Extensions are not being installed with deployment profiles and allowed images list

[IsaSih]

Actual Behavior

I am not sure if the deployment profiles and the allowed images list are somehow breaking lima, but none of the extensions regardless if they are allowed or not in the deployment profiles, are failing to download

Error says : limactl exited with code 1

Steps to Reproduce

1. Run a factory reset
2. Create system and user's deployment profiles (the files can be found in the session Additional Information)
3. Start Rancher Desktop

Result

All the extensions are failing to download

Important information from the logs:
extensions.log:

023-06-09T02:50:17.725Z: Failed to read metadata for docker/disk-usage-extension: Error: /Applications/Rancher Desktop.app/Contents/Resources/resources/darwin/lima/bin/limactl exited with code 1

2023-06-09T02:50:20.925Z: Failed to read metadata for ignatandrei/blockly-automation: Error: /Applications/Rancher Desktop.app/Contents/Resources/resources/darwin/lima/bin/limactl exited with code 1

2023-06-09T02:51:24.267Z: Failed to read metadata for docker/logs-explorer-extension: Error: /Applications/Rancher Desktop.app/Contents/Resources/resources/darwin/lima/bin/limactl exited with code 1

2023-06-09T02:53:09.118Z: Failed to read metadata for joycelin79/newman-extension: Error: /Applications/Rancher Desktop.app/Contents/Resources/resources/darwin/lima/bin/limactl exited with code 1

from lima.log:

2023-06-09T02:53:09.118Z: Lima: executing: /usr/local/bin/nerdctl --namespace rancher-desktop-extensions create --entrypoint=/ joycelin79/newman-extension:0.0.7: Error: /Applications/Rancher Desktop.app/Contents/Resources/resources/darwin/lima/bin/limactl exited with code 1

2023-06-09T02:53:09.118Z: stdout: 
2023-06-09T02:53:09.118Z: stderr: time="2023-06-08T19:53:09-07:00" level=debug msg="changeDirCmd=\"cd . || exit 1\""
time="2023-06-08T19:53:09-07:00" level=debug msg="OpenSSH version 8.6.1 detected"
time="2023-06-08T19:53:09-07:00" level=debug msg="AES accelerator seems available, prioritizing aes128-gcm@openssh.com and aes256-gcm@openssh.com"
time="2023-06-08T19:53:09-07:00" level=debug msg="executing ssh (may take a long)): [/usr/bin/ssh -F /dev/null -o IdentityFile=\"/Users/isasih/Library/Application Support/rancher-desktop/lima/_config/user\" -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o NoHostAuthenticationForLocalhost=yes -o GSSAPIAuthentication=no -o PreferredAuthentications=publickey -o Compression=no -o BatchMode=yes -o IdentitiesOnly=yes -o Ciphers=\"^aes128-gcm@openssh.com,aes256-gcm@openssh.com\" -o User=isasih -o ControlMaster=auto -o ControlPath=\"/Users/isasih/Library/Application Support/rancher-desktop/lima/0/ssh.sock\" -o ControlPersist=5m -q -p 56789 127.0.0.1 -- cd . || exit 1 ; exec \"$SHELL\" --login -c '/usr/local/bin/nerdctl --namespace rancher-desktop-extensions create --entrypoint=/ joycelin79/newman-extension:0.0.7']"
time="2023-06-09T02:53:07Z" level=fatal msg="failed to resolve reference \"docker.io/joycelin79/newman-extension:0.0.7\": unexpected status from HEAD request to https://registry-1.docker.io/v2/joycelin79/newman-extension/manifests/0.0.7: 403 Forbidden"

From serial.log:

 * Waiting for uevents to be processed ... [ ok ]
 * Starting networking ... *   lo ... [ ok ]
 *   eth0 ...udhcpc: started, v1.36.1
udhcpc: broadcasting discover
udhcpc: broadcasting select for 192.168.5.15, server 192.168.5.2
udhcpc: lease of 192.168.5.15 obtained from 192.168.5.2, lease time 86400
 [ ok ]
 * The binfmt-misc module needs to be loaded by the modules service or built in.
 * Mounting misc binary format filesystem ... [ ok ]
 * Registering QEMU binaries in binfmt misc ... [ ok ]
 [ ok ]
 * Caching service dependencies ... [ ok ]
ssh-keygen: generating new host keys: RSA ECDSA ED25519 
 * Starting sshd ... [ ok ]


Welcome to Alpine Linux 3.18

Kernel 6.1.32-0-virt on an x86_64 (/dev/ttyS0)



lima-rancher-desktop login: 

Archive.zip

lima-logs.zip

Expected Behavior

Extensions that belong to the allowed images list or the allowed extensions list should be installed with no errors. Extensions that are not in any of these list should be preventing from installing with a bad request error.

Additional Information

Here are the files containing each of the deployment profiles used

System locked profile - profile.txt
System default profile - sys-profile-default.txt
User locked profile - user-profile-locked.txt
User default profile -
user-profile-defaults.txt

Rancher Desktop Version

1.7.0-1669-g22e4b6c2

Rancher Desktop K8s Version

1.26.2

Which container engine are you using?

containerd (nerdctl)

What operating system are you using?

macOS

Operating System / Build Version

macOS Monterey

What CPU architecture are you using?

x64

Linux only: what package format did you use to install Rancher Desktop?

None

Windows User Only

No response

[xianjin-xu]

yes，i have the same problem, i guess the reason is that the timeout 230 seconds is the load balance of azure app, my network speed just at 500~600 kb/s, i retry many times, every there was more than 40m left can't be downloaded.

[IsaSih]

Issue happens with both dockerd and containerd. Both system and user deployment profiles

[mook-as]

failed to resolve reference "docker.io/joycelin79/newman-extension:0.0.7": … 403 Forbidden

That sounds like Docker Hub doesn't like us. If you're doing this remotely (using Remote Desktop or something to a machine in the lab), perhaps there's been too many requests from that IP address and you're being rate limited? That should be HTTP 429 instead, though…

[mook-as]

Oh, it's the image allow list; the system locked profile has:

  <key>containerEngine</key>
  <dict>
    <key>allowedImages</key>
    <dict>
      <key>enabled</key>
      <true/>
      <key>patterns</key>
      <array>
        <string>nginx</string>
        <string>busybox</string>
      </array>
    </dict>
  </dict>

That doesn't cover docker.io/joycelin79/newman-extension:0.0.7…

[IsaSih]

I'm using my own machine.

[IsaSih]

But if we have it allowed in the extensions list shouldn't this suffice? the image needs to be in both images and extensions list?