使用Registry v2 API推送镜像清单失败问题排查

更新 #

已在评论区得到解答：manifest.json中遗漏了摘要的sha256前缀！

问题描述 #

我用Shell脚本测试Registry v2 API时，始终无法完成镜像推送。

按API文档推送了镜像层（tar.gz文件和config.json），两次上传都返回201状态码：

< HTTP/1.1 201 Created
< content-length: 0
< docker-content-digest: sha256:e251e682f7e64cff127020015be3254313b3a7900f54d82ecf34653192be4c21
< docker-distribution-api-version: registry/2.0
< location: https://registry.hub.docker.com/v2/ravikanth/cnc2/blobs/sha256:e251e682f7e64cff127020015be3254313b3a7900f54d82ecf34653192be4c21
< date: Mon, 28 Nov 2022 13:43:31 GMT
< strict-transport-security: max-age=31536000

< HTTP/1.1 201 Created
< content-length: 0
< docker-content-digest: sha256:4500bf72b8876e180985cb9d30dcbfb4b37c6212af4a1e66f6a59e9c44e4430e
< docker-distribution-api-version: registry/2.0
< location: https://registry.hub.docker.com/v2/ravikanth/cnc2/blobs/sha256:4500bf72b8876e180985cb9d30dcbfb4b37c6212af4a1e66f6a59e9c44e4430e
< date: Mon, 28 Nov 2022 14:03:00 GMT
< strict-transport-security: max-age=31536000

我已经验证这些镜像层确实存在：

date: Mon, 28 Nov 2022 14:03:50 GMT
content-type: application/octet-stream
content-length: 277
cf-ray: 7713a639ae0326b9-BLR
accept-ranges: bytes
cache-control: public, max-age=14400
etag: "6ff6ee3576fbb38ded464213e5119f93"
expires: Mon, 28 Nov 2022 18:03:50 GMT
last-modified: Mon, 28 Nov 2022 09:38:20 GMT
vary: Accept-Encoding
cf-cache-status: MISS
x-amz-id-2: BKOqrxyDQlWoyu/lv9AiyoCUMqImMVJROkFCpvHrtNdU1YDdjGJSQLoR+E+J7sYlyo9AwQd27Ao=
x-amz-request-id: D9F9EP13RA3VY9TJ
x-amz-version-id: y1TMXGkb8nPxCq1Ojxp7P0FbwmfurXTs
server: cloudflare

HTTP/2 200 
date: Mon, 28 Nov 2022 14:02:00 GMT
content-type: application/octet-stream
content-length: 1074934
cf-ray: 7713a3862b8f1d89-BLR
accept-ranges: bytes
cache-control: public, max-age=14400
etag: "bb6070a00aab579e87f54126c0147bf6"
expires: Mon, 28 Nov 2022 18:02:00 GMT
last-modified: Mon, 28 Nov 2022 08:57:53 GMT
vary: Accept-Encoding
cf-cache-status: MISS
x-amz-id-2: ZIwf+5xaaHuHdQhCtErlXXXxfKZA3GPFSP2CTm1TbYS8caRh53bjxJ2yj/jGRTUPXQ0fHdTXIDs=
x-amz-request-id: FZH3XXP4VP2C354S
x-amz-version-id: 0ZKPRYiiGUKn5dc_rISx4jHKcKTH3rfR
server: cloudflare

但推送清单时，得到以下错误响应：

{"errors":[{"code":"DIGEST_INVALID","message":"provided digest did not match uploaded content"},{"code":"MANIFEST_BLOB_UNKNOWN","message":"blob unknown to registry","detail":"4500bf72b8876e180985cb9d30dcbfb4b37c6212af4a1e66f6a59e9c44e4430e"},{"code":"DIGEST_INVALID","message":"provided digest did not match uploaded content"},{"code":"MANIFEST_BLOB_UNKNOWN","message":"blob unknown to registry","detail":"e251e682f7e64cff127020015be3254313b3a7900f54d82ecf34653192be4c21"}]}

相关代码 #

生成摘要/差异值的Shell命令：

LAYERDIGEST=$(sha256sum < hello-cloud.tar.gz | cut -d' ' -f1)
LAYERDIFF=$(gunzip < hello-cloud.tar.gz | sha256sum | cut -d' ' -f1)
LAYERSIZE=$(ls -l hello-cloud.tar.gz | awk '{print $5}')
CONFIGDIGEST=$(sha256sum < configuration.json | cut -d' ' -f1)
CONFIGSIZE=$(ls -l configuration.json | awk '{print $5}')

manifest.json内容：

{
  "schemaVersion": 2,
  "mediaType": "application/vnd.oci.image.manifest.v1+json",
  "config": {
    "mediaType": "application/vnd.oci.image.config.v1+json",
    "size": 277,
    "digest": "4500bf72b8876e180985cb9d30dcbfb4b37c6212af4a1e66f6a59e9c44e4430e"
  },
  "layers": [
    {
      "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
      "size": 1074934,
      "digest": "e251e682f7e64cff127020015be3254313b3a7900f54d82ecf34653192be4c21"
    }
  ]
}

configuration.json内容：

{
  "architecture": "amd64",
  "os": "linux",
  "config": {
  },
  "rootfs": {
    "type": "layers",
    "diff_ids": [
      "sha256:690fa2812df903a4cee676e28389e154fe022f2a26fb29c4c97e9c6583fa5bc6"
    ]
  },
  "history": [
    {
      "created_by": "Ravikanth C"
    }
  ]
}

解决方法 #

问题出在manifest.json的digest字段中，缺少了sha256:前缀。Registry v2 API要求摘要必须包含算法前缀，修改后的manifest.json应如下：

{
  "schemaVersion": 2,
  "mediaType": "application/vnd.oci.image.manifest.v1+json",
  "config": {
    "mediaType": "application/vnd.oci.image.config.v1+json",
    "size": 277,
    "digest": "sha256:4500bf72b8876e180985cb9d30dcbfb4b37c6212af4a1e66f6a59e9c44e4430e"
  },
  "layers": [
    {
      "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
      "size": 1074934,
      "digest": "sha256:e251e682f7e64cff127020015be3254313b3a7900f54d82ecf34653192be4c21"
    }
  ]
}

内容的提问来源于stack exchange，提问作者ravikanth