kotovalexarian-likes-github/moby--moby
1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2022-11-09 12:21:53 -05:00
Code Releases Activity

Prune digest references when deleting by tag

Browse source 
When pulling an image with content trust enabled, two references are
created: a digest reference and a tag reference. Deleting by tag
wouldn't actually remove the image, because the digest reference keeps
it alive.

This change modifies the rmi logic so that digest references don't keep
an image alive. If the last tag referencing a given image is deleted,
any digest references to it will be removed as well, so the image can
actually get deleted. This fixes the usability problem with deletions
when content trust is in use, so something like "docker pull busybox;
docker rmi busybox" will work as expected.

Signed-off-by: Aaron Lehmann <aaron.lehmann@docker.com>
This commit is contained in:
Aaron Lehmann 2016-01-06 17:57:21 -08:00
parent 18fdbdb07b
commit 2f048f73e1
4 changed files with 113 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

53
integration-cli/docker_cli_pull_trusted_test.go
View file

@ -4,6 +4,7 @@ import (
"fmt"
"io/ioutil"
"os/exec"
"strings"
"time"
"github.com/docker/docker/pkg/integration/checker"
@ -200,3 +201,55 @@ func (s *DockerTrustSuite) TestTrustedOfflinePull(c *check.C) {
c.Assert(err, check.IsNil, check.Commentf(out))
c.Assert(string(out), checker.Contains, "Tagging", check.Commentf(out))
}
func (s *DockerTrustSuite) TestTrustedPullDelete(c *check.C) {
repoName := fmt.Sprintf("%v/dockercli/%s:latest", privateRegistryURL, "trusted-pull-delete")
// tag the image and upload it to the private registry
_, err := buildImage(repoName, `
FROM busybox
CMD echo trustedpulldelete
`, true)
pushCmd := exec.Command(dockerBinary, "push", repoName)
s.trustedCmd(pushCmd)
out, _, err := runCommandWithOutput(pushCmd)
if err != nil {
c.Fatalf("Error running trusted push: %s\n%s", err, out)
}
if !strings.Contains(string(out), "Signing and pushing trust metadata") {
c.Fatalf("Missing expected output on trusted push:\n%s", out)
}
if out, status := dockerCmd(c, "rmi", repoName); status != 0 {
c.Fatalf("Error removing image %q\n%s", repoName, out)
}
// Try pull
pullCmd := exec.Command(dockerBinary, "pull", repoName)
s.trustedCmd(pullCmd)
out, _, err = runCommandWithOutput(pullCmd)
c.Assert(err, check.IsNil, check.Commentf(out))
matches := digestRegex.FindStringSubmatch(out)
c.Assert(matches, checker.HasLen, 2, check.Commentf("unable to parse digest from pull output: %s", out))
pullDigest := matches[1]
imageID, err := inspectField(repoName, "Id")
c.Assert(err, checker.IsNil, check.Commentf("error inspecting image id"))
imageByDigest := repoName + "@" + pullDigest
byDigestID, err := inspectField(imageByDigest, "Id")
c.Assert(err, checker.IsNil, check.Commentf("error inspecting image id"))
c.Assert(byDigestID, checker.Equals, imageID)
// rmi of tag should also remove the digest reference
dockerCmd(c, "rmi", repoName)
_, err = inspectField(imageByDigest, "Id")
c.Assert(err, checker.NotNil, check.Commentf("digest reference should have been removed"))
_, err = inspectField(imageID, "Id")
c.Assert(err, checker.NotNil, check.Commentf("image should have been deleted"))
}