Tried to pull image manifest for registry-1.docker.io/arm64v8/openjdk:8 but failed because: manifest unknown

[smallverse]

Environment:

• Jib version:1.7.0
• Build tool:apache-maven-3.6.1
• OS: arm linux

OS name: "linux", version: "4.9.140-tegra", arch: "aarch64", family: "unix"
Distributor ID: Ubuntu
Description:    Ubuntu 18.04.2 LTS
Release:        18.04
Codename:       bionic

Description of the issue:
Failed to execute goal com.google.cloud.tools:jib-maven-plugin:1.7.0:build (default) on project xxx: Tried to pull image manifest for registry-1.docker.io/arm64v8/openjdk:8 but failed because: manifest unknown

jib-maven-plugin Configuration:

 <plugin>
                <groupId>com.google.cloud.tools</groupId>
                <artifactId>jib-maven-plugin</artifactId>
                <version>1.7.0</version>
                <configuration>
                    <from>
                        <image>arm64v8/openjdk:8</image>
                        <!-- <image>openjdk:alpine</image> -->
                    </from>
                    <container>
                        <mainClass>com.xxx.xxx.xxx</mainClass>
                        <jvmFlags>
                            <jvmFlag>-server</jvmFlag>
                        </jvmFlags>
                        <!--使用该参数将镜像的创建时间与系统时间对其-->
                        <useCurrentTimestamp>true</useCurrentTimestamp>
                    </container>
                    <!--如果私有镜像仓库没有启用https，设置allowInsecureRegistries参数为true-->
                    <allowInsecureRegistries>false</allowInsecureRegistries>
                    <to>
                        <image>docker.io/xxx/${project.artifactId}</image>
                        <tags>
                            <tag>${project.version}</tag>
                        </tags>
                        <auth>
                            <username>xxx</username>
                            <password>xxx</password>
                        </auth>
                    </to>
                </configuration>
                <executions>
                    <execution>
                        <phase>package</phase>
                        <goals>
                            <goal>build</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>

Log output:

[INFO] ------------------------------------------------------------------------
[INFO] Total time:  52.376 s
[INFO] Finished at: 2019-11-13T16:18:54+08:00
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal com.google.cloud.tools:jib-maven-plugin:1.7.0:build (default) on project xxx: Tried to pull image manifest for registry-1.docker.io/arm64v8/openjdk:8 but failed because: manifest unknown | If this is a bug, please file an issue at https:/GoogleContainerTools/jib/issues/new: 404 Not Found
[ERROR] {"errors":[{"code":"MANIFEST_UNKNOWN","message":"manifest unknown"}]}
[ERROR] -> [Help 1]
[ERROR] 
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR] 
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoExecutionException
[ERROR] 
[ERROR] After correcting the problems, you can resume the build with the command
[ERROR]   mvn <goals> -rf :xxx

[chanseokoh]

Hi @TuringZhai,

arm64v8/openjdk:8 is a manifest list ("mediaType": "application/vnd.docker.distribution.manifest.list.v2+json"). Jib's current limited support for a manifest list is to always choose amd64/linux among the list. This behavior is to ensure reproducibility even on building images on different architectures. (For example, running Jib on Windows doesn't build a Windows image but instead builds a Linux image.) In your case, the manifest list arm64v8/openjdk:8 doesn't have amd64/linux, so Jib fails.

$ docker manifest inspect arm64v8/openjdk:8

{         
   ...
   // This whole BLOB itself is a manifest list.
   "mediaType": "application/vnd.docker.distribution.manifest.list.v2+json",
   "manifests": [
      {
         // This entry in the list points to the manifest for the ARM64/Linux manifest.
         "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
         ...
         "digest": "sha256:1fbd49e3fc5e53154fa93cad15f211112d899a6b0c5dc1e8661d6eb6c18b30a6",
         "platform": {
            "architecture": "arm64",
            "os": "linux",
            "variant": "v8"
         }
      }
   ]
}

As you can see, the list shows that the actual manifest for ARM64 is at sha256:1fbd49e3fc5e53154fa93cad15f211112d899a6b0c5dc1e8661d6eb6c18b30a6. So, as a workaround, you can directly specify the ARM64 manifest:

<from>
  <image>openjdk@sha256:1fbd49e3fc5e53154fa93cad15f211112d899a6b0c5dc1e8661d6eb6c18b30a6</image>
</from>

If you want, you can leave the tag :8 in the reference. Note :8 will serve only as documentation and have no effect, which means it may eventually go out of sync with the actual :8 on Docker Hub; you'll be pinned down specifically by the digest.

<image>openjdk:8@sha256:1fbd49e3fc5e53154fa93cad15f211112d899a6b0c5dc1e8661d6eb6c18b30a6</image>

Of course, this is inconvenient and a hassle. For this matter, we do have an open issue for a feature to be able to specify an architecture and OS for a manifest list (#1567). That feature is precisely to support this use case. That is, I regard this issue as a duplicate of #1567.

[chanseokoh]

Closing as a duplicate of #1567.

[chanseokoh]

But I think it is reasonable to pick and use the first manifest entry in the manifest list if that is the only entry. (UPDATE: see #2148 (comment)) This will cover a lot of use cases from Docker Hub. Currently, it is very cumbersome to figure out the actual manifest.

[smallverse]

thank you！
i directly specify the ARM64 manifest:

<from>
  <image>openjdk@sha256:1fbd49e3fc5e53154fa93cad15f211112d899a6b0c5dc1e8661d6eb6c18b30a6</image>
</from>

[chanseokoh]

Great! I will leave this open to make Jib automatically pick the manifest if it is the only one in the list.

[loosebazooka]

I thought picking the single item in a manifest list would open us up to breakages if the manifest list ever expanded.

[chanseokoh]

Then instead of doing that, perhaps we could just print a message like

"... is a manifest list, but the list does not contain an image manifest for amd64/Linux. If your intention was to use a non-amd64/Linux base image, see #2148 to learn how to specify a manifest instead of a manifest list, until Jib fixes #1567 to allow specifying architecture and OS."

I guess showing a more detailed helpful message won't hurt than doing nothing.

[loosebazooka]

Should add to FAQ and then link to FAQ instead of this issue directly.

[chanseokoh]

@XiaoNaoEr Jib Maven 2.5.2 and Jib Gradle 2.5.0 are released with limited support for configuring a platform to select the matching base image from a manifest list. Take a look at the FAQ "How do I specify a platform in the manifest list (or OCI index) of a base image?". I suggest using the new feature instead of using a digest in <from><image> to point to a specific manifest. Note you'll need to update <from><image> to point to a manifest list when using this feature.

[smallverse]

@XiaoNaoEr Jib Maven 2.5.2 and Jib Gradle 2.5.0 are released with limited support for configuring a platform to select the matching base image from a manifest list. Take a look at the FAQ "How do I specify a platform in the manifest list (or OCI index) of a base image?". I suggest using the new feature instead of using a digest in <from><image> to point to a specific manifest. Note you'll need to update <from><image> to point to a manifest list when using this feature.

thanks