When os.Stat returns an error different from ErrNotExist,
mkdirAllWithPermissions may panic with a nil pointer
derefence due to insufficient error checking.
Avoid the panic by bailing out, returning the error to the
caller.
* git: accept explicit commit hash for git context
When checking out code from non-github repositories, the typical
assumptions may not be valid, e.g. that the only interesting
non-branch commits have ref names starting with refs/pull. A specific
example is fetching an un-merged commit from a gerrit repository by
commit hash.
This change just looks at the second part of the git context path and
checks if it's a SHA commit hash, and if so, will fetch and check out
this commit after cloning the repository.
Sample context argument:
https://github.repo/project#e1772f228e06d15facdf175e5385e265b57068c0
* ci: fix test script to recognize any non-zero exit as an error
hack/linter.sh didn't properly install golangci-lint in hack/bin as I
already have another version of golangci-lint on my PATH, but then it
failed to execute because it was looking for it specifically in
hack/bin.
When the executable is not found, the exit code is 127 instead of 1,
and so test.sh ignored the error.
Two fixes:
1. `test.sh`:
- Use `if (script) ...` instead of assigning / checking a result
variable to determine if each validation script passed or failed.
2. `hack/linter.sh`:
- Instead of checking for golangci-lint on the path, just
specifically check for an executable file (`test -x`) in the
expected location.
Co-authored-by: Wade Carpenter <wwade@users.noreply.github.com>
* Remove tarball.WithCompressedCaching flag to resolve OOM Killed error
Large images cannot be build as the kaniko container will be killed due to an OOM error. Removing the tarball compression drastically reduces the memory required to push large image layers. Fixes#1680
This change may increase the build time for smaller images. Therefore a command line option to trigger the compression or a more intelligent behaviour may be useful.
* Add new command line flag to toggle compressed caching
* Add unittest for build with --compressed-caching command line flag set to false
* chore: add workflows for pr tests
* fix unit tests
* fix formatting
* chore: fix gobuild
* change minikube script
* chore: fix lint install script
* chore: ignore and fix tests
* fix lint and run gofmt
* lint fixes
* k8s executor image only
* fix Makefile
* fix travis env variables
* more info on k8s tests
* fix travis run
* fix
* fix
* fix
* fix log
* some more changes
* increase timeout
* delete travis.yml and fix multiple copy tests
* fix registry mirror
* fix lint
* add concurency
* last attemot to fix k8 integrations
* diff id for diff workflows
* Fix composite cache key for multi-stage copy command (#1706)
PR #1518 reintroduced COPY layers caching using the `--cache-copy-layers`
flag. Unfortunately, this PR also introduced a bug by not including the
stage digest into the caching key of the COPY command when the
`--cache-copy-layers` flag was not set. As a result, kaniko would use
any previous (possibly stalled) layer from the cache because the digest
of the "COPY --from" command would never change.
PR author probably expected Go to fallthrough in the switch just like C
does. However, this is not the case. Go does not fallthrough in
switch-statements by default and requires the fallthrough keyword to be
used. Note that this keyword is not available in type-switches though,
because it wouldn't work properly with typings.
* refactor: add an abstract copy command interface to avoid code duplication
* fix typo in error message
Co-authored-by: Tejal Desai <tejal29@gmail.com>
When providing multiple images to warm, the warmer stops at the first error.
There are use cases however where an image is provided to the warmer which does not yet exist on purpose (e.g. CI/CD latest image only created at first release).
Thus we want to try all given images and only error if none of them work.
* avoid deleting whiteouts if they are in ignore list
* fix snapshotter ignore list
* include filesystem mounts in ignorelist of snapshotter
* clean up ignore list logic
* add unit and integration tests for #1652
* fix tests and ignore list updates
which means we can now:
- set up one or more mirrors
- set up registries certificates
- skip TLS verify
- use plain HTTP
using the same set of flags that are defined for the executor
The upstream of github.com/genuinetools/amicontained switched to the
container runtime detection via github.com/genuinetools/bpfd/proc,
which supports a larger range of container runtimes. With this change
(among others) Podman can be detected correctly.
Fixes#1501.
Fixes#1473
The initial implementation of the registry mirror only allowed a single mirror, and if pulling from the mirror failed, the build would fail.
This change introduces:
- multiple registry mirrors instead of a single one
- fallback if an image can't be pulled from a registry
This is the same behavior as the docker daemon and will allow using a registry mirror such as `mirror.gcr.io` which is incomplete and doesn't have all the content that the default registry on docker.io has.
Note that there are no changes in the CLI flags, the `--registry-mirror` flag is still valid. But now it can be used multiple times to set up more than one registry mirror.
Co-authored-by: Tejal Desai <tejaldesai@google.com>
* Extend .dockerignore integration test with copies in later stages
.dockerignore should continue to apply when copying from the build context in later stages, but it currently doesn't
* Replace excluded global with passed along FileContext struct
This new FileContext struct allows much cleaner handling of context specific file exclusions.
The global excluded file state is no longer needed.
Additionally this also fixes the issue where excluded files aren't being applied for build context copies in later build stages.
Cached COPY layers are expensive in that they both need to be retrieved
over the network and occupy space in the layer cache.
They are unnecessary in that we already have all resources needed to
execute the COPY locally, and doing so is a trivial file-system
operation. This is in contrast to RUN layers, which can do
arbitrary and unbounded work.
The end result is that cached COPY commands were more expensive when
cached, not less. Remove them.
Resolves#1357
* Allow DOCKER_CONFIG to be a filename
* UnitTest: DockerConfLocation must return a file if it is existent and passed using env, or default if the file is incorrect
This allows those using Kaniko as a library to add ignored dirs and
files without needs to modify /proc/self/mountinfo or doing other
strange things with mount -t tmpfs
Cache warming fetched images without specifying platform, which resulted
in always pulling default linux/amd64. Even when kaniko was built and
run on arm64.
This change brings warmer's behaviour in line with executor's by
specifying runtime.GOOS/GOARCH.
Fixes#1372
This allows the value to be determined on the fly, which supports consumers that use Kaniko snaphot as a library and may need to change the value of config.KanikoDir
When deleting files of previous layers, the whiteout files
were not added to the tar file in a consistent order.
This change adds a stable sorting to the whiteout files and
adds unit tests to check for stable sorting.
Kaniko currently does config file setup for GCR such that pushing to GCR
automagically works. This change does the same for pkg.dev:
https://cloud.google.com/artifact-registry
This also tightens up the hostname check to ensure we don't send
credentials to a registry that happens to contain "gcr.io".
Currently the only way to set the git auth is by including it in the context
git URL. This can be problematic for certain environments such as ECS where the
command args for are stored in logs. Introduces updates to allow setting the
authentication info using the environment variables `GIT_USERNAME` and
`GIT_PASSWORD`.
This uses the default provided retry transport by
go-containerregistry as this originally had no retries
built in.
This is useful to avoid intermittent failures of image
registries when returning a retryable status code.
Add tests. The tests assume a POSIX file system, but it seems many
other tests assume Linux, so perhaps this is not a problem, or at
least does not add a new problem.
Fixes#1235
If the DOCKER_CONFIG environment variable is set, use it when
determining if the Docker config file exists. Fall back to kaniko
default if it the DOCKER_CONFIG environment variable is not set.
Fixes#1228
Currently the default WorkingDir in test is "/", while in reallife it's
empty.
This change the tests to reflect reel life and fix the case where
First WorkingDir is relative.
Andrei Kvapil
Lars Seipel
ygelfand
Travis DePrato
François JACQUES
Tejal Desai
wwade
Janosch Maier
Gilbert Gilb's
Rhianna
Jason Hall
nihilo
Silvano Cirujano Cuesta
Jose Donizetti
Patrick Barker
Max Walther
Kamal Nasser
Colin
Vivek Kumar
Jon Friesen
Lars Gröber
Sascha Schwarze
Theofilos Papapanagiotou
Or Geva
Josh Chorlton
Matt Moore
Vincent Behar
Fabrice
Severin Strobl
Lars
Sladyn
mickkael
Shashank
ejose19
Tinjo Schöni
Ian Kerins
Akram Ben Aissi
Tejal Desai
Joe Kutner
tsufeki
Carlos Alexandro Becker
Christopher Hlubek
aca
Jon Johnson
Yoan Blanc
Ben Einaudi
Yoriyasu Yano
Lukasz Jakimczuk
Mitchell Friedman
Gábor Lipták
David Dooling
Jordan Goasdoue
Mehdi Abaakouk