我们在Github操作流中生成的Docker镜像被拉取、标记,然后推送,这会导致推送具有新摘要的新镜像,而不是简单地标记现有镜像。
首先,我们使用Docker build-push action (https://github.com/docker/build-push-action)的新v2构建镜像。
jobs:
build-push:
name: Build and push docker image
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v2
- name: Set up QEMU
uses: docker/setup-qemu-action@v1
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v1
- name: Login to GCR
uses: docker/login-action@v1
with:
registry: gcr.io
username: _json_key
password: ${{ secrets.GOOGLE_APPLICATION_CREDENTIALS }}
- id: docker_build
uses: docker/build-push-action@v2
with:
tags: gcr.io/our-project/foo:initial-tag
push: true
target: build
build-args: |
NPM_TOKEN=${{ secrets.NPM_TOKEN }}然后,在稍后的单独工作流程中,我们下拉该图像(gcr.io/our-project/foo:initial-tag)并添加新标签。
jobs:
tag-image:
name: Tag image
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v2
- name: Login to GCR
uses: docker/login-action@v1
with:
registry: gcr.io
username: _json_key
password: ${{ secrets.GOOGLE_APPLICATION_CREDENTIALS }}
- run: |
docker pull gcr.io/our-project/foo:initial-tag
docker tag gcr.io/our-project/foo:initial-tag gcr.io/our-project/foo:new-tag
docker push gcr.io/our-project/foo:new-tag在推送new-tag之后,我希望我们的注册表包含一个带有initial-tag和new-tag的图像摘要。相反,这会创建一个仅包含new-tag的新图像摘要。
Digest: sha256:abc123
Tags: gcr.io/our-project/foo:initial-tag
Digest: sha256:def456
Tags: gcr.io/our-project/foo:new-tag此外,如果我们现在拉取一个标签(比如latest)并添加到new-tag中,它将不会创建新的图像摘要
Digest: sha256:abc123
Tags: gcr.io/our-project/foo:initial-tag
Digest: sha256:def456
Tags: gcr.io/our-project/foo:new-tag, gcr.io/our-project/foo:latest作为一种解决方法,我们发现推送不带标签的镜像名称会正确地将标签分配给现有的摘要。
docker pull gcr.io/our-project/foo:initial-tag
docker tag gcr.io/our-project/foo:initial-tag gcr.io/our-project/foo:new-tag
docker push gcr.io/our-project/foo发布于 2021-10-14 10:25:27
crane cp将高效地复制图像并保留摘要值
https://github.com/google/go-containerregistry/blob/main/cmd/crane/doc/crane_copy.md
https://stackoverflow.com/questions/64779312
复制相似问题