Reproducible builds broken in 1.8.0 #2005
Description
Actual behavior
Consider the Go program main.go and its corresponding Dockerfile (both listed below). Using kaniko in version 1.7.0, two subsequent reproducible builds using the command listed below result – as expected – in two identical Docker images. In version 1.8.0, however, two subsequent builds are no longer identical.
Expected behavior
I expect two subsequent reproducible builds to result in identical images.
To Reproduce
Steps to reproduce the behavior:
- Build an image by running:
$ docker run -v $(pwd):/src --network=host gcr.io/kaniko-project/executor:v1.8.0 --reproducible --dockerfile /src/Dockerfile --no-push --tarPath /src/image-file-main-00.tar --destination main:00 --cache=false --context dir:///src/
- Build a second image by running:
$ docker run -v $(pwd):/src --network=host gcr.io/kaniko-project/executor:v1.8.0 --reproducible --dockerfile /src/Dockerfile --no-push --tarPath /src/image-file-main-01.tar --destination main:01 --cache=false --context dir:///src/
- Import both images by running:
$ cat image-file-main-00.tar | docker load
$ cat image-file-main-01.tar | docker load
- Compare the image IDs:
$ docker image ls main
REPOSITORY TAG IMAGE ID CREATED SIZE
main 00 e65d80240143 N/A 1.75MB
main 01 77fc4150ed91 N/A 1.75MB
The Go program is identical in both builds but the surrounding tar archive isn't. I compared the hexdump of the tar archive of both builds and noticed that there are atime and ctime fields that contain a Unix timestamp, which is the reason why the builds differ. Could this regression have been caused by ee95be1?
Additional Information
- Dockerfile
FROM golang:1.18 as builder
WORKDIR /src
COPY main.go ./
RUN CGO_ENABLED=0 GO111MODULE=off go build -trimpath -o main
FROM scratch as artifact
COPY --from=builder /src/main /bin/
CMD [ "/" ]
- Build Context
package main
import "fmt"
func main() {
fmt.Println("Hello!")
}
Triage Notes for the Maintainers
| Description | Yes/No |
|---|---|
| Please check if this a new feature you are proposing | |
| Please check if the build works in docker but not in kaniko | |
Please check if this error is seen when you use --cache flag |
|
| Please check if your dockerfile is a multistage dockerfile |