Comments (4)
Ran into this while attempting to use the Docker provider with Terraform Cloud's remote execution mode.
Until the client.Ping(ctx)
call that happens during the provider's configuration gets removed (or made optional), this is the workaround I opted for, and hopefully it helps anyone else stumbling across this issue.
It's essentially doing the same thing docker_registry_image
does - it calls the registry API and pulls out the docker-content-digest
header.
Note that it's GCR-specific, but can easily be adapted for other registries.
# Provides data.external.docker-image.result.image and
# data.external.docker-image.result.digest
data "external" "docker-image" {
program = [
"./digest.sh", "gcr.io/<project>/<image>:<tag>"
]
}
#!/usr/bin/env bash
set -eo pipefail
input=$1 # gcr.io/project/image:tag
input=${input/gcr.io\//} # project/image:tag
components=(${input//:/ }) # [project/image, tag]
repository=${components[0]} # project
tag=${components[1]:-latest} # tag
url="https://gcr.io/v2/${repository}/manifests/${tag}"
digest=$(curl -I "${url}" -u "_json_key:${SERVICE_ACCOUNT}" | \
grep docker-content-digest | cut -c 24-94) # sha256:abcd...
image="gcr.io/${repository}@${digest}" # gcr.io/project/image@sha256:abcd...
jq -n --arg digest "${digest}" --arg image "${image}" '{"digest": $digest, "image": $image}'
from terraform-provider-docker.
@Deiz, thank you for your comment. Based on your approach I have decide to use terraform http provider to achieve a similar result:
data "http" "access_token" {
url = "https://${var.docker_registry.host}/oauth2/token?service=${var.docker_registry.host}&scope=repository:*:pull"
request_headers = {
Authorization = "Basic ${base64encode("${var.docker_registry.user}:${var.docker_registry.password}")}"
}
}
data "http" "tips" {
url = "https://${var.docker_registry.host}/v2/tips/manifests/${local.environment}"
request_headers = {
Accept = "application/vnd.docker.distribution.manifest.v2+json",
Authorization = "Bearer ${jsondecode(data.http.access_token.body).access_token}"
}
}
output "image" {
value = "${var.docker_registry.host}/tips@${data.http.tips.response_headers.Docker-Content-Digest}"
}
from terraform-provider-docker.
I can't manage to figure this one out. @rafagsiqueira do you mind posting your entire working solution with full format for repository names? I'm assuming you're using ghcr.io as well?
I managed to get a solution with the old docker registry working, but github does not send the Docker-Content-Digest
header that you're using. The information is available in the body but since it's not using application/json
Content-Type, the http provider won't parse it.
from terraform-provider-docker.
@dvcrn, I am using azure container registry. var.docker_registry.host just has the fqdn of my container registry.
From @Deiz response, it looks like gcr also sends the digest on the body of the response. If http provider won't parse it, perhaps you can use terraform's jsondecode?
@Deiz also did not use the Accept = "application/vnd.docker.distribution.manifest.v2+json" on the headers, perhaps gcr.io does not need that?
Other than that, I am sorry I can't help you, since we are not using gcr.io.
from terraform-provider-docker.
Related Issues (20)
- ci: update to go 1.15 HOT 1
- Missing security_opt option for docker_container resource
- How can I pass private_key for ssh connection? HOT 1
- Alias fails when passed to child module.
- Image value in docker_service state doesn't stick
- Image argument after v2.6.0 always replaces resources (mismatch between image name vs sha image id) HOT 2
- Modifying labels does not recreate container
- How to use provider with simple get from https://hub.docker.com/search?q=&type=image HOT 1
- [docker_network] - check_duplicate not working
- Unable to remove Docker image: image is referenced in multiple repositories HOT 1
- Swarm Secret Data Source
- Provider can't connect to Docker daemon in WSL 2
- Crash Import service docker module with hosts include
- Call for future maintainers HOT 8
- Add support for docker plugins
- terraform destroy does not respect stop_grace_period for docker swarm services running on DOCKER_HOST
- OCI images are not supported
- Null user should not force a replacement
- Non existent or null workdir should not force replacement
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from terraform-provider-docker.