KCD Munich 2023 - Demystifying Container Images Understanding Multi-Architecture, Manifests, IDs, and Digests
•
0 likes•188 views
Container images are a fundamental component of modern software development and deployment, but the inner workings of how they function can still be a mystery to many developers. The complexity only increases when dealing with multi-architecture container images, manifests, IDs, and digests. In this talk, we will take a deep dive into these concepts to give you a better understanding of how container images work, how to distribute them, and how they can be created to run on multiple architectures. We will explore the differences between various types of container manifests, take a closer look at image IDs and digests, and discuss how multi-architecture container images can be created and distributed across different architectures and operating systems. You'll walk away from this talk with a greater understanding of container images and the tools you need to create and distribute them effectively.
Recommended
More Related Content
What's hot
What's hot (20)
Similar to KCD Munich 2023 - Demystifying Container Images Understanding Multi-Architecture, Manifests, IDs, and Digests
Similar to KCD Munich 2023 - Demystifying Container Images Understanding Multi-Architecture, Manifests, IDs, and Digests (20)
Recently uploaded
Recently uploaded (20)
KCD Munich 2023 - Demystifying Container Images Understanding Multi-Architecture, Manifests, IDs, and Digests
- 1. SPONSORS Speaker: Robert Bohne Company: Demystifying Container Images: Understanding Multi-Architecture, Manifests, IDs, and Digests
- 2. 3 Build Where do we start? Demystifying Container Images: Understanding Multi-Architecture, Manifests, IDs, and Digests Registry Run
- 3. 4 Build Container build Where do we start? Registry Container Registry Run Container Runtime
- 4. 5 Build Container build Build Where do we start? Registry Container Registry Run Container Runtime Container Image
- 5. 6 Build Container build Push to Registry Where do we start? Registry Container Registry Run Container Runtime Container Image Container Image Push
- 6. 7 Build Container build Pull Where do we start? Registry Container Registry Run Container Runtime Container Image Container Image Container Image Push Pull
- 7. 8 Build Container build Run Where do we start? Registry Container Registry Run Container Runtime Container (Process) Container Image Container Image Container Image Push Pull
- 8. 9 Container build Tools? Container Registry Container Runtime Push Pull
- 9. 10 Source: https://github.com/containers Container build Tools? Container Registry Container Runtime Push Pull
- 10. 11 Source: https://opencontainers.org/ https://github.com/opencontainers/ Container build Standards / Specifications Container Registry Container Runtime Push Pull
- 11. 12 Source: https://opencontainers.org/ https://github.com/opencontainers/ Container build Image Spec Container Registry Distribution Spec Container Runtime Runtime Spec Push Pull
- 12. 13 Source: https://opencontainers.org/ https://github.com/opencontainers/ Container build Container build FROM registry.access.redhat.com/ubi9/ubi-micro AS runner CMD ["uname","-om" ] Containerfile $ buildah bud -t quay.io/openshift-examples/multi-arch:kcdmunich2023-$(uname -m) . Command line Container Image Container Image Manifest Configuration Filesystem layers
- 13. Container Image for amd64/x86_64 14 Container Image (we are still in the runtime) Manifest Configuration Filesystem layers Blob - sha256:f89495e3e0be Blob - sha256:e54dc53d0edb Blob - sha256:5f70bf18a086 Blob - sha256:d9b46d23c9f8
