distroless: fallback to marinara:3.0 when date-matched tag missing#18099
Open
jslobodzian wants to merge 1 commit into
Open
distroless: fallback to marinara:3.0 when date-matched tag missing#18099jslobodzian wants to merge 1 commit into
jslobodzian wants to merge 1 commit into
Conversation
Marinara is published to MCR by Stage 6 alongside base/core, but as an independent push. The current substitution in BuildGoldenDistrolessContainer.sh forces marinara to use the exact same tag as base/core with no way to recover if marinara publishing hiccups on a given date. Add a docker manifest inspect probe. If the date-matched marinara tag is missing, fall back to mcr.microsoft.com/azurelinux/marinara:3.0 (floating). Marinara is used only as a builder image whose contents don't ship in the final distroless image, so any recent 3.0 marinara is functionally equivalent. References Task 22512. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6acbc596-5dee-4743-8060-834350b93111
microsoft-github-policy-service
Bot
added
the
3.0-dev
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Marinara is published to MCR by Stage 6 (
BuildBaseContainers.sh) alongsidebase/core, but as an independent push. The current substitution inBuildGoldenDistrolessContainer.shforces marinara to use the exact same tag as base/core with no way to recover if marinara publishing hiccups on a given date:MARINARA_IMAGE=${BASE_IMAGE_NAME_FULL/base\/core/$marinara}If marinara's date-matched tag is ever missing from MCR while base/core succeeds, every subsequent Stage 7 distroless golden build breaks with
manifest not founduntil Stage 6 is re-run. This is the same class of failure that motivated thebaseImageOverrideparameter in ADO PR #28408.Change
Add a
docker manifest inspectprobe after the substitution. If the date-matched marinara tag is missing, fall back tomcr.microsoft.com/azurelinux/marinara:3.0(floating) and log a warning.Rationale
Marinara is used only as a builder image (
FROM marinara AS builder) — its contents don't ship in the finalFROM scratchdistroless image. Any recent 3.0 marinara is functionally equivalent for staging RPMs into/staging. The:3.0floating tag is empirically published on MCR today.Refs
baseImageOverride=latestin CBL-Mariner-Pipelines to work around the parallel 20260712 base/core MCR-publish miss)Testing
DEV Stage 4 (defs 2733/2734) and PROD Stage 7 (defs 2902/2905) test runs are in flight against the
baseImageOverridePR. Once those complete cleanly, this PR can be validated by intentionally targeting a date where marinara doesn't exist (or by manual verification thatdocker manifest inspecton the current happy-path tag returns success in the pipeline environment).