Output correct image ID when using Docker with the containerd-snapshotter.

Prior to this change, the following command emits the wrong image ID when buildx
uses the "docker-container" driver and Docker is configured with the
containerd-snapshotter.

$ docker buildx build --load --iidfile=img.txt

$ docker run --rm "$(cat img.txt)" echo hello
docker: Error response from daemon: No such image: sha256:4ac37e81e00f242010e42f3251094e47de6100e01d25e9bd0feac6b8906976df.
See 'docker run --help'.

The problem is that buildx is outputing the incorrect image ID in this scenario
(it's outputing the container image config digest, instead of the container
image digest used by the containerd-snapshotter).

This commit fixes this. See moby/moby#45458.

Signed-off-by: Cesar Talledo <[email protected]>

Author: ctalledo

commands/build.go

@@ -33,6 +33,7 @@ import (
 	"github.com/docker/buildx/util/cobrautil"
 	"github.com/docker/buildx/util/confutil"
 	"github.com/docker/buildx/util/desktop"
+	"github.com/docker/buildx/util/dockerutil"
 	"github.com/docker/buildx/util/ioset"
 	"github.com/docker/buildx/util/metricutil"
 	"github.com/docker/buildx/util/osutil"
@@ -321,12 +322,30 @@ func runBuild(ctx context.Context, dockerCli command.Cli, options buildOptions)
 	if err != nil {
 		return err
 	}
+
 	_, err = b.LoadNodes(ctx)
 	if err != nil {
 		return err
 	}
 	driverType := b.Driver
 
+	// Check if the image will be loaded (i.e.,  --load or --output=type=docker is set)
+	loadImage := opts.ExportLoad
+	for _, e := range opts.Exports {
+		if e.Type == "docker" {
+			loadImage = true
+		}
+	}
+
+	preferImageDigest := false
+	if loadImage {
+		// If loading the image and the local Docker instance is using the
+		// containerd snapshotter, output the image digest (rather than the image
+		// config digest), so that "docker run <digest>" will work. See
+		// https://github.com/moby/moby/issues/45458.
+		preferImageDigest = isDockerUsingContainerdSnapshotter(ctx, dockerCli, opts.Exports)
+	}
+
 	var term bool
 	if _, err := console.ConsoleFromFile(os.Stderr); err == nil {
 		term = true
@@ -377,12 +396,12 @@ func runBuild(ctx context.Context, dockerCli command.Cli, options buildOptions)
 	case progressui.RawJSONMode:
 		// no additional display
 	case progressui.QuietMode:
-		fmt.Println(getImageID(resp.ExporterResponse))
+		fmt.Println(getImageID(resp.ExporterResponse, preferImageDigest))
 	default:
 		desktop.PrintBuildDetails(os.Stderr, printer.BuildRefs(), term)
 	}
 	if options.imageIDFile != "" {
-		if err := os.WriteFile(options.imageIDFile, []byte(getImageID(resp.ExporterResponse)), 0644); err != nil {
+		if err := os.WriteFile(options.imageIDFile, []byte(getImageID(resp.ExporterResponse, preferImageDigest)), 0644); err != nil {
 			return errors.Wrap(err, "writing image ID file")
 		}
 	}
@@ -412,14 +431,43 @@ func runBuild(ctx context.Context, dockerCli command.Cli, options buildOptions)
 }
 
 // getImageID returns the image ID - the digest of the image config
-func getImageID(resp map[string]string) string {
+func getImageID(resp map[string]string, preferImageDigest bool) string {
 	dgst := resp[exptypes.ExporterImageDigestKey]
+	if preferImageDigest {
+		return dgst
+	}
 	if v, ok := resp[exptypes.ExporterImageConfigDigestKey]; ok {
 		dgst = v
 	}
 	return dgst
 }
 
+func isDockerUsingContainerdSnapshotter(ctx context.Context, dockerCli command.Cli, exports []*controllerapi.ExportEntry) bool {
+	usingContainerdSnapshotter := false
+
+	// If the build command has "-o type=docker,context=<mycontext>", then pass that
+	// context to docker.Features() below, so we can find out if the associated
+	// Docker engine is using the containerd snapshotter.
+	dockerCtx := ""
+	for _, e := range exports {
+		if e.Type == "docker" {
+			for k, v := range e.Attrs {
+				if k == "context" {
+					dockerCtx = v
+				}
+			}
+		}
+	}
+
+	docker := dockerutil.NewClient(dockerCli)
+	features := docker.Features(ctx, dockerCtx)
+	if features[dockerutil.OCIImporter] {
+		usingContainerdSnapshotter = true
+	}
+
+	return usingContainerdSnapshotter
+}
+
 func runBasicBuild(ctx context.Context, dockerCli command.Cli, opts *controllerapi.BuildOptions, printer *progress.Printer) (*client.SolveResponse, *build.Inputs, error) {
 	resp, res, dfmap, err := cbuild.RunBuild(ctx, dockerCli, opts, dockerCli.In(), printer, false)
 	if res != nil {

tests/build.go

@@ -399,18 +399,25 @@ func testImageIDOutput(t *testing.T, sb integration.Sandbox) {
 
 	require.Equal(t, dgst.String(), strings.TrimSpace(stdout.String()))
 
+	// read the md.json file
 	dt, err = os.ReadFile(filepath.Join(targetDir, "md.json"))
 	require.NoError(t, err)
 
 	type mdT struct {
+		Digest       string `json:"containerimage.digest"`
 		ConfigDigest string `json:"containerimage.config.digest"`
 	}
+
 	var md mdT
 	err = json.Unmarshal(dt, &md)
 	require.NoError(t, err)
 
 	require.NotEmpty(t, md.ConfigDigest)
-	require.Equal(t, dgst, digest.Digest(md.ConfigDigest))
+	require.NotEmpty(t, md.Digest)
+
+	// verify the image ID output is correct
+	// XXX: improve this by checking that it's one of the two expected digests depending on the scenario.
+	require.Contains(t, []digest.Digest{digest.Digest(md.ConfigDigest), digest.Digest(md.Digest)}, dgst)
 }
 
 func testBuildMobyFromLocalImage(t *testing.T, sb integration.Sandbox) {