Issues pulling from docker.io

[UebelAndre]

When using the WORKSPACE file documented below I get an unexpected error when running bazel query @node_image//...

oci_demo % bazel query @node_image//...
DEBUG: /private/var/tmp/_bazel_user/ba478bafcfc1207449b383e8560b89d0/external/contrib_rules_oci/oci/pull.bzl:71:14:
WARNING: fetching from https://docker.io/v2/library/node/manifests/18 without an integrity hash. The result will not be cached.
INFO: Repository node_image instantiated at:
  /Users/oci_demo/WORKSPACE.bazel:19:9: in <toplevel>
  /private/var/tmp/_bazel_user/ba478bafcfc1207449b383e8560b89d0/external/contrib_rules_oci/oci/pull.bzl:398:22: in oci_pull
Repository rule oci_pull_rule defined at:
  /private/var/tmp/_bazel_user/ba478bafcfc1207449b383e8560b89d0/external/contrib_rules_oci/oci/pull.bzl:220:32: in <toplevel>
ERROR: An error occurred during the fetch of repository 'node_image':
   Traceback (most recent call last):
	File "/private/var/tmp/_bazel_user/ba478bafcfc1207449b383e8560b89d0/external/contrib_rules_oci/oci/pull.bzl", line 149, column 27, in _oci_pull_impl
		mf, mf_len = _download(rctx, rctx.attr.identifier, mf_file, resource = "manifests")
	File "/private/var/tmp/_bazel_user/ba478bafcfc1207449b383e8560b89d0/external/contrib_rules_oci/oci/pull.bzl", line 80, column 27, in _download
		return json.decode(bytes), len(bytes)
Error in decode: at offset 0, unexpected character "<"
ERROR: /Users/oci_demo/WORKSPACE.bazel:19:9: fetching oci_pull_rule rule //external:node_image: Traceback (most recent call last):
	File "/private/var/tmp/_bazel_user/ba478bafcfc1207449b383e8560b89d0/external/contrib_rules_oci/oci/pull.bzl", line 149, column 27, in _oci_pull_impl
		mf, mf_len = _download(rctx, rctx.attr.identifier, mf_file, resource = "manifests")
	File "/private/var/tmp/_bazel_user/ba478bafcfc1207449b383e8560b89d0/external/contrib_rules_oci/oci/pull.bzl", line 80, column 27, in _download
		return json.decode(bytes), len(bytes)
Error in decode: at offset 0, unexpected character "<"
ERROR: Target parsing failed due to unexpected exception: at offset 0, unexpected character "<"
Loading: 0 packages loaded

WORKSPACE.bazel

workspace(name = "oci_demo")

load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")

http_archive(
    name = "contrib_rules_oci",
    sha256 = "929da1362e27dc38206a116783d2b3efb95bcb165bdbc62a8190013e612a9b51",
    strip_prefix = "rules_oci-0.3.1",
    url = "https://github.com/bazel-contrib/rules_oci/releases/download/v0.3.1/rules_oci-v0.3.1.tar.gz",
)

load("@contrib_rules_oci//oci:dependencies.bzl", "rules_oci_dependencies")

rules_oci_dependencies()

load("@contrib_rules_oci//oci:pull.bzl", "oci_pull")

# A single-arch base image
oci_pull(
    name = "node_image",
    image = "docker.io/library/node",
    # Unpinning is undesired but is used to figure out how to initially pin.
    reproducible = False,
    tag = "18",
)

[alexeagle]

The < character is because docker is redirecting to an html page. We have to give a url that points to the registry v2 layout. Maybe we can rewrite well-known ones

[alexeagle]

The other issue is that you need to hook up the experimental "Credential Helper" https://github.com/bazelbuild/bazel/blob/master/src/main/java/com/google/devtools/build/lib/authandtls/AuthAndTLSOptions.java#L144
If we can't figure it out from sources, I meant have a chat with @tjgq sometime anyway.

[alexeagle]

The URL needs to be index.docker.io/library/node so that we try to fetch
https://index.docker.io/v2/library/node/manifests/18
and that's where the credentials are needed.
(Is there some standard way that the docker tool knows that docker.io is a shorthand for index.docker.io?)

https://github.com/bazelbuild/proposals/blob/main/designs/2022-06-07-bazel-credential-helpers.md also helpful, docker was called out as the design it's based on. @Yannic maybe can help us wire it up since there are no docs for it yet.

[thesayyn]

Upon closer investigation i realized that --experimental-credential-helper isn't hooked up to the Starlark API. we can't use it yet.

See: bazelbuild/bazel#15013 (comment)

[thesayyn]

fixed by #115

[UebelAndre]

@thesayyn Thanks! Do you have an example of this working?

[thesayyn]

Here:

rules_oci/e2e/custom_registry/WORKSPACE

Lines 28 to 38 in 3c7e6f9

	oci_pull(
	name = "debian",
	image = "index.docker.io/library/debian",
	platforms = [
	"linux/arm64",
	"linux/amd64",
	],
	# Don't make a debian_unpinned repo and print a warning about the tag
	reproducible = False,
	tag = "latest",
	)

[alexeagle]

From #115 (comment)
I still think we should probably support docker.io/library/debian as a shortcut for index.docker.io/library/debian if the former one is what everyone expects to work.