CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-06-15 06:38:40 +02:00
Code Issues Packages Projects Releases Wiki Activity

push images via buildx imagetools create

Browse Source 
Replaces `docker push` with a registry-to-registry copy. On Docker 29.x
with the containerd image store, `docker push` of a freshly-pulled image
hits a path that wraps single-platform manifests in a synthetic index
and then can't push the layers it claims to reference, producing
`NotFound: content digest ...` even when the image is fully present.

Keep the local `docker tag` so so-image-pull's `docker images | grep :5000`
existence check continues to work.
This commit is contained in:
Mike Reeves
2026-04-28 14:49:02 -04:00
parent c86399327b
commit 288a823edf
1 changed files with 12 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
salt/common/tools/sbin/so-image-common
+11 -2
View File
@@ -228,8 +228,17 @@ update_docker_containers() {
echo "Unable to tag $image" >> "$LOG_FILE" 2>&1 echo "Unable to tag $image" >> "$LOG_FILE" 2>&1
exit 1 exit 1
} }
docker push $HOSTNAME:5000/$IMAGEREPO/$image >> "$LOG_FILE" 2>&1 || { # Push to the embedded registry via a registry-to-registry copy. Avoids
echo "Unable to push $image" >> "$LOG_FILE" 2>&1 # `docker push`, which on Docker 29.x with the containerd image store
# represents freshly-pulled images as an index whose layer content
# isn't reachable through the push path. The local `docker tag` above
# is preserved so so-image-pull's `:5000` existence check still works.
local PUSH_SRC="$CONTAINER_REGISTRY/$IMAGEREPO/$image"
if [ -n "$PLATFORM_DIGEST" ] && [ "$PLATFORM_DIGEST" != "null" ]; then
PUSH_SRC="$CONTAINER_REGISTRY/$IMAGEREPO/$image@$PLATFORM_DIGEST"
fi
docker buildx imagetools create --tag $HOSTNAME:5000/$IMAGEREPO/$image "$PUSH_SRC" >> "$LOG_FILE" 2>&1 || {
echo "Unable to copy $image to embedded registry" >> "$LOG_FILE" 2>&1
exit 1 exit 1
} }
fi fi