- 14. 15 Container Image Manifest Container Image Manifest Configuration Filesystem layers Blob - sha256:f89495e3e0be Blob - sha256:e54dc53d0edb Blob - sha256:5f70bf18a086 Blob - sha256:d9b46d23c9f8 { "schemaVersion": 2, "mediaType": "application/vnd.oci.image.manifest.v1+json", "config": { "mediaType": "application/vnd.oci.image.config.v1+json", "digest": "sha256:f89495e3e0be655cdd4abc0048fbd3974658e9c07296ff4cdcf5e4e3226edc41", "size": 4236 }, "layers": [ { "mediaType": "application/vnd.oci.image.layer.v1.tar", "digest": "sha256:e54dc53d0edbbc96d3307fdea7bc1ed433d9083a1aab033dc3b38fd8b4fb165a", "size": 26090496 }, { "mediaType": "application/vnd.oci.image.layer.v1.tar", "digest": "sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef", "size": 1024 } ], "annotations": { "org.opencontainers.image.base.digest": "sha256:18a01cb5c53560ca2295e8a218454fe33b330ad6fac0d0ea43a513cd93787b7f", "org.opencontainers.image.base.name": "registry.access.redhat.com/ubi9/ubi-micro:latest" } } Manifest
- 15. 16 Container Image Configuration Container Image Manifest Configuration Filesystem layers Blob - sha256:f89495e3e0be Blob - sha256:e54dc53d0edb Blob - sha256:5f70bf18a086 Blob - sha256:d9b46d23c9f8 { "created": "2023-07-14T11:49:23.062774594Z", "architecture": "amd64", "os": "linux", "config": { "Env": ["PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"], "Cmd": ["uname","-om"], "Labels": { "architecture": "x86_64", "build-date": "2023-06-15T11:05:34", [...snipped...] } }, "rootfs": { "type": "layers", "diff_ids": [ "sha256:e54dc53d0edbbc96d3307fdea7bc1ed433d9083a1aab033dc3b38fd8b4fb165a", "sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef" ] }, "history": [ [...snipped...] ] } Configuration
- 16. 17 Container Image (we are still in the runtime) Container Image for amd64/x86_64 Manifest Configuration Filesystem layers Blob - sha256:f89495e3e0be Blob - sha256:e54dc53d0edb Blob - sha256:5f70bf18a086 Blob - sha256:d9b46d23c9f8 [root@centos-amd64 multi-arch]# podman images --digests --no-trunc REPOSITORY TAG DIGEST IMAGE ID quay.io/openshift-examples/multi-arch kcdmunich2023-x86_64 sha256:d9b46d23c9f8 sha256:f89495e3e0be … Command line
- 17. Blob - sha256:f89495e3e0be 18 Container Image (we are still in the runtime) Container Image for amd64/x86_64 Manifest Configuration Filesystem layers Blob - sha256:e54dc53d0edb Blob - sha256:5f70bf18a086 Blob - sha256:d9b46d23c9f8 [root@centos-amd64 multi-arch]# podman images --digests --no-trunc REPOSITORY TAG DIGEST IMAGE ID quay.io/openshift-examples/multi-arch kcdmunich2023-x86_64 sha256:d9b46d23c9f8 sha256:f89495e3e0be … Blob - sha256:f89495e3e0be Command line
- 18. 19 Source: https://github.com/containers Container build Push to Container Registry Container Registry Push
- 19. 20 Push the Container Image [root@centos-amd64 multi-arch]# podman push quay.io/openshift-examples/multi-arch:kcdmunich2023-x86_64 Getting image source signatures Copying blob 5f70bf18a086 done Copying blob e54dc53d0edb done Copying config f89495e3e0 done Writing manifest to image destination Storing signatures Command line Quay.io webui 😱
- 20. 21 Container Image (pushed) Container Image for amd64/x86_64 Manifest Configuration Filesystem layers Blob - sha256:f89495e3e0be Blob - sha256:940034fae708 Blob - sha256:bd9ddc54bea9 Blob - sha256:d3b7a48ede60
- 21. Registry Runtime 22 Container Image Container Image for amd64/x86_64 Manifest Configuration Filesystem layers Blob - sha256:f89495e3e0be Blob - sha256:940034fae708 Blob - sha256:bd9ddc54bea9 Blob - sha256:d3b7a48ede60 Blob - sha256:f89495e3e0be Blob - sha256:e54dc53d0edb Blob - sha256:5f70bf18a086 Blob - sha256:d9b46d23c9f8
