[PR #128] [MERGED] fix(build): aux.ID is the real sha256 config digest, not the image ref #129

New issue

Closed

opened 2026-10-15 12:52:13 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 12:52:13 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/games-on-whales/LXC2Docker/pull/128
Author: @JBailes
Created: 7/1/2026
Status: ✅ Merged
Merged: 7/1/2026
Merged by: @JBailes

Base: main ← Head: fix/build-config-digest

📝 Commits (1)

7d3e98b fix(build): aux.ID is the real sha256 config digest, not the image ref

📊 Changes

1 file changed (+14 additions, -1 deletions)

View changed files

📝 internal/api/build.go (+14 -1)

📄 Description

Part 2 of the real-image-ID work (follows #126, which did commit + the shared infra).

POST /build's final aux emitted {"aux":{"ID":"<repo>:<tag>"}} — real Docker emits the image ID: {"aux":{"ID":"sha256:<config-digest>"}}.

Fix

After the build succeeds, compute the digest over the built rootfs via computeConfigDigest(rec) — the built record is already in the store, so openImageRootfs resolves the real built rootfs (accurate, and matches a later docker save of the same image). Store it on the record and return sha256:<digest> as aux.ID.

Done before applying extra -t tags, so their copied records inherit the digest.
Best-effort: falls back to the ref on a tar/hash error, so builds never fail on this.
Reuses #126's imageDisplayID/findImageByID, so inspect/list/df/history of a built image show the real digest and docker inspect <digest> resolves.

Note

The computeConfigDigest for a build re-tars the rootfs (an extra pass on top of the build's own finalize IO). Build is already heavy, so this is acceptable; a pre-tar optimization (reusing the layer sha the build already produces) is a possible future refinement.

Testing

The build handler needs infra (like the existing build tests); the digest helpers (computeConfigDigest, imageDisplayID, findImageByID) are unit-tested in #126. go test ./..., go vet, gofmt, go build clean. Merge only on verified-green CI.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/games-on-whales/LXC2Docker/pull/128 **Author:** [@JBailes](https://github.com/JBailes) **Created:** 7/1/2026 **Status:** ✅ Merged **Merged:** 7/1/2026 **Merged by:** [@JBailes](https://github.com/JBailes) **Base:** `main` ← **Head:** `fix/build-config-digest` --- ### 📝 Commits (1) - [`7d3e98b`](https://github.com/games-on-whales/LXC2Docker/commit/7d3e98b13830f7bc652440532509b556a65399cb) fix(build): aux.ID is the real sha256 config digest, not the image ref ### 📊 Changes **1 file changed** (+14 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `internal/api/build.go` (+14 -1) </details> ### 📄 Description Part 2 of the real-image-ID work (follows #126, which did commit + the shared infra). `POST /build`'s final aux emitted `{"aux":{"ID":"<repo>:<tag>"}}` — real Docker emits the **image ID**: `{"aux":{"ID":"sha256:<config-digest>"}}`. ## Fix After the build succeeds, compute the digest over the **built** rootfs via `computeConfigDigest(rec)` — the built record is already in the store, so `openImageRootfs` resolves the real built rootfs (accurate, and matches a later `docker save` of the same image). Store it on the record and return `sha256:<digest>` as `aux.ID`. - Done **before** applying extra `-t` tags, so their copied records inherit the digest. - **Best-effort**: falls back to the ref on a tar/hash error, so builds never fail on this. - Reuses #126's `imageDisplayID`/`findImageByID`, so inspect/list/df/history of a built image show the real digest and `docker inspect <digest>` resolves. ## Note The `computeConfigDigest` for a build re-tars the rootfs (an extra pass on top of the build's own finalize IO). Build is already heavy, so this is acceptable; a pre-tar optimization (reusing the layer sha the build already produces) is a possible future refinement. ## Testing The build handler needs infra (like the existing build tests); the digest helpers (`computeConfigDigest`, `imageDisplayID`, `findImageByID`) are unit-tested in #126. `go test ./...`, `go vet`, `gofmt`, `go build` clean. Merge only on verified-green CI. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-15 12:52:13 +00:00

closed this issue
added the
pull-request
label

No labels

pull-request

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

games-on-whales/LXC2Docker#129

No description provided.

Rows
Columns