echo hello
docker: Error response from daemon: No such image: sha256:4ac37e81e00f242010e42f3251094e47de6100e01d25e9bd0feac6b8906976df.
See 'docker run --help'.

The problem is that buildx is outputing the incorrect image ID in this scenario
(it's outputing the container image config digest, instead of the container
image digest used by the containerd-snapshotter).

This commit fixes this. See moby/moby#45458.

Signed-off-by: Cesar Talledo <[email protected]>

Author: ctalledo

commands/build.go

@@ -33,6 +33,7 @@ import (
 	"github.com/docker/buildx/util/cobrautil"
 	"github.com/docker/buildx/util/confutil"
 	"github.com/docker/buildx/util/desktop"
+	"github.com/docker/buildx/util/dockerutil"
 	"github.com/docker/buildx/util/ioset"
 	"github.com/docker/buildx/util/metricutil"
 	"github.com/docker/buildx/util/osutil"
@@ -321,12 +322,15 @@ func runBuild(ctx context.Context, dockerCli command.Cli, options buildOptions)
 	if err != nil {
 		return err
 	}
+
 	_, err = b.LoadNodes(ctx)
 	if err != nil {
 		return err
 	}
 	driverType := b.Driver
 
+	dockerUsingContainerdSnapshotter := isDockerUsingContainerdSnapshotter(ctx, dockerCli, opts.Exports)
+
 	var term bool
 	if _, err := console.ConsoleFromFile(os.Stderr); err == nil {
 		term = true
@@ -377,12 +381,12 @@ func runBuild(ctx context.Context, dockerCli command.Cli, options buildOptions)
 	case progressui.RawJSONMode:
 		// no additional display
 	case progressui.QuietMode:
-		fmt.Println(getImageID(resp.ExporterResponse))
+		fmt.Println(getImageID(resp.ExporterResponse, dockerUsingContainerdSnapshotter))
 	default:
 		desktop.PrintBuildDetails(os.Stderr, printer.BuildRefs(), term)
 	}
 	if options.imageIDFile != "" {
-		if err := os.WriteFile(options.imageIDFile, []byte(getImageID(resp.ExporterResponse)), 0644); err != nil {
+		if err := os.WriteFile(options.imageIDFile, []byte(getImageID(resp.ExporterResponse, dockerUsingContainerdSnapshotter)), 0644); err != nil {
 			return errors.Wrap(err, "writing image ID file")
 		}
 	}
@@ -412,12 +416,40 @@ func runBuild(ctx context.Context, dockerCli command.Cli, options buildOptions)
 }
 
 // getImageID returns the image ID - the digest of the image config
-func getImageID(resp map[string]string) string {
-	dgst := resp[exptypes.ExporterImageDigestKey]
-	if v, ok := resp[exptypes.ExporterImageConfigDigestKey]; ok {
-		dgst = v
+func getImageID(resp map[string]string, dockerUsingContainerdSnapshotter bool) string {
+	if dockerUsingContainerdSnapshotter {
+		// If Docker is using the containerd snapshotter, use the image digest, not
+		// the image config digest. See https://github.com/moby/moby/issues/45458.
+		return resp[exptypes.ExporterImageDigestKey]
+	}
+
+	return resp[exptypes.ExporterImageConfigDigestKey]
+}
+
+func isDockerUsingContainerdSnapshotter(ctx context.Context, dockerCli command.Cli, exports []*controllerapi.ExportEntry) bool {
+	usingContainerdSnapshotter := false
+
+	// If the build command has "-o type=docker,context=<mycontext>", then pass that
+	// context to docker.Features() below, so we can find out if the associated
+	// Docker engine is using the containerd snapshotter.
+	dockerCtx := ""
+	for _, e := range exports {
+		if e.Type == "docker" {
+			for k, v := range e.Attrs {
+				if k == "context" {
+					dockerCtx = v
+				}
+			}
+		}
 	}
-	return dgst
+
+	docker := dockerutil.NewClient(dockerCli)
+	features := docker.Features(ctx, dockerCtx)
+	if features[dockerutil.OCIImporter] {
+		usingContainerdSnapshotter = true
+	}
+
+	return usingContainerdSnapshotter
 }
 
 func runBasicBuild(ctx context.Context, dockerCli command.Cli, opts *controllerapi.BuildOptions, printer *progress.Printer) (*client.SolveResponse, *build.Inputs, error) {

tests/build.go

@@ -399,18 +399,25 @@ func testImageIDOutput(t *testing.T, sb integration.Sandbox) {
 
 	require.Equal(t, dgst.String(), strings.TrimSpace(stdout.String()))
 
+	// read the md.json file
 	dt, err = os.ReadFile(filepath.Join(targetDir, "md.json"))
 	require.NoError(t, err)
 
 	type mdT struct {
+		Digest       string `json:"containerimage.digest"`
 		ConfigDigest string `json:"containerimage.config.digest"`
 	}
+
 	var md mdT
 	err = json.Unmarshal(dt, &md)
 	require.NoError(t, err)
 
 	require.NotEmpty(t, md.ConfigDigest)
-	require.Equal(t, dgst, digest.Digest(md.ConfigDigest))
+	require.NotEmpty(t, md.Digest)
+
+	// verify the image ID output is correct
+	// XXX: improve this by checking that it's one of the two expected digests depending on the scenario.
+	require.Contains(t, []digest.Digest{digest.Digest(md.ConfigDigest), digest.Digest(md.Digest)}, dgst)
 }
 
 func testBuildMobyFromLocalImage(t *testing.T, sb integration.Sandbox) {