- 22. Registry Runtime 23 Container Image Manifest from Container Registry Container Image Manifest Configuration Filesystem layers Blob - sha256:f89495e3e0be Blob - sha256:940034fae708 Blob - sha256:bd9ddc54bea9 Blob - sha256:d3b7a48ede60 Blob - sha256:f89495e3e0be Blob - sha256:e54dc53d0edb Blob - sha256:5f70bf18a086 Blob - sha256:d9b46d23c9f8 { "schemaVersion": 2, "mediaType": "application/vnd.oci.image.manifest.v1+json", "config": { "mediaType": "application/vnd.oci.image.config.v1+json", "digest": "sha256:f89495e3e0be655cdd4abc0048fbd3974658e9c07296ff4cdcf5e4e3226edc41", "size": 4236 }, "layers": [ { "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip", "digest": "sha256:940034fae708a1fe0ee6ff6929fffd48c235a6da185812ea4b31bab58815b6cf", "size": 26090496 }, { "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip", "digest": "sha256:bd9ddc54bea929a22b334e73e026d4136e5b73f5cc29942896c72e4ece69b13d", "size": 1024 } ], "annotations": { "org.opencontainers.image.base.digest": "sha256:18a01cb5c53560ca2295e8a218454fe33b330ad6fac0d0ea43a513cd93787b7f", "org.opencontainers.image.base.name": "registry.access.redhat.com/ubi9/ubi-micro:latest" } } Manifest
- 23. 24 Container Image (pushed) Container Image for amd64/x86_64 Manifest Configuration Filesystem layers Blob - sha256:f89495e3e0be Blob - sha256:940034fae708 Blob - sha256:bd9ddc54bea9 Blob - sha256:d3b7a48ede60
- 24. 25 Source: https://github.com/containers Container build Let’s run the Container Image Container Registry Container Runtime Push Pull
- 25. 26 Run the Container Image on amd64/x86_64 [root@centos-amd64-run ~]# podman run -ti --rm quay.io/openshift-examples/multi-arch:kcdmunich2023-x86_64 Trying to pull quay.io/openshift-examples/multi-arch:kcdmunich2023-x86_64... Getting image source signatures Copying blob bd9ddc54bea9 done Copying blob 940034fae708 done Copying config f89495e3e0 done Writing manifest to image destination Storing signatures x86_64 GNU/Linux [root@centos-amd64-run ~]# Command line 👏 ✅ amd64/x86_64 container image running ✅ application ‘uname -om’
- 26. 27 Run the Container Image on ARM64 [root@centos-arm64 ~]# podman run -ti --rm quay.io/openshift-examples/multi-arch:kcdmunich2023-x86_64 Trying to pull quay.io/openshift-examples/multi-arch:kcdmunich2023-x86_64... Getting image source signatures Copying blob 940034fae708 skipped: already exists Copying blob bd9ddc54bea9 done Copying config f89495e3e0 done Writing manifest to image destination Storing signatures WARNING: image platform (linux/amd64) does not match the expected platform (linux/arm64) {"msg":"exec container process `/usr/bin/uname`: Exec format error","level":"error","time":"2023-07-14T13:49:01.044372Z"} Command line 😠 📛 amd64/x86_64 container image running 📛 application ‘uname -om’
- 27. 28 Let’s build, push and run an ARM64 image [root@centos-arm64 multi-arch]# buildah bud -t quay.io/openshift-examples/multi-arch:kcdmunich2023-$(uname -m) . STEP 1/2: FROM registry.access.redhat.com/ubi9/ubi-micro AS runner Trying to pull registry.access.redhat.com/ubi9/ubi-micro:latest... Getting image source signatures Checking if image destination supports signatures Copying blob 5c3f8435842b done Copying config e2742eb12e done Writing manifest to image destination Storing signatures STEP 2/2: CMD ["uname","-om" ] COMMIT quay.io/openshift-examples/multi-arch:kcdmunich2023-aarch64 Getting image source signatures Copying blob 9eda08853b4a skipped: already exists Copying blob 5f70bf18a086 skipped: already exists Copying config 05447a1ff2 done Writing manifest to image destination Storing signatures --> 05447a1ff2eb Successfully tagged quay.io/openshift-examples/multi-arch:kcdmunich2023-aarch64 05447a1ff2eb966612bfbebd8f78f61ae7d0ffba09ce4dd9b4aaf8f384a75f21 Command line
- 28. 29 Let’s build, push and run an ARM64 image [root@centos-arm64 multi-arch]# buildah push quay.io/openshift-examples/multi-arch:kcdmunich2023-$(uname -m) Getting image source signatures Copying blob 9eda08853b4a done Copying blob bd9ddc54bea9 skipped: already exists Copying config 05447a1ff2 done Writing manifest to image destination Storing signatures Command line Quay.io webui
- 29. 30 Container Image (pushed) Container Image for arm64/aarch64 Manifest Configuration Filesystem layers Blob - sha256:05447a1ff2eb Blob - sha256:5c3f8435842b Blob - sha256:bd9ddc54bea9 Blob - sha256:b2be25b1c834 👉 Same structure as amd64/x86_64 👉 Manifest sha256 and compression of layers changed between build and push as well!
