Support for Docker Manifest List seems to break Bazel rules_docker

[mathieubergeron]

Hello!

10 days ago, we've seen apparition of docker digest updates using Docker Manifest List, like this one:

  container_pull(
      name = "node_14.15.4_buster_slim",
-     digest = "sha256:8e4843f26333ed01f8733c7163bf88fc31c8516f96c46094d15e906160451f26",
+     digest = "sha256:eb89a0a8d3d4572972fa0f247bec96d46e7b5da0b819b73857739788986bcbf5",
      registry = "index.docker.io",
      repository = "node",
      tag = "14.15.4-buster-slim",
  )

The issue we have is that Bazel rules_docker does not allow pinning manifest list:

ERROR: An error occurred during the fetch of repository 'node_14.15.4_buster_slim':
   SHA256 of the image specified does not match SHA256 of the pulled image. Expected sha256:eb89a0a8d3d4572972fa0f247bec96d46e7b5da0b819b73857739788986bcbf5, but pulled image with sha256:8e4843f26333ed01f8733c7163bf88fc31c8516f96c46094d15e906160451f26. It is possible that you have a pin to a manifest list which points to another image, if so, change the pin to point at the actual Docker image

Maybe this could be related to this change: #8427, that also occured 10 days ago.

Is there something we can do on our side to fix this? Or is this an issue with renovate?

[rarkins]

Can you see if using amd64/node instead of node works around the problem?

[mathieubergeron]

Thanks for the quick reply! That did the trick :-)

[viceice]

Try to reference amd64/node as repo

[rarkins]

I'm curious if this is a perfect solution or if it's merely a workaround that works for some but not all? Can be hard for us to fix.

So I understand it: Renovate pins the image to the "master" digest for all platforms, whereas bazel wants a platform-specific digest?

[viceice]

Looks like. But previous renovate strictly uses the docker hub fallback, which causes to always point to the amd64 image.

This fallback doesn't work for all registries.
I also don't want to revert our changes, as I think that's the expected behavior. All other docker tools, which supports manifest list, works with those digests.

[viceice]

We should check for an issue in bazel tools or open a new to clarify how we can best support those docker rules.