Description

When running docker image tag:

docker pull gke.gcr.io/pause@sha256:880e63f94b145e46f1b1082bb71b85e21f16b99b180b9996407d61240ceb9830
docker image tag gke.gcr.io/pause@sha256:880e63f94b145e46f1b1082bb71b85e21f16b99b180b9996407d61240ceb9830 gke.gcr.io/pause:foo+bar

Receiving: Error parsing reference: "gke.gcr.io/pause:foo+bar" is not a valid repository/tag: invalid reference format

However ctr allows this.

ctr -n=k8s.io image tag gke.gcr.io/pause@sha256:880e63f94b145e46f1b1082bb71b85e21f16b99b180b9996407d61240ceb9830 gke.gcr.io/pause:foo+bar

ctr -n=k8s.io image list | grep pause | awk '{print $1}'

outputs:

gke.gcr.io/pause:foo+bar
gke.gcr.io/pause@sha256:880e63f94b145e46f1b1082bb71b85e21f16b99b180b9996407d61240ceb9830

This result in incompatible tag that cannot be seen by CRI - the command crictl images list doesn't show it (RepoTags is empty in CRI response when using --debug).

• Symbols supported:

  containerd/reference/docker/regexp.go

  Line 33 in 8dcc06d

  separator = `(?:[._]|__|[-]*)`

• Used from:

  containerd/reference/docker/reference.go

  Line 225 in 8dcc06d

  nameMatch := anchoredNameRegexp.FindStringSubmatch(matches[1])

• here is where the tags are simply ommitted by CRI if they have bad chars:

  containerd/pkg/cri/server/helpers.go

  Line 323 in 8dcc06d

  continue

• no conversion or parsing happens in ctr:

  containerd/cmd/ctr/commands/images/images.go

  Line 85 in 8dcc06d

  imageList, err := imageStore.List(ctx, filters...)

Steps to reproduce the issue

1. Run ctr -n=k8s.io image tag gke.gcr.io/pause@sha256:880e63f94b145e46f1b1082bb71b85e21f16b99b180b9996407d61240ceb9830 gke.gcr.io/pause:foo+bar
2. The command succeeds when it sholdn't

Describe the results you received and expected

corresponding docker command will fail.

What version of containerd are you using?

containerd github.com/containerd/containerd 1.6.18 2456e98

Any other relevant information

Interesting question will be how to handle back compat with those "bad" tags on environment where they already created

Show configuration if it is related to CRI plugin.

No response