- 30. 31 Let’s build, push and run an ARM64 image [root@centos-arm64 multi-arch]# podman run -ti --rm quay.io/openshift-examples/multi-arch:kcdmunich2023-$(uname -m) aarch64 GNU/Linux Command line 👏 ✅ arm64 container image running ✅ application ‘uname -om’
- 31. 32 Run the Container Image on amd64/X86_64 [root@centos-amd64-run ~]# podman run -ti --rm quay.io/openshift-examples/multi-arch:kcdmunich2023-aarch64 Trying to pull quay.io/openshift-examples/multi-arch:kcdmunich2023-aarch64... Getting image source signatures Copying blob bd9ddc54bea9 skipped: already exists Copying blob 5c3f8435842b done Copying config 05447a1ff2 done Writing manifest to image destination Storing signatures WARNING: image platform (linux/arm64) does not match the expected platform (linux/amd64) {"msg":"exec container process `/usr/bin/uname`: Exec format error","level":"error","time":"2023-07-14T14:04:50.249825Z"} Command line 😠 📛 aarch64 container image running 📛 application ‘uname -om’
- 32. 33 Let’s create a Multi-Arch Container Image Container Image for arm64/aarch64 Manifest Configuration Filesystem layers Blob - sha256:05447a1ff2eb Blob - sha256:5c3f8435842b Blob - sha256:b2be25b1c834 Blob - sha256:bd9ddc54bea9 Container Image for amd64/x86_64 Manifest Configuration Filesystem layers Blob - sha256:f89495e3e0be Blob - sha256:940034fae708 Blob - sha256:bd9ddc54bea9 Blob - sha256:d3b7a48ede60 Manifest Index “Image” / Fat Manifest arm64 amd64
- 33. Let’s create a Multi-Arch Container Image [root@centos-amd64 multi-arch]# buildah manifest create manifestlist/v1 74fab59072d748f3a8bdb88d3248d4372f8c21440732038de7b4e88888373b3f [root@centos-amd64 multi-arch]# buildah manifest add manifestlist/v1 quay.io/openshift-examples/multi-arch:kcdmunich2023-aarch64 74fab59072d748f3a8bdb88d3248d4372f8c21440732038de7b4e88888373b3f: sha256:b2be25b1c8344d0f6a028a9b50d2e42ba25451c2d19fef3635dbd131d005bbf4 [root@centos-amd64 multi-arch]# buildah manifest add manifestlist/v1 quay.io/openshift-examples/multi-arch:kcdmunich2023-x86_64 74fab59072d748f3a8bdb88d3248d4372f8c21440732038de7b4e88888373b3f: sha256:d3b7a48ede6086835f0b97a82f9baaaa2d566072aec7e209d4341eb29566fafb [root@centos-amd64 multi-arch]# buildah manifest push manifestlist/v1 docker://quay.io/openshift-examples/multi-arch:kcdmunich2023 Getting image list signatures Copying 0 of 2 images in list Writing manifest list to image destination Storing list signatures [root@centos-amd64 multi-arch]# buildah manifest rm manifestlist/v1 untagged: localhost/manifestlist/v1:latest 74fab59072d748f3a8bdb88d3248d4372f8c21440732038de7b4e88888373b3f Command line
- 34. Manifest 35 Let’s create a Multi-Arch Container Image Container Image for arm64/aarch64 Manifest Configuration Filesystem layers Blob - sha256:05447a1ff2eb Blob - sha256:5c3f8435842b Blob - sha256:bd9ddc54bea9 Blob - sha256:b2be25b1c834 Container Image for amd64/x86_64 Manifest Configuration Filesystem layers Blob - sha256:f89495e3e0be Blob - sha256:940034fae708 Blob - sha256:bd9ddc54bea9 Blob - sha256:d3b7a48ede60 Index “Image” / Fat Manifest arm64 amd64 Blob - sha256:8a2f1bc89213
- 35. 36 Let’s create a Multi-Arch Container Image { "schemaVersion": 2, "mediaType": "application/vnd.oci.image.index.v1+json", "manifests": [ { "mediaType": "application/vnd.oci.image.manifest.v1+json", "digest": "sha256:b2be25b1c8344d0f6a028a9b50d2e42ba25451c2d19fef3635dbd131d005bbf4", "size": 776, "platform": { "architecture": "arm64", "os": "linux" } }, { "mediaType": "application/vnd.oci.image.manifest.v1+json", "digest": "sha256:d3b7a48ede6086835f0b97a82f9baaaa2d566072aec7e209d4341eb29566fafb", "size": 776, "platform": { “architecture": "amd64", "os": "linux" } } ] } Manifest
- 36. 37 Run the Container Image [root@centos-arm64 ~]# podman run -ti --rm quay.io/openshift-examples/multi-arch:kcdmunich2023 Trying to pull quay.io/openshift-examples/multi-arch:kcdmunich2023... Getting image source signatures Copying blob bd9ddc54bea9 skipped: already exists Copying blob 5c3f8435842b skipped: already exists Copying config 05447a1ff2 done Writing manifest to image destination Storing signatures aarch64 GNU/Linux [root@centos-arm64 ~]# Command line 👏 [root@centos-amd64 ~]# podman run -ti --rm quay.io/openshift-examples/multi-arch:kcdmunich2023 Trying to pull quay.io/openshift-examples/multi-arch:kcdmunich2023... Getting image source signatures Copying blob bd9ddc54bea9 skipped: already exists Copying blob 940034fae708 skipped: already exists Copying config f89495e3e0 done Writing manifest to image destination Storing signatures x86_64 GNU/Linux [root@centos-amd64 ~]# Command line 👏
- 37. 38 Run the Container Image [root@centos-arm64 ~]# podman run -ti --rm quay.io/openshift-examples/multi-arch:kcdmunich2023 Trying to pull quay.io/openshift-examples/multi-arch:kcdmunich2023... Getting image source signatures Copying blob bd9ddc54bea9 skipped: already exists Copying blob 5c3f8435842b skipped: already exists Copying config 05447a1ff2 done Writing manifest to image destination Storing signatures aarch64 GNU/Linux [root@centos-arm64 ~]# Command line 👏 [root@centos-amd64 ~]# podman run -ti --rm quay.io/openshift-examples/multi-arch:kcdmunich2023 Trying to pull quay.io/openshift-examples/multi-arch:kcdmunich2023... Getting image source signatures Copying blob bd9ddc54bea9 skipped: already exists Copying blob 940034fae708 skipped: already exists Copying config f89495e3e0 done Writing manifest to image destination Storing signatures x86_64 GNU/Linux [root@centos-amd64 ~]# Command line 👏 Container Runtime select Container Image based on ● platform.architecture - REQUIRED, GOARCH ● platform.os - REQUIRED, GOOS ● platform.os.version - optional, windows only.
- 38. Manifest 39 Let’s create a Multi-Arch Container Image Container Image for arm64/aarch64 Manifest Configuration Filesystem layers Blob - sha256:05447a1ff2eb Blob - sha256:5c3f8435842b Blob - sha256:bd9ddc54bea9 Blob - sha256:b2be25b1c834 Container Image for amd64/x86_64 Manifest Configuration Filesystem layers Blob - sha256:f89495e3e0be Blob - sha256:940034fae708 Blob - sha256:bd9ddc54bea9 Blob - sha256:d3b7a48ede60 Index “Image” / Fat Manifest arm64 amd64 Blob - sha256:8a2f1bc89213
- 40. 41 { "schemaVersion": 2, "mediaType": "application/vnd.docker.distribution.manifest.list.v2+json", "manifests": [ { "mediaType": "application/vnd.docker.distribution.manifest.v2+json", "digest": "sha256:57f1b9ae0b74d98ba7a8e70fa00758712f92ed3c06b3beda51c5c9ba93ba65e7", "platform": { "architecture": "amd64", "os": "linux" } }, { "mediaType": "application/vnd.docker.distribution.manifest.v2+json", "digest": "sha256:48f4a90f0c61ed8727c034e5336046949052376bd4ae9f9d538c6f8a2dd8c571", "platform": { "architecture": "arm64", "os": "linux" } }, { "mediaType": "application/vnd.docker.distribution.manifest.v2+json", "digest": "sha256:0037d35ed71250996928d5db1f4d4761f810b34d0bfee0202c7e3a6394897502", "platform": { "architecture": "amd64", "os": "windows", "os.version": "10.0.17763.2928" } }, { "mediaType": "application/vnd.docker.distribution.manifest.v2+json", "digest": "sha256:7d9065900b046d7612ef131da7444114109db252a43de212277ffa51fe738169", "platform": { "architecture": "amd64", "os": "windows", "os.version": "10.0.20348.707" } } ] } Multi-Arch, Multi-OS, Multi-OS-Version Container Image? mcr.microsoft.com/oss/kubernetes/pause:3.9 Manifest
- 41. 43 Blog post Slides Background info Questions? Thank you!