标记和推送 Docker 映像更改摘要

Question

拉取、标记然后推送我们在 Github 操作流程中生成的 Docker 映像会导致推送具有新摘要的新映像，而不是简单地标记现有映像。

首先，我们使用 Docker build-push 操作 (https://github.com/docker/build-push-action) 的新 v2 构建映像

jobs:
  build-push:
    name: Build and push docker image
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v2
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v1
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v1
      - name: Login to GCR
        uses: docker/login-action@v1
        with:
          registry: gcr.io
          username: _json_key
          password: ${{ secrets.GOOGLE_APPLICATION_CREDENTIALS }}
      - id: docker_build
        uses: docker/build-push-action@v2
        with:
          tags: gcr.io/our-project/foo:initial-tag
          push: true
          target: build
          build-args: |
            NPM_TOKEN=${{ secrets.NPM_TOKEN }}

然后，在稍后的单独工作流程中，我们将图片 (gcr.io/our-project/foo:initial-tag) 拉下并添加新标签。

jobs:
  tag-image:
    name: Tag image
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v2
      - name: Login to GCR
        uses: docker/login-action@v1
        with:
          registry: gcr.io
          username: _json_key
          password: ${{ secrets.GOOGLE_APPLICATION_CREDENTIALS }}
      - run: |
          docker pull gcr.io/our-project/foo:initial-tag
          docker tag gcr.io/our-project/foo:initial-tag gcr.io/our-project/foo:new-tag
          docker push gcr.io/our-project/foo:new-tag

推高new-tag 后，我希望我们的注册表包含一个带有initial-tag 和new-tag 的图像摘要。相反，这会创建一个新的图像摘要，上面只有 new-tag。

Digest: sha256:abc123
Tags: gcr.io/our-project/foo:initial-tag

Digest: sha256:def456
Tags: gcr.io/our-project/foo:new-tag

此外，如果我们现在将标签（比如latest）添加到new-tag，它不会创建新的图像摘要

Digest: sha256:abc123
Tags: gcr.io/our-project/foo:initial-tag

Digest: sha256:def456
Tags: gcr.io/our-project/foo:new-tag, gcr.io/our-project/foo:latest

作为一种解决方法，我们发现推送不带标签的图像名称会正确地将标签分配给现有的摘要。

docker pull gcr.io/our-project/foo:initial-tag
docker tag gcr.io/our-project/foo:initial-tag gcr.io/our-project/foo:new-tag
docker push gcr.io/our-project/foo

Answer 1

crane cp 将有效地复制图像并保留摘要值

https://github.com/google/go-containerregistry/blob/main/cmd/crane/doc/crane_copy.md