BuildKit expects secret management behavior not present in GCR [123043691]

Fixed

Bug

Status Update

No update yet.

Description

ya...@google.com

created issue #1

Jan 18, 2019 01:50AM

Please provide as much information as possible. At least, this should include a description of your issue and steps to reproduce the problem. If possible please provide a summary of what steps or workarounds you have already tried, and any docs or articles you found (un)helpful.

Problem you have encountered:

When using BuildKit with Docker 18.09 using base images FROM

gcr.io, BuildKit fails.
From the explanation from a Moby engineer [1], this seems to be an issue related to authentication handling on GCR that doesn't match what BuildKit is expecting.

What you expected to happen:

BuildKit to being asked for an authentication method instead of directly returning 403.

Steps to reproduce:

1. Create a Dockerfile
2. Use a FROM directive to pull an already existing image from a private repository in

gcr.io
3. Set the 'credshelper' to use GCR hostnames [2]
4. Run `DOCKER_BUILDKIT=1 docker build .`
5. After waiting long time and pressing CTRL-C and the error is printed

Command output:
failed to copy: httpReaderSeeker: failed open: unexpected status code

https://gcr.io/v2/...: 403 Forbidden

Note: "..." used for private information obfuscation.

Other information (workarounds you have tried, documentation consulted, etc):

[1]

https://github.com/moby/buildkit/issues/720#issuecomment-440092509
[2]

https://github.com/docker/docker-credential-helpers

Comments

g....@saltosystems.com <g....@saltosystems.com> #2Jan 21, 2019 02:04PM

We're using img[1] which uses buildkit under the hood and we're facing an issue that seems to fall into this one: "unexpected status: 403 Forbidden". This was working just fine on last Friday morning (GMT). Will appreciate any comments on this matter.

[1]

https://github.com/genuinetools/img

ha...@gmail.com <ha...@gmail.com> #3Feb 28, 2019 11:28PM

Hi Google team,
Can you please share any progress on this? (BuildKit +

gcr.io private repos)
You are considered one of industry leaders in container technologies, so how come it's been over half a year since BuildKit is out and we still can't use with

gcr.io?

Thank you,
Zaar

nb...@gmail.com <nb...@gmail.com> #4Mar 26, 2019 07:48AM

Hello,

Experiencing this as well. Appreciate the work being done to correct this.

Thanks,

N

ap...@google.com <ap...@google.com> #5Oct 24, 2019 04:18PM

Accepted by gc...@google.com.

🤖 This is an automatic update. The status of the related internal issue(s) listed in "Blocked By" has changed, so we've done the following:

* Updated the status to Accepted, because an engineer has begun work on the related issue.

You can read more about what these statuses mean at

https://developers.google.com/issue-tracker/concepts/issues#fields

di...@google.com <di...@google.com> #6Oct 29, 2019 03:27PM

Marked as fixed.

While checking the internal report, this issue seems to be fixed now. Therefore I am closing this issue report for now.

However,if the issue is still persisting, feel free to open a new issue report by mentioning the details of this old report.

Issue 123043691