Skip to content

podman import failed with error 'layer 0 <...> does not match config's DiffID' #25593

@babykart

Description

@babykart

Issue Description

Importing a tar.xz archive as a container fail with the following error :

Error: writing blob: layer 0 (blob "sha256:57eca825bd922bd6aa59c30ac95be594144816b3951caefa2cf0be2d86db12d2"/""/"sha256:ebccf21abea5bba2d53df5158901c325b33a5cb1a17c44ddd6cc97c6036a9dcc") does not match config's DiffID "sha256:57eca825bd922bd6aa59c30ac95be594144816b3951caefa2cf0be2d86db12d2"

I tested with an archive that the size is ~45MB without problem.

Steps to reproduce the issue

Steps to reproduce the issue

  1. wget https://mirror.init7.net/gentoo//releases/amd64/autobuilds/current-stage3-amd64-musl-hardened/stage3-amd64-musl-hardened-20250309T170330Z.tar.xz
  2. podman import stage3-amd64-musl-hardened-20250309T170330Z.tar.xz gentoo-musl:latest

Describe the results you received

Error: writing blob: layer 0 (blob "sha256:57eca825bd922bd6aa59c30ac95be594144816b3951caefa2cf0be2d86db12d2"/""/"sha256:ebccf21abea5bba2d53df5158901c325b33a5cb1a17c44ddd6cc97c6036a9dcc") does not match config's DiffID "sha256:57eca825bd922bd6aa59c30ac95be594144816b3951caefa2cf0be2d86db12d2"

Describe the results you expected

Import task successfull (with podman-5.3.2):

Getting image source signatures
Copying blob 57eca825bd92 done   |
Copying config 0b14cb6fdc done   |
Writing manifest to image destination
sha256:0b14cb6fdc54455ab9964482dff111d02a696a3846df2d4db5bdf1dae6ce0582

podman info output

host:
  arch: amd64
  buildahVersion: 1.39.2
  cgroupControllers:
  - cpuset
  - cpu
  - io
  - memory
  - hugetlb
  - pids
  - rdma
  - misc
  cgroupManager: cgroupfs
  cgroupVersion: v2
  conmon:
    package: app-containers/conmon-2.1.13
    path: /usr/bin/conmon
    version: 'conmon version 2.1.13, commit: v2.1.13'
  cpuUtilization:
    idlePercent: 99.89
    systemPercent: 0.06
    userPercent: 0.05
  cpus: 16
  databaseBackend: sqlite
  distribution:
    distribution: gentoo
    version: "2.17"
  eventLogger: file
  freeLocks: 2045
  hostname: masha
  idMappings:
    gidmap: null
    uidmap: null
  kernel: 6.12.16-gentoo
  linkmode: dynamic
  logDriver: k8s-file
  memFree: 48935530496
  memTotal: 67151851520
  networkBackend: netavark
  networkBackendInfo:
    backend: netavark
    dns:
      package: app-containers/aardvark-dns-1.12.2-r1
      path: /usr/libexec/podman/aardvark-dns
      version: aardvark-dns 1.12.2
    package: app-containers/netavark-1.12.2-r1
    path: /usr/libexec/podman/netavark
    version: netavark 1.12.2
  ociRuntime:
    name: crun
    package: app-containers/crun-1.20
    path: /usr/bin/crun
    version: |-
      crun version 1.20
      commit: 9c9a76ac11994701dd666c4f0b869ceffb599a66
      rundir: /run/crun
      spec: 1.0.0
      +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +YAJL
  os: linux
  pasta:
    executable: /usr/bin/pasta
    package: net-misc/passt-2025.01.21
    version: |
      pasta 2025.01.21
      Copyright Red Hat
      GNU General Public License, version 2 or later
        <https://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
      This is free software: you are free to change and redistribute it.
      There is NO WARRANTY, to the extent permitted by law.
  remoteSocket:
    exists: true
    path: /run/podman/podman.sock
  rootlessNetworkCmd: pasta
  security:
    apparmorEnabled: false
    capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: false
    seccompEnabled: true
    seccompProfilePath: /usr/share/containers/seccomp.json
    selinuxEnabled: false
  serviceIsRemote: false
  slirp4netns:
    executable: /usr/bin/slirp4netns
    package: app-containers/slirp4netns-1.2.0
    version: |-
      slirp4netns version 1.2.0
      commit: 656041d45cfca7a4176f6b7eed9e4fe6c11e8383
      libslirp: 4.7.0
      SLIRP_CONFIG_VERSION_MAX: 4
      libseccomp: 2.6.0
  swapFree: 0
  swapTotal: 0
  uptime: 406h 4m 29.00s (Approximately 16.92 days)
  variant: ""
plugins:
  authorization: null
  log:
  - k8s-file
  - none
  - passthrough
  network:
  - bridge
  - macvlan
  - ipvlan
  volume:
  - local
registries: {}
store:
  configFile: /etc/containers/storage.conf
  containerStore:
    number: 1
    paused: 0
    running: 0
    stopped: 1
  graphDriverName: overlay
  graphOptions:
    overlay.mountopt: nodev,metacopy=on
  graphRoot: /vol/containers/storage
  graphRootAllocated: 21474836480
  graphRootUsed: 5049495552
  graphStatus:
    Backing Filesystem: btrfs
    Native Overlay Diff: "false"
    Supports d_type: "true"
    Supports shifting: "true"
    Supports volatile: "true"
    Using metacopy: "true"
  imageCopyTmpDir: /var/tmp
  imageStore:
    number: 120
  runRoot: /run/containers/storage
  transientStore: false
  volumePath: /vol/containers/storage/volumes
version:
  APIVersion: 5.4.1
  Built: 1741719773
  BuiltTime: Tue Mar 11 20:02:53 2025
  GitCommit: ""
  GoVersion: go1.23.6
  Os: linux
  OsArch: linux/amd64
  Version: 5.4.1

Podman in a container

No

Privileged Or Rootless

None

Upstream Latest Release

Yes

Additional environment details

Additional environment details

Additional information

Additional information like issue happens only occasionally or issue happens with a particular architecture or on a particular setting

Metadata

Metadata

Assignees

No one assigned

    Labels

    kind/bugCategorizes issue or PR as related to a bug.locked - please file new issue/PRAssist humans wanting to comment on an old issue or PR with locked comments.regressionv5.4

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions