Force OCI format for inner images when publishing tarballs or to local docker instances #47398
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…cal docker instances
ghost
added
baronfel
added
Area-Containers
surayya-MS
approved these changes
Mar 19, 2025
baronfel
changed the title
surayya-MS
reviewed
Mar 19, 2025
src/Tests/Microsoft.NET.Build.Containers.IntegrationTests/EndToEndTests.cs
Outdated
Show resolved
Hide resolved
|
LGTM |
baronfel
force-pushed
the
enforce-oci-for-manifest-publishing
branch
from
1bcd676 to
1ec4897
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Today it's possible to publish a multi-arch container manifest that is an OCI format, but contains inner images that are Docker format. This is an error - all formats (Docker or OCI) should be unified. Some tools will accept this mismatch, but others will error and force compliance. The MDE team found this as it impacted their migrations to SDK containers.
Fix
This PR determines if we are in a scenario in the outer-build where we are publishing an OCI manifest wrapper and forces the inner images to be OCI also. There results in exactly one change to the generated inner images: the media type field changes. All other content remains the same.
Workaround
Users can set
<ContainerImageFormat>OCI</ContainerImageFormat>today to fix this.Risk
Low - this is covered by tests and only applies to a single specific erroring scenario.