I am building a custom Python application with a Dockerfile that starts with:
FROM python:3.9-slim
This project has a GitLab CI/CD pipeline attached to it that builds an image on every new tag. It looks like this:
image: docker:19.03.11
variables:
DOCKER_HOST: tcp://docker:2375
DOCKER_TLS_CERTDIR: ""
REGISTRY_IMAGE_PREFIX: $CI_REGISTRY/$CI_PROJECT_PATH
services:
- docker:19.03.11-dind
before_script:
- docker info
- docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
stages:
- build
build_tag:
stage: build
tags:
- docker
only:
- tags
script:
- docker pull $REGISTRY_IMAGE_PREFIX:latest || true
- docker build --pull --cache-from $REGISTRY_IMAGE_PREFIX:latest -t $REGISTRY_IMAGE_PREFIX:$CI_BUILD_TAG -t $REGISTRY_IMAGE_PREFIX:latest .
- docker push $REGISTRY_IMAGE_PREFIX:$CI_BUILD_TAG
- docker push $REGISTRY_IMAGE_PREFIX:latest
Now, I would be expecting this pipeline to always be using the latest image of python3.9-slim rather than something cached. I would like it to always pull the latest one for security reasons. My understanding is that docker build --pull will achieve that.
My job logs look as follows:
Running with gitlab-runner 14.7.0 (98daeee0)
# ...
docker pull $REGISTRY_IMAGE_PREFIX:latest || true
latest: Pulling from foo/bar
5eb5b503b376: Pulling fs layer
5c69ac0246d0: Pulling fs layer
ec43610c2a17: Pulling fs layer
3a2ae6a8a46f: Pulling fs layer
078e1103ffcc: Pulling fs layer
556f49a27dfa: Pulling fs layer
0867fd7a4808: Pulling fs layer
e4c1b3224a80: Pulling fs layer
c53e1e2d923a: Pulling fs layer
bffedbbd3d68: Pulling fs layer
4f4fb700ef54: Pulling fs layer
81e60cba01e4: Pulling fs layer
0867fd7a4808: Waiting
e4c1b3224a80: Waiting
c53e1e2d923a: Waiting
bffedbbd3d68: Waiting
4f4fb700ef54: Waiting
81e60cba01e4: Waiting
3a2ae6a8a46f: Waiting
078e1103ffcc: Waiting
556f49a27dfa: Waiting
5c69ac0246d0: Verifying Checksum
5c69ac0246d0: Download complete
3a2ae6a8a46f: Verifying Checksum
3a2ae6a8a46f: Download complete
078e1103ffcc: Verifying Checksum
078e1103ffcc: Download complete
ec43610c2a17: Verifying Checksum
ec43610c2a17: Download complete
0867fd7a4808: Verifying Checksum
0867fd7a4808: Download complete
e4c1b3224a80: Verifying Checksum
e4c1b3224a80: Download complete
556f49a27dfa: Verifying Checksum
556f49a27dfa: Download complete
bffedbbd3d68: Verifying Checksum
bffedbbd3d68: Download complete
4f4fb700ef54: Verifying Checksum
4f4fb700ef54: Download complete
81e60cba01e4: Verifying Checksum
81e60cba01e4: Download complete
5eb5b503b376: Verifying Checksum
5eb5b503b376: Download complete
c53e1e2d923a: Verifying Checksum
c53e1e2d923a: Download complete
5eb5b503b376: Pull complete
5c69ac0246d0: Pull complete
ec43610c2a17: Pull complete
3a2ae6a8a46f: Pull complete
078e1103ffcc: Pull complete
556f49a27dfa: Pull complete
0867fd7a4808: Pull complete
e4c1b3224a80: Pull complete
c53e1e2d923a: Pull complete
bffedbbd3d68: Pull complete
4f4fb700ef54: Pull complete
81e60cba01e4: Pull complete
Digest: sha256:846adf36a0f321040b9ec56470031cf196e856eb238e6896930eff405c1f48c3
Status: Downloaded newer image for registry.example.com/foo/bar:latest
registry.example.com/foo/bar:latest
[32;1m$ docker build --ssh default --pull --cache-from $REGISTRY_IMAGE_PREFIX:latest -t $REGISTRY_IMAGE_PREFIX:$CI_BUILD_TAG -t $REGISTRY_IMAGE_PREFIX:latest .
#2 [internal] load build definition from Dockerfile
#2 transferring dockerfile: 968B 0.0s done
#2 DONE 0.1s
#1 [internal] load .dockerignore
#1 transferring context: 2B 0.0s done
#1 DONE 0.1s
#3 resolve image config for docker.io/docker/dockerfile:experimental
#3 DONE 1.8s
#4 docker-image://docker.io/docker/dockerfile:experimental@sha256:600e5c62e...
#4 resolve docker.io/docker/dockerfile:experimental@sha256:600e5c62eedff338b3f7a0850beb7c05866e0ef27b2d2e8c02aa468e78496ff5 done
#4 sha256:d7f0373ffb1d5ac3477b10ab7f91cba7c5df586c72e7e4a12649024efdc0d531 0B / 9.64MB 0.1s
#4 sha256:600e5c62eedff338b3f7a0850beb7c05866e0ef27b2d2e8c02aa468e78496ff5 1.69kB / 1.69kB done
#4 sha256:3c244c0c6fc9d6aa3ddb73af4264b3a23597523ac553294218c13735a2c6cf79 528B / 528B done
#4 sha256:b587adb6abfd8d6c87b1f649c2e924d53f148ae1c7f0ceaaded70b27b44dccb5 1.21kB / 1.21kB done
#4 sha256:d7f0373ffb1d5ac3477b10ab7f91cba7c5df586c72e7e4a12649024efdc0d531 9.64MB / 9.64MB 0.4s
#4 sha256:d7f0373ffb1d5ac3477b10ab7f91cba7c5df586c72e7e4a12649024efdc0d531 9.64MB / 9.64MB 0.4s done
#4 extracting sha256:d7f0373ffb1d5ac3477b10ab7f91cba7c5df586c72e7e4a12649024efdc0d531
#4 extracting sha256:d7f0373ffb1d5ac3477b10ab7f91cba7c5df586c72e7e4a12649024efdc0d531 1.1s done
#4 DONE 1.7s
#5 [internal] load build definition from Dockerfile
#5 transferring dockerfile: 968B done
#5 DONE 0.0s
#6 [internal] load metadata for docker.io/library/python:3.9-slim
#6 DONE 1.0s
#7 importing cache manifest from registry.example.com/foo/bar...
#7 DONE 0.0s
#10 [internal] load build context
#10 transferring context: 16.81kB done
#10 DONE 0.0s
#16 [1/8] FROM docker.io/library/python:3.9-slim@sha256:e3c1da82791d70133938...
#16 resolve docker.io/library/python:3.9-slim@sha256:e3c1da82791d701339381d90ae63843cf078fed94bae6f36f7abe3ed3e339218 done
#16 sha256:e3c1da82791d701339381d90ae63843cf078fed94bae6f36f7abe3ed3e339218 1.86kB / 1.86kB done
#16 sha256:8ff47efd398ee4f3bf71b145c7eccdbedc475bea6dd7c44bf725ac9019befb8b 1.37kB / 1.37kB done
#16 sha256:8da5d5abf979e34a2f0b9598e97e00f15b67711b041fac7fe9319b03d299c61d 7.67kB / 7.67kB done
#16 DONE 0.2s
# .... other steps of the Dockerfile
#17 exporting to image
#17 exporting layers
#17 exporting layers 3.9s done
#17 writing image sha256:3c0206f884ff3639eef4c3b557fa34d966a13c7207aa9600ef3b195060ac3035 done
#17 naming to registry.example.com/foo/bar:v0.12.4 done
#17 naming to registry.example.com/foo/bar:latest done
#17 DONE 3.9s
$ docker push $REGISTRY_IMAGE_PREFIX:$CI_BUILD_TAG
The push refers to repository [registry.example.com/foo/bar]
692d2d5c748d: Preparing
5f70bf18a086: Preparing
b0de6637a0d3: Preparing
ca2925b22955: Preparing
328252fe7b15: Preparing
a16b2d819d6a: Preparing
8d00e4e19bd0: Preparing
bd2446141b44: Preparing
fa5abdc28024: Preparing
65bc0c77c48f: Preparing
32034715e5d4: Preparing
7d0ebbe3f5d2: Preparing
a16b2d819d6a: Waiting
bd2446141b44: Waiting
fa5abdc28024: Waiting
65bc0c77c48f: Waiting
32034715e5d4: Waiting
7d0ebbe3f5d2: Waiting
8d00e4e19bd0: Waiting
328252fe7b15: Layer already exists
5f70bf18a086: Layer already exists
692d2d5c748d: Pushed
b0de6637a0d3: Pushed
a16b2d819d6a: Pushed
bd2446141b44: Layer already exists
fa5abdc28024: Layer already exists
32034715e5d4: Layer already exists
65bc0c77c48f: Layer already exists
7d0ebbe3f5d2: Layer already exists
8d00e4e19bd0: Pushed
ca2925b22955: Pushed
v0.12.4: digest: sha256:fa4f5684ae81f7b25736da86429451fe264a970b0d0e7c9c2401de24b908ac0f size: 2829
[32;1m$ docker push $REGISTRY_IMAGE_PREFIX:latest
The push refers to repository [registry.example.com/foo/bar]
692d2d5c748d: Preparing
5f70bf18a086: Preparing
b0de6637a0d3: Preparing
ca2925b22955: Preparing
328252fe7b15: Preparing
a16b2d819d6a: Preparing
8d00e4e19bd0: Preparing
bd2446141b44: Preparing
fa5abdc28024: Preparing
65bc0c77c48f: Preparing
32034715e5d4: Preparing
7d0ebbe3f5d2: Preparing
a16b2d819d6a: Waiting
8d00e4e19bd0: Waiting
bd2446141b44: Waiting
32034715e5d4: Waiting
7d0ebbe3f5d2: Waiting
65bc0c77c48f: Waiting
fa5abdc28024: Waiting
b0de6637a0d3: Layer already exists
328252fe7b15: Layer already exists
a16b2d819d6a: Layer already exists
692d2d5c748d: Layer already exists
5f70bf18a086: Layer already exists
ca2925b22955: Layer already exists
8d00e4e19bd0: Layer already exists
bd2446141b44: Layer already exists
32034715e5d4: Layer already exists
7d0ebbe3f5d2: Layer already exists
fa5abdc28024: Layer already exists
65bc0c77c48f: Layer already exists
latest: digest: sha256:fa4f5684ae81f7b25736da86429451fe264a970b0d0e7c9c2401de24b908ac0f size: 2829
section_end:1644480261:step_script
section_start:1644480261:cleanup_file_variables
Cleaning up project directory and file based variables
section_end:1644480262:cleanup_file_variables
Job succeeded
In particular, looking at this part:
#16 [1/8] FROM docker.io/library/python:3.9-slim@sha256:e3c1da82791d70133938...
#16 resolve docker.io/library/python:3.9-slim@sha256:e3c1da82791d701339381d90ae63843cf078fed94bae6f36f7abe3ed3e339218 done
#16 sha256:e3c1da82791d701339381d90ae63843cf078fed94bae6f36f7abe3ed3e339218 1.86kB / 1.86kB done
#16 sha256:8ff47efd398ee4f3bf71b145c7eccdbedc475bea6dd7c44bf725ac9019befb8b 1.37kB / 1.37kB done
#16 sha256:8da5d5abf979e34a2f0b9598e97e00f15b67711b041fac7fe9319b03d299c61d 7.67kB / 7.67kB done
#16 DONE 0.2s
I want to make sure it's actually pulling the latest version of python:3.9-slim here. Looking at Docker Hub, the latest amd64 image's SHA is 8ff47e and not e3c1da, but I see 8ff47e in one of the later lines.
I guess my question is a simple one: Is it pulling the latest image here, and can I be sure that --pull works as intended?
If so, what is e3c1da referring to, here?