Fact finding: Registry & client support for Image Manifest type artifacts #1025
Description
To hopefully help with #999 and #1015 I've tested various flavors of Image Manifest with various registries and client software. Please to chip in if you can try other registries & clients. And definitely let me know if the working group has documented something similar.
NB: The ✅ and ❌ do not indicate conformance, only of what we could do now would work in existing implementations.
Registries
Test manifest PUT and GET
| Registry | Arbitrary Config mediaType | No Config | Empty Layers | No Layers | No Subject | Zero Layer | Scratch Layer |
|---|---|---|---|---|---|---|---|
| distribution | ✅ | ❌ PUT: "blob unknown to registry" | ✅ | ✅ | ✅ | ✅ | ✅ |
| ICR | ✅ | ❌ PUT: "blob unknown to registry" | ✅ | ✅ | ✅ | ❌ 500 error uploading zero blob | ✅ |
| Docker Hub | ✅* | ❌ PUT: "manifest config: mediaType and digest can not be empty" | ✅* | ✅* | ✅ | ✅* | ✅* |
| Quay.io | ✅ | ❌† PUT: "manifest invalid" | ✅ | ❌ PUT: "manifest invalid" | ✅ | ❌ 500 error uploading zero blob | ✅ |
| GCR | ✅ | ❌ PUT: "Manifest is missing required field "config"." | ❌ "Manifest is missing required field "layers"." | ❌ "Manifest is missing required field "layers"." | ✅ | ✅ | ✅ |
| AR | ✅ | ❌ PUT: "failed to read config blob" | ✅ | ✅ | ✅ | ✅ | ✅ |
| Azure | ✅ | ❌ PUT: "manifest invalid" | ✅ | ✅ | ✅ | ✅ | ✅ |
| ECR | ✅ | ❌ "Invalid parameter at 'ImageManifest' failed to satisfy constraint: 'Invalid JSON syntax'" | ❌ "unsupported: Invalid parameter at 'ImageManifest' failed to satisfy constraint: 'Image has to have at least 1 layer'" | ❌ "unsupported: Invalid parameter at 'ImageManifest' failed to satisfy constraint: 'Image has to have at least 1 layer'" | ✅ | ✅ | ✅ |
| Artifactory | ✅ | ❌ PUT: "manifest invalid" | ✅ | ❌ PUT: "manifest invalid" | ✅ | ✅ | ✅ |
| Harbor | ✅ | ❌ PUT: "blob unknown to registry" | ✅ | ✅ | ✅ | ❌ PUT: "blob unknown to registry" | ✅ |
* Docker Hub responds with "not found" to any OCI Image Manifest with a subject, even if the subject exists in the same repository. Subjects have been temporarily disabled.
Clients
Test pull and push
| Client | Arbitrary Config mediaType | No Config | Empty Layers | No Layers | No Subject | Zero Layer | Scratch Layer |
|---|---|---|---|---|---|---|---|
| Docker 20.10.21 | ❌* pull: "invalid rootfs in image configuration" | - | ✅† | ✅† | ✅† | ✅† | ✅† |
| Skopeo 1.10.0 (github.com/containers/image) | ✅ | - | ✅ | ✅ | ✅ | ✅ | ✅ |
* Runtimes unpacking artifacts are almost certain to fail.
† If performed with a compatible config blob.
Manifests
The subject in these images is: dev.icr.io/oci-artifacts/test:image
Arbitrary Config mediaType
dev.icr.io/oci-artifacts/test:artifact
{
"schemaVersion": 2,
"mediaType": "application/vnd.oci.image.manifest.v1+json",
"config": {
"mediaType": "image/gif",
"digest": "sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
"size": 2
},
"subject": {
"mediaType": "application/vnd.oci.image.manifest.v1+json",
"digest": "sha256:71dbae9d7e6445fb5e0b11328e941b8e8937fdd52465079f536ce44bb78796ed",
"size": 406
},
"layers": [
{
"mediaType": "image/gif",
"digest": "sha256:725c49c527a83669901d00392768df9f653b1964a056c54232bc4c93003ddb48",
"size": 3540101
}
]
}No config
I can't upload this anywhere, but it references the same blobs as the one above.
{
"schemaVersion": 2,
"mediaType": "application/vnd.oci.image.manifest.v1+json",
"subject": {
"mediaType": "application/vnd.oci.image.manifest.v1+json",
"digest": "sha256:71dbae9d7e6445fb5e0b11328e941b8e8937fdd52465079f536ce44bb78796ed",
"size": 406
},
"layers": [
{
"mediaType": "image/gif",
"digest": "sha256:725c49c527a83669901d00392768df9f653b1964a056c54232bc4c93003ddb48",
"size": 3540101
}
]
}Empty Layers
dev.icr.io/oci-artifacts/test:artifact-empty-layers
{
"schemaVersion": 2,
"mediaType": "application/vnd.oci.image.manifest.v1+json",
"config": {
"mediaType": "image/gif",
"digest": "sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
"size": 2
},
"subject": {
"mediaType": "application/vnd.oci.image.manifest.v1+json",
"digest": "sha256:71dbae9d7e6445fb5e0b11328e941b8e8937fdd52465079f536ce44bb78796ed",
"size": 406
},
"layers": [],
"annotations": {
"com.example.key1": "value1"
}
}No Layers
dev.icr.io/oci-artifacts/test:artifact-no-layers
{
"schemaVersion": 2,
"mediaType": "application/vnd.oci.image.manifest.v1+json",
"config": {
"mediaType": "image/gif",
"digest": "sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
"size": 2
},
"subject": {
"mediaType": "application/vnd.oci.image.manifest.v1+json",
"digest": "sha256:71dbae9d7e6445fb5e0b11328e941b8e8937fdd52465079f536ce44bb78796ed",
"size": 406
},
"annotations": {
"com.example.key1": "value1"
}
}No Subject
dev.icr.io/oci-artifacts/test:artifact-no-subject
{
"schemaVersion": 2,
"mediaType": "application/vnd.oci.image.manifest.v1+json",
"config": {
"mediaType": "image/gif",
"digest": "sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
"size": 2
},
"layers": [
{
"mediaType": "image/gif",
"digest": "sha256:725c49c527a83669901d00392768df9f653b1964a056c54232bc4c93003ddb48",
"size": 3540101
}
]
}Zero Layer
alandaws/oci-artifacts:artifact-0-layer (Subject is missing because Docker Hub).
{
"schemaVersion": 2,
"mediaType": "application/vnd.oci.image.manifest.v1+json",
"config": {
"mediaType": "image/gif",
"digest": "sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
"size": 2
},
"subject": {
"mediaType": "application/vnd.oci.image.manifest.v1+json",
"digest": "sha256:71dbae9d7e6445fb5e0b11328e941b8e8937fdd52465079f536ce44bb78796ed",
"size": 406
},
"layers": [
{
"mediaType": "application/octet-stream",
"digest": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"size": 0
}
]
}Scratch Layer
dev.icr.io/oci-artifacts/test:artifact-scratch-layer
{
"schemaVersion": 2,
"mediaType": "application/vnd.oci.image.manifest.v1+json",
"config": {
"mediaType": "text/comment",
"digest": "sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
"size": 2
},
"subject": {
"mediaType": "application/vnd.oci.image.manifest.v1+json",
"digest": "sha256:71dbae9d7e6445fb5e0b11328e941b8e8937fdd52465079f536ce44bb78796ed",
"size": 406
},
"layers": [
{
"mediaType": "application/octet-stream",
"digest": "sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
"size": 2
}
],
"annotations": {
"com.example.comment": "Hello world"
}
}