Skip to content

Conversation

jsternberg
Copy link
Collaborator

Improves the determination of the proper parent for exec and file ops.
With file ops, it will only consider inputs and ignore secondary inputs.
This prevents the following case:

FROM busybox AS build1
RUN echo foo > /hello

FROM scratch
COPY --from=build1 /hello .

Previously, build1 would be considered the parent of the copy
instruction. Now, copy properly does not have a parent.

If there are multiple file ops and the operations disagree on the
canonical "parent", we give up on trying to find a canonical parent and
assume there is none.

For exec operations, whichever input is associated with the root mount
is considered the primary parent.

For all other operations, the first parent is considered the primary
parent if it exists.

dap/thread.go Outdated
candidates[int(action.Input)] = struct{}{}
}

if len(candidates) != 1 {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Multiple actions are possible, even in Dockerfile. For example COPY with multiple source paths. Non-negative input of first action should be ok.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I figured it was best to be cautious when it came to the inputs. Is it possible for the multiple source paths in dockerfile to also have multiple different input indices?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The way it works is that input keys in action point first to the input array of the op and after that is exhausted then then index is result of another action https://github.com/moby/buildkit/blob/master/solver/pb/ops.proto#L310. So if you have two copy actions after each other it is smth like

fileop {
  inputs = [ A , B ]
  actions = [
     copy{input: 0, secondaryInput: 1},
     copy{input: 2, secondaryInput: 1}

where the 2 means the result of the first action len(inputs)+0

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I see what you mean. While unlikely, I'm still concerned about what to do if there are multiple copies with inputs that are below index 2 in your example. Maybe I can just update this so it filters out any input index that references something within the action?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've updated this to just use the first suitable input from the list of file actions.

@jsternberg jsternberg force-pushed the dap-detect-parent branch 2 times, most recently from 27a491d to fbcf69b Compare August 15, 2025 15:17
@jsternberg jsternberg requested a review from tonistiigi August 15, 2025 17:26
@jsternberg jsternberg added this to the v0.27.0 milestone Aug 15, 2025
Improves the determination of the proper parent for exec and file ops.
With file ops, it will only consider inputs and ignore secondary inputs.
This prevents the following case:

```
FROM busybox AS build1
RUN echo foo > /hello

FROM scratch
COPY --from=build1 /hello .
```

Previously, `build1` would be considered the parent of the copy
instruction. Now, copy properly does not have a parent.

If there are multiple file ops and the operations disagree on the
canonical "parent", we give up on trying to find a canonical parent and
assume there is none.

For exec operations, whichever input is associated with the root mount
is considered the primary parent.

For all other operations, the first parent is considered the primary
parent if it exists.

Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
@tonistiigi tonistiigi merged commit bac71de into docker:master Aug 18, 2025
138 checks passed
@jsternberg jsternberg deleted the dap-detect-parent branch August 18, 2025 17:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants