Docker dependency update suggested digest does not exist

[esetnik]

What would you like help with?

I think I found a bug

How are you running Renovate?

Mend Renovate hosted app on github.com

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

No response

Please tell us more about your question or problem

I have a Dockerfile which includes the line:

COPY --from=composer:2.6.6@sha256:eacc7de1c1f6554a2acc49ca9ca3fff57ca4567e626e778c43d0ac0bc2d54b43 /usr/bin/composer /usr/local/bin/composer

Renovate is suggesting the following update:

- COPY --from=composer:2.6.6@sha256:eacc7de1c1f6554a2acc49ca9ca3fff57ca4567e626e778c43d0ac0bc2d54b43 /usr/bin/composer /usr/local/bin/composer
+ COPY --from=composer:2.7.2@sha256:a4666f3438a40c6bc14090636efa7a567c8c7f503077be3aa30316bfd56d4d2b /usr/bin/composer /usr/local/bin/composer

However, no such digest a4666f3438a40c6bc14090636efa7a567c8c7f503077be3aa30316bfd56d4d2b exists on docker hub and docker build fails when using the renovate suggested digest.

Logs (if relevant)

Logs

          {
            "autoReplaceStringTemplate": "{{depName}}{{#if newValue}}:{{newValue}}{{/if}}{{#if newDigest}}@{{newDigest}}{{/if}}",
            "currentDigest": "sha256:eacc7de1c1f6554a2acc49ca9ca3fff57ca4567e626e778c43d0ac0bc2d54b43",
            "currentValue": "2.6.6",
            "currentVersion": "2.6.6",
            "datasource": "docker",
            "depName": "composer",
            "depType": "final",
            "fixedVersion": "2.6.6",
            "isSingleVersion": true,
            "lookupName": "library/composer",
            "packageName": "composer",
            "registryUrl": "https://index.docker.io",
            "replaceString": "composer:2.6.6@sha256:eacc7de1c1f6554a2acc49ca9ca3fff57ca4567e626e778c43d0ac0bc2d54b43",
            "versioning": "docker",
            "warnings": [],
            "updates": [
              {
                "bucket": "non-major",
                "newVersion": "2.7.2",
                "newValue": "2.7.2",
                "newDigest": "sha256:a4666f3438a40c6bc14090636efa7a567c8c7f503077be3aa30316bfd56d4d2b",
                "releaseTimestamp": "2024-03-12T18:02:39.680Z",
                "newMajor": 2,
                "newMinor": 7,
                "updateType": "minor",
                "branchName": "renovate/composer-2.x"
              }
            ]
          }
        ],
        "packageFile": "web/fpm.Dockerfile"
      },

[rarkins]

Per this log the sha exists?

❯ docker pull composer@sha256:a4666f3438a40c6bc14090636efa7a567c8c7f503077be3aa30316bfd56d4d2b
docker.io/library/composer@sha256:a4666f3438a40c6bc14090636efa7a567c8c7f503077be3aa30316bfd56d4d2b: Pulling from library/composer
bca4290a9639: Pull complete 
...

[esetnik]

Actually I was wrong about the patch that renovate opened a new PR against. Initially renovate suggested the following change:

- COPY --from=composer:2.6.6@sha256:eacc7de1c1f6554a2acc49ca9ca3fff57ca4567e626e778c43d0ac0bc2d54b43 /usr/bin/composer /usr/local/bin/composer
+ COPY --from=composer:2.7.2@sha256:3ed80ae3af9ba574917ac6cfe3be394e22aeda56ab7651e6dbb250fa1aa261ea /usr/bin/composer /usr/local/bin/composer

And I got the error:

#3 [internal] load metadata for docker.io/library/composer:2.7.2@sha256:3ed80ae3af9ba574917ac6cfe3be394e22aeda56ab7651e6dbb250fa1aa261ea
#3 ERROR: no match for platform in manifest sha256:3ed80ae3af9ba574917ac6cfe3be394e22aeda56ab7651e6dbb250fa1aa261ea: not found

#4 [internal] load metadata for docker.io/library/php:8.3.3-fpm-bullseye@sha256:0e8be91ab1a9ac0e151e04c85aef23aa0885b36ff906df172db60122ef60ba61
#4 CANCELED
------
 > [internal] load metadata for docker.io/library/composer:2.7.2@sha256:3ed80ae3af9ba574917ac6cfe3be394e22aeda56ab7651e6dbb250fa1aa261ea:
------
DEBU[0000] serving grpc connection                      
DEBU[0000] stopping session                              span="load buildkit capabilities"
DEBU[0000] serving grpc connection                      
DEBU[0000] stopping session                             
failed to solve: composer:2.7.2@sha256:3ed80ae3af9ba574917ac6cfe3be394e22aeda56ab7651e6dbb250fa1aa261ea: no match for platform in manifest sha256:3ed80ae3af9ba574917ac6cfe3be394e22aeda56ab7651e6dbb250fa1aa261ea: not found

          {
            "autoReplaceStringTemplate": "{{depName}}{{#if newValue}}:{{newValue}}{{/if}}{{#if newDigest}}@{{newDigest}}{{/if}}",
            "currentDigest": "sha256:eacc7de1c1f6554a2acc49ca9ca3fff57ca4567e626e778c43d0ac0bc2d54b43",
            "currentValue": "2.6.6",
            "currentVersion": "2.6.6",
            "datasource": "docker",
            "depName": "composer",
            "depType": "final",
            "fixedVersion": "2.6.6",
            "isSingleVersion": true,
            "lookupName": "library/composer",
            "packageName": "composer",
            "registryUrl": "https://index.docker.io",
            "replaceString": "composer:2.6.6@sha256:eacc7de1c1f6554a2acc49ca9ca3fff57ca4567e626e778c43d0ac0bc2d54b43",
            "versioning": "docker",
            "warnings": [],
            "updates": [
              {
                "bucket": "non-major",
                "newVersion": "2.7.2",
                "newValue": "2.7.2",
                "newDigest": "sha256:3ed80ae3af9ba574917ac6cfe3be394e22aeda56ab7651e6dbb250fa1aa261ea",
                "releaseTimestamp": "2024-03-12T17:32:25.709Z",
                "newMajor": 2,
                "newMinor": 7,
                "updateType": "minor",
                "branchName": "renovate/composer-2.x"
              }
            ]

https://developer.mend.io/github/ProdigyEMS/prodigy/-/job/018e33d2-6905-79af-8a88-b8f9ce30e436

[esetnik]

@rarkins I am still facing the same issue periodically on some other dependencies. It looks as though renovate chooses incorrect hashes which don't exist on docker hub in some cases.

[esetnik]

https://developer.mend.io/github/ProdigyEMS/prodigy/-/job/886d8e03-36aa-4046-bc9d-f8bb0cedf3bf

{
        "deps": [
          {
            "depName": "node",
            "currentValue": "20.12.0-alpine",
            "currentDigest": "sha256:77a112617c71bbc319b6658acbf805724ec99c1876b00007ba4e26f02fdfbec1",
            "replaceString": "node:20.12.0-alpine@sha256:77a112617c71bbc319b6658acbf805724ec99c1876b00007ba4e26f02fdfbec1",
            "autoReplaceStringTemplate": "{{depName}}{{#if newValue}}:{{newValue}}{{/if}}{{#if newDigest}}@{{newDigest}}{{/if}}",
            "datasource": "docker",
            "depType": "final",
            "updates": [
              {
                "updateType": "digest",
                "newValue": "20.12.0-alpine",
                "newDigest": "sha256:f2a9d4d47483a974529c15bacf09f52048bec5849c6b0ef88e52d7ceae2e309c",
                "branchName": "renovate/node-20.12.0-alpine"
              }
            ],
            "packageName": "node",
            "versioning": "node",
            "warnings": [],
            "sourceUrl": "https://github.com/nodejs/node",
            "registryUrl": "https://index.docker.io",
            "lookupName": "library/node",
            "currentVersion": "20.12.0",
            "fixedVersion": "20.12.0"
          }
        ],
        "packageFile": "frontend/Dockerfile"
      },

[esetnik]

f2a9d4d47483a974529c15bacf09f52048bec5849c6b0ef88e52d7ceae2e309c is not found.

[viceice]

it's not a wrong digest. it points to the image list, which is missing the image for your architecture. that's a general issue on official docker images. those arch images are build separately and the image list is constantly updated. so if renovate found the update too fast then your required platform can be missing. renovate can't know that.

[esetnik]

Is there a way to slow renovate down for these types of dependencies so we can give the arch images time to be built and published before renovate opens a PR? It's happening across the board several times a week to us where we get renovate suggesting an update that fails in our e2e testing environment due to missing platform.

[esetnik]

In the case of node-20.12.0-alpine it looks like it took 21 hours before the platform images were available after renovate initially suggested the digest update.