Replace docker-image-not-found in CircleCI publish workflow

[MikeMcC399]

What would you like?

The npm module docker-image-not-found, sourced from the repo cypress-io/docker-image-not-found, is out of date and should be replaced.

Why is this needed?

The npm module docker-image-not-found is on the critical path for releasing Cypress Docker images to the repositories Docker Hub and Amazon ECR (Elastic Container Registry) Public Gallery.

The module is used in the CircleCI workflow command halt-if-docker-image-exists.

docker-image-not-found (current latest), which was released in March 2020, is not compatible with default multi-architecture manifests using OCI formats. If an OCI type image exists, then docker-image-not-found reports the same 1 return code as for an existing docker manifest image. The error log however shows that there has been a problem evaluating the manifest, leading to loss of confidence in the module's reliability.

The following issues would need to be resolved in order to continue to use it in the medium term:

• InvalidContentError for Docker image using OCI imageType docker-image-not-found#6
• Multiple deprecations for dependencies docker-image-not-found#5
• Multiple vulnerabilities docker-image-not-found#4
• Outdated npm v1 lockfile docker-image-not-found#3
• CI based on unsupported Node.js 12 docker-image-not-found#2

Considering that its only function is to check for the existence of an image, the effort to update it to current environments is out of proportion to its benefit. The original repo https://github.com/mishguruorg/docker-image-exists, from which it was forked, was last updated 7 years ago and would not be helpful for any update.

Other

Related

• docker-image-not-found not compatible with oci mediatype #1141
• Migrate to current Docker version #1095

[MikeMcC399]

Recap

• As experienced in issue "Push Factory Image" failure checking cypress/factory:4.0.1 #1093, docker-image-not-found was unable to evaluate a media_type in the form of oci and it output an error message:

  message: 'unsupported schema version 2 in cypress/factory:4.0.1 manifest',

  The manifest causing an issue contained the following:

  "schemaVersion": 2,
  "mediaType": "application/vnd.oci.image.index.v1+json",

  Due to uncertain root causes and effects, the change was reverted in PR Revert "ci: update circleci runner (#1079)" #1094 changing the media_type back to docker:

  "schemaVersion": 2,
  "mediaType": "application/vnd.docker.distribution.manifest.list.v2+json",

A solution for checking if an image has already been published to Docker Hub is needed which covers both the older docker type and the newer oci type. This issue is preventing further version updates taking place (see #1095 & #1145).

Solution suggestion

Using the Docker HUB API (beta)'s Check repository tag with the following format it is possible to replace the outdated npm module docker-image-not-found. The API does not require a Docker client and is therefore independent of any Docker engine version installed:

https://hub.docker.com/v2/namespaces/{namespace}/repositories/{repository}/tags/{tag}

For instance

curl -s https://hub.docker.com/v2/namespaces/cypress/repositories/factory/tags/4.0.2 | grep -iq 'httperror 404'
echo $?
curl -s https://hub.docker.com/v2/namespaces/cypress/repositories/factory/tags/missing | grep -iq 'httperror 404'
echo $?

• returns 1 (failure) = image exists (not 'not found')
• returns 0 (success) = image check returned HTTP 404 'not found'

respectively, exactly as docker-image-not-found does.

Additionally the API is able to cope with images that have an imageType oci. For example, we can check the method using ubuntu/jammy which has converted to vnd.oci.image:

$ curl -s https://hub.docker.com/v2/namespaces/library/repositories/ubuntu/tags/jammy | python -mjson.tool | grep media_
type
    "media_type": "application/vnd.oci.image.index.v1+json",

and executing this command against the oci image correctly returns the expected result:

curl -s https://hub.docker.com/v2/namespaces/library/repositories/ubuntu/tags/jammy | grep -iq 'httperror 404'
echo $?

• returns 1 (failure) = image exists. This is despite it having an oci manifest.

Note that the experimental Docker command docker manifest inspect in the currently used Docker engine 20.10 fails to recognize images with an oci manifest, and so it is not yet a candidate to replace docker-image-not-found. It does however work in later versions such as Docker engine 24.0 and its status can be monitored to see if docker manifest inspect should be used at a later time.