Bug 1498178

Summary: Builds using Docker strategy attempt to pull down all tags of a base image when tag is not specified
Product: OpenShift Container Platform Reporter: Patrick Easters <peasters>
Component: BuildAssignee: Ben Parees <bparees>
Status: CLOSED ERRATA QA Contact: Wenjing Zheng <wzheng>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 3.6.0CC: aos-bugs
Target Milestone: ---   
Target Release: 3.7.0   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Cause: When no tag is explicitly set, docker behavior is to pull all images. Consequence: Builds would pull more images than necessary and take longer than needed. Fix: A default tag will be set when the user does not supply a tag. Result: Only a single image will be pulled for the build.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2017-11-28 22:14:33 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Patrick Easters 2017-10-03 16:04:08 UTC 
Description of problem:
When running a build using the Docker strategy, if the Dockerfile does not explicity specify a tag of the base image, the build pod will attempt to do a `docker pull` of *every* tag that exists for that image instead of just assuming the "latest" tag.

Version-Release number of selected component (if applicable):
I've reproduced this on 3.4, 3.5, and 3.6. OpenShift Origin seems to not exhibit this behavior.

How reproducible:
Reproducible every time

Steps to Reproduce:
1. Create a build config using a Dockerfile WITH a tag specified: oc create -f https://raw.githubusercontent.com/patrickeasters/openshift-build-test/master/build.yml

2. Trigger the build: oc start-build build-with-tag

3. Create a BC using a Dockerfile WITHOUT a tag specified: https://raw.githubusercontent.com/patrickeasters/openshift-build-test/master/build_no_tag.yml

4. Trigger the build: oc start-build build-no-tag


Actual results:
The build with no tag pulls all existing tags

Pulling image fedora ...
Trying to pull repository registry.access.redhat.com/fedora ... 
Trying to pull repository registry.access.redhat.com/fedora ... 
Trying to pull repository docker.io/library/fedora ... 
sha256:5d5a02b873d298da9bca4b84440c5cd698b0832560c850d92cf389cef58bc549: Pulling from docker.io/library/fedora
4abd98c7489c: Pulling fs layer
4abd98c7489c: Verifying Checksum
4abd98c7489c: Download complete
4abd98c7489c: Pull complete
Digest: sha256:5d5a02b873d298da9bca4b84440c5cd698b0832560c850d92cf389cef58bc549
sha256:a268e5e12257c7770eb44c24041baf5e728fba2eed1a84f007b81845ded0a485: Pulling from docker.io/library/fedora
fced6e4a4c06: Pulling fs layer
fced6e4a4c06: Download complete
fced6e4a4c06: Pull complete
Digest: sha256:a268e5e12257c7770eb44c24041baf5e728fba2eed1a84f007b81845ded0a485
sha256:d5cce9139f8758171936a033c0625307760026446d4d30f084ff6b52aecc1721: Pulling from docker.io/library/fedora
2fdf5ac7b687: Pulling fs layer
2fdf5ac7b687: Verifying Checksum
2fdf5ac7b687: Download complete
2fdf5ac7b687: Pull complete
Digest: sha256:d5cce9139f8758171936a033c0625307760026446d4d30f084ff6b52aecc1721
sha256:24994d55192ca83f7837c5e4c24323b0f78445af37c2abca0019b8fc7ec4852f: Pulling from docker.io/library/fedora
14707640923f: Pulling fs layer
14707640923f: Verifying Checksum
14707640923f: Download complete
14707640923f: Pull complete
Digest: sha256:24994d55192ca83f7837c5e4c24323b0f78445af37c2abca0019b8fc7ec4852f
sha256:0c1580c63e623ecfa0ef2d4a548d73a655e8072725bcca01bc6f2e446914a7bc: Pulling from docker.io/library/fedora
d489011951f5: Pulling fs layer
d489011951f5: Verifying Checksum
d489011951f5: Download complete
d489011951f5: Pull complete
Digest: sha256:0c1580c63e623ecfa0ef2d4a548d73a655e8072725bcca01bc6f2e446914a7bc
sha256:a8766a880e615046822b455b2a5331be5f2a2359b57d38a41b114b7dc2483bb0: Pulling from docker.io/library/fedora
8ab017634520: Pulling fs layer
8ab017634520: Verifying Checksum
8ab017634520: Download complete
8ab017634520: Pull complete
Digest: sha256:a8766a880e615046822b455b2a5331be5f2a2359b57d38a41b114b7dc2483bb0
sha256:f8d11253fad3d618071792bf4c4d6f9a8610217317c3fc990d300d18920e00c3: Pulling from docker.io/library/fedora
3cf8787d5447: Pulling fs layer
3cf8787d5447: Verifying Checksum
3cf8787d5447: Pull complete
Digest: sha256:f8d11253fad3d618071792bf4c4d6f9a8610217317c3fc990d300d18920e00c3
sha256:613830d906f8897c05fd737aea8c7c00e4ecb5a518eedf71958c2c110532957c: Pulling from docker.io/library/fedora
00ddb097f3f5: Pulling fs layer
00ddb097f3f5: Verifying Checksum
00ddb097f3f5: Download complete
00ddb097f3f5: Pull complete
Digest: sha256:613830d906f8897c05fd737aea8c7c00e4ecb5a518eedf71958c2c110532957c
sha256:5d5a02b873d298da9bca4b84440c5cd698b0832560c850d92cf389cef58bc549: Pulling from docker.io/library/fedora
Digest: sha256:5d5a02b873d298da9bca4b84440c5cd698b0832560c850d92cf389cef58bc549
sha256:613830d906f8897c05fd737aea8c7c00e4ecb5a518eedf71958c2c110532957c: Pulling from docker.io/library/fedora
Digest: sha256:613830d906f8897c05fd737aea8c7c00e4ecb5a518eedf71958c2c110532957c
sha256:d67170a44d8cc93d137b7652a9f3f3e1662c6d10ef7dc6ca4028f7ed815153d2: Pulling from docker.io/library/fedora
91f69af70dd7: Pulling fs layer
91f69af70dd7: Verifying Checksum
91f69af70dd7: Download complete
91f69af70dd7: Pull complete
Digest: sha256:d67170a44d8cc93d137b7652a9f3f3e1662c6d10ef7dc6ca4028f7ed815153d2
Status: Downloaded newer image for docker.io/fedora:rawhide


Expected results:
The docker build should only pull the tag "latest"

Pulling image fedora:latest ...
Trying to pull repository registry.access.redhat.com/fedora ... 
Trying to pull repository registry.access.redhat.com/fedora ... 
Trying to pull repository docker.io/library/fedora ... 
sha256:613830d906f8897c05fd737aea8c7c00e4ecb5a518eedf71958c2c110532957c: Pulling from docker.io/library/fedora
00ddb097f3f5: Pulling fs layer
00ddb097f3f5: Verifying Checksum
00ddb097f3f5: Download complete
00ddb097f3f5: Pull complete
Digest: sha256:613830d906f8897c05fd737aea8c7c00e4ecb5a518eedf71958c2c110532957c
Status: Downloaded newer image for docker.io/fedora:latest



Additional info:
The official Docker docs specify that when a tag or digest is not specified in the FROM field of a Dockerfile, that the tag "latest" is assumed: https://docs.docker.com/engine/reference/builder/#from

"The tag or digest values are optional. If you omit either of them, the builder assumes a latest tag by default. The builder returns an error if it cannot find the tag value."

There should be no need to pull the image associated with each tag. For images with a long tag history, this can exponentially increase build time.
Comment 1 Ben Parees 2017-10-03 16:14:09 UTC 
yes this was fixed by https://github.com/openshift/origin/pull/15967 which is why you don't see it in origin.
Comment 3 Wenjing Zheng 2017-10-09 09:55:33 UTC 
Verified with below version:
openshift v3.7.0-0.143.1
kubernetes v1.7.0+80709908fd
etcd 3.2.1
Comment 6 errata-xmlrpc 2017-11-28 22:14:33 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2017:3188