deploy: skopeo rejects the dev-image probe ref carrying both tag and digest #232

New issue

Closed

opened 2026-07-25 17:27:35 +02:00 by dominik.polakovics · 0 comments

dominik.polakovics commented

2026-07-25 17:27:35 +02:00

Owner

Issue #230 (ADR-0056) added the module's default dev-image ref to the deploy wait step's skopeo probe. The ref is pinned tag-and-digest for readability — docker.io/library/buildpack-deps:stable-scm@sha256:07554a82… — and the probe passes it to skopeo verbatim. skopeo's docker:// transport refuses that form, so every probe attempt fails on parse and the wait step spins until the 30-minute deadline:

waiting for docker://docker.io/library/buildpack-deps:stable-scm@sha256:07554a82… … (skopeo: time="2026-07-25T15:25:13Z" level=fatal msg="Error parsing image name \"docker://docker.io/library/buildpack-deps:stable-scm@sha256:07554a82…\": Docker references with both a tag and digest are currently not supported")

The pin itself is correct — podman on the host accepts name:tag@digest and pulls by digest, and ADR-0056 deliberately keeps the tag beside the digest. The probe should strip the tag before handing the ref to skopeo: the digest is the only part that determines whether the ref resolves, so probing docker.io/library/buildpack-deps@sha256:… proves the same pull.

Issue #230 (ADR-0056) added the module's default dev-image ref to the deploy wait step's skopeo probe. The ref is pinned tag-and-digest for readability — `docker.io/library/buildpack-deps:stable-scm@sha256:07554a82…` — and the probe passes it to skopeo verbatim. skopeo's `docker://` transport refuses that form, so every probe attempt fails on parse and the wait step spins until the 30-minute deadline: ``` waiting for docker://docker.io/library/buildpack-deps:stable-scm@sha256:07554a82… … (skopeo: time="2026-07-25T15:25:13Z" level=fatal msg="Error parsing image name \"docker://docker.io/library/buildpack-deps:stable-scm@sha256:07554a82…\": Docker references with both a tag and digest are currently not supported") ``` The pin itself is correct — podman on the host accepts `name:tag@digest` and pulls by digest, and ADR-0056 deliberately keeps the tag beside the digest. The probe should strip the tag before handing the ref to skopeo: the digest is the only part that determines whether the ref resolves, so probing `docker.io/library/buildpack-deps@sha256:…` proves the same pull.

dominik.polakovics referenced this issue from a commit

2026-07-25 17:29:03 +02:00

fix(deploy): strip the tag from the dev-image ref before the skopeo probe (issue #232)

dominik.polakovics referenced this issue from a pull request that will close it,

2026-07-25 17:29:19 +02:00

fix(deploy): strip the tag from the dev-image ref before the skopeo probe #233

dominik.polakovics closed this issue

2026-07-25 17:37:12 +02:00