RUN instruction with bind mounted image is never cached

[zbynekwinkler]

Issue Description

RUN instruction with bind mounted image is never cached but the same thing using COPY instruction caches ok.

Steps to reproduce the issue

Steps to reproduce the issue

1. podman build the Containerfile bellow
2. build again

FROM docker.io/library/debian:12

RUN --mount=type=bind,from=ghcr.io/astral-sh/uv:latest,target=/usr/local/bin uv venv /app

Describe the results you received

The RUN instruction is executed both times, it is not taken from cache for the second build.

Describe the results you expected

The second build should use cache.

podman info output

host:
  arch: amd64
  buildahVersion: 1.38.0
  cgroupControllers:
  - cpu
  - memory
  - pids
  cgroupManager: systemd
  cgroupVersion: v2
  conmon:
    package: conmon_100:2.1.12-1_amd64
    path: /usr/bin/conmon
    version: 'conmon version 2.1.12, commit: e21e7c85b7637e622f21c57675bf1154fc8b1866'
  cpuUtilization:
    idlePercent: 93.73
    systemPercent: 2.43
    userPercent: 3.84
  cpus: 8
  databaseBackend: sqlite
  distribution:
    codename: bookworm
    distribution: debian
    version: "12"
  eventLogger: journald
  freeLocks: 2047
  hostname: gsdev
  idMappings:
    gidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 100000
      size: 65536
    uidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 100000
      size: 65536
  kernel: 6.1.0-27-amd64
  linkmode: dynamic
  logDriver: journald
  memFree: 6692057088
  memTotal: 7856631808
  networkBackend: netavark
  networkBackendInfo:
    backend: netavark
    dns:
      package: podman-aardvark-dns_100:1.13.1-1_amd64
      path: /usr/libexec/podman/aardvark-dns
      version: aardvark-dns 1.13.1
    package: podman-netavark_100:1.13.0-1_amd64
    path: /usr/libexec/podman/netavark
    version: netavark 1.13.0
  ociRuntime:
    name: runc
    package: cri-o-runc_100:1.2.2-1_amd64
    path: /usr/lib/cri-o-runc/sbin/runc
    version: |-
      runc version unknown
      spec: 1.2.0
      go: go1.23.3
      libseccomp: 2.5.4
  os: linux
  pasta:
    executable: /usr/bin/pasta
    package: passt_100:0.0+20241030.ee7d0b62-1_amd64
    version: |
      pasta 0.0+20241030.ee7d0b62
      Copyright Red Hat
      GNU General Public License, version 2 or later
        <https://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
      This is free software: you are free to change and redistribute it.
      There is NO WARRANTY, to the extent permitted by law.
  remoteSocket:
    exists: true
    path: /run/user/1000/podman/podman.sock
  rootlessNetworkCmd: pasta
  security:
    apparmorEnabled: false
    capabilities: CAP_AUDIT_WRITE,CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_MKNOD,CAP_NET_BIND_SERVICE,CAP_NET_RAW,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: true
    seccompEnabled: true
    seccompProfilePath: /usr/share/containers/seccomp.json
    selinuxEnabled: false
  serviceIsRemote: false
  slirp4netns:
    executable: ""
    package: ""
    version: ""
  swapFree: 1024454656
  swapTotal: 1024454656
  uptime: 28h 8m 35.00s (Approximately 1.17 days)
  variant: ""
plugins:
  authorization: null
  log:
  - k8s-file
  - none
  - passthrough
  - journald
  network:
  - bridge
  - macvlan
  - ipvlan
  volume:
  - local
registries:
  search:
  - docker.io
store:
  configFile: /home/mos/.config/containers/storage.conf
  containerStore:
    number: 1
    paused: 0
    running: 1
    stopped: 0
  graphDriverName: overlay
  graphOptions: {}
  graphRoot: /home/mos/.local/share/containers/storage
  graphRootAllocated: 249365385216
  graphRootUsed: 9810419712
  graphStatus:
    Backing Filesystem: extfs
    Native Overlay Diff: "true"
    Supports d_type: "true"
    Supports shifting: "false"
    Supports volatile: "true"
    Using metacopy: "false"
  imageCopyTmpDir: /var/tmp
  imageStore:
    number: 2
  runRoot: /run/user/1000/containers
  transientStore: false
  volumePath: /home/mos/.local/share/containers/storage/volumes
version:
  APIVersion: 5.3.0
  Built: 0
  BuiltTime: Thu Jan  1 01:00:00 1970
  GitCommit: ""
  GoVersion: go1.23.3
  Os: linux
  OsArch: linux/amd64
  Version: 5.3.0

Podman in a container

No

Privileged Or Rootless

Rootless

Upstream Latest Release

Yes

Additional environment details

Additional environment details

Additional information

If I change the Containerfile (see bellow), everything is cached. The resulting image is the same but the definition is more complex.

FROM docker.io/library/debian:12 as base

COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv

RUN uv venv /app

FROM docker.io/library/debian:12

COPY --from=base /app /app

[nalind]

I think containers/buildah#5691 will be adding information about --mounted items to cache evaluation.