Skip to content

fix(oci): tell a null "manifests" from a list, and report a host failure as such - #14491

Open
ndeloof wants to merge 1 commit into
docker:mainfrom
ndeloof:oci-manifest-followup
Open

ndeloof wants to merge 1 commit into
docker:mainfrom
ndeloof:oci-manifest-followup

Conversation

@ndeloof

@ndeloof ndeloof commented Nov 11, 2026

Copy link
Copy Markdown
Contributor

What this PR does, in one sentence

Two small robustness fixes in the OCI loader: a manifest whose "manifests" is null is no longer taken for an image index, and a failure of the host to create a directory of the cache is no longer reported as an invalid artifact.

Context

This follows #14490, which docker-agent reviewed. Two of its findings were left for a follow-up:

  • A document with no media type is read as an index when it has a "manifests" key. With {"manifests": null} the key is present, so the document was read as an index and only failed later with "doesn't refer to compose artifacts", which points at the wrong problem.
  • When writing the manifest into a cache entry, every failure to create the .manifest directory was reported as invalid OCI artifact, including permission errors or a full disk, which have nothing to do with the artifact.

What the PR brings

  • A null "manifests" is treated like an absent one: the document is not an index.
  • Only the collision with an artifact file named .manifest is reported as invalid OCI artifact; any other error is returned as it is.
  • Tests cover both: the media-type-less document with a list, no manifests and null, and a failing directory creation (a missing parent, so it behaves the same on every OS). The existing test for the collision is unchanged.

🤖 Generated with Claude Code

…ure as such

A manifest with no media type was taken for an image index when it had a
"manifests" key, even when its value is null. It is now an index only when
that value is a list.

writeCacheEntryManifest reported every failure to create the directory
holding the manifest as an invalid OCI artifact. Only the collision with a
file of the artifact of that name is one; any other failure (missing
directory, permission, full disk) is the host's and is now returned as it is.

Signed-off-by: Nicolas De Loof <nicolas.deloof@gmail.com>
@ndeloof
ndeloof requested review from a team as code owners November 11, 2026 07:55

@docker-agent docker-agent left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Assessment: 🟢 APPROVE

@codecov

codecov Bot commented Nov 11, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants