[Bug]: Can't Build Image from Dockerfile with scratch Base Image

[dennis-iv]

Testcontainers version

4.0.0

Using the latest Testcontainers version?

Yes

Host OS

Linux

Host arch

x86_64

.NET version

8.0.110

Docker version

Client:
 Version:           24.0.7
 API version:       1.43
 Go version:        go1.22.2
 Git commit:        24.0.7-0ubuntu4.1
 Built:             Fri Aug  9 02:33:20 2024
 OS/Arch:           linux/amd64
 Context:           default

Server:
 Engine:
  Version:          24.0.7
  API version:      1.43 (minimum version 1.12)
  Go version:       go1.22.2
  Git commit:       24.0.7-0ubuntu4.1
  Built:            Fri Aug  9 02:33:20 2024
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.7.12
  GitCommit:        
 runc:
  Version:          1.1.12-0ubuntu3.1
  GitCommit:        
 docker-init:
  Version:          0.19.0
  GitCommit:

Docker info

Client:
 Version:    24.0.7
 Context:    default
 Debug Mode: false

Server:
 Containers: 0
  Running: 0
  Paused: 0
  Stopped: 0
 Images: 0
 Server Version: 24.0.7
 Storage Driver: overlay2
  Backing Filesystem: extfs
  Supports d_type: true
  Using metacopy: false
  Native Overlay Diff: true
  userxattr: false
 Logging Driver: json-file
 Cgroup Driver: systemd
 Cgroup Version: 2
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
 Swarm: inactive
 Runtimes: runc io.containerd.runc.v2
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: 
 runc version: 
 init version: 
 Security Options:
  apparmor
  seccomp
   Profile: builtin
  cgroupns
 Kernel Version: 6.8.0-49-generic
 Operating System: Ubuntu 24.04.1 LTS
 OSType: linux
 Architecture: x86_64
 CPUs: 8
 Total Memory: 7.52GiB
 Name: _
 ID: _
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 Experimental: false
 Insecure Registries:
  127.0.0.0/8
 Live Restore Enabled: false

What happened?

I'm trying to build an image from a dockerfile with ImageFromDockerfileBuilder using scratch as a base layer.
Here's a simplified dockerfile example from https://hub.docker.com/_/scratch:

FROM scratch
COPY hello /
CMD ["/hello"]

But building the image fails with this stacktrace:

Unhandled exception. Docker.DotNet.DockerApiException: Docker API responded with status code=Forbidden, response={"message":"'scratch' is a reserved name"}

   at Docker.DotNet.DockerClient.HandleIfErrorResponseAsync(HttpStatusCode statusCode, HttpResponseMessage response)
   at Docker.DotNet.DockerClient.MakeRequestForRawResponseAsync(HttpMethod method, String path, IQueryString queryString, IRequestContent body, IDictionary`2 headers, CancellationToken token)
   at Docker.DotNet.Models.StreamUtil.MonitorResponseForMessagesAsync[T](Task`1 responseTask, DockerClient client, CancellationToken cancel, IProgress`1 progress)
   at DotNet.Testcontainers.Clients.DockerImageOperations.CreateAsync(IImage image, IDockerRegistryAuthenticationConfiguration dockerRegistryAuthConfig, CancellationToken ct) in /_/src/Testcontainers/Clients/DockerImageOperations.cs:line 73
   at DotNet.Testcontainers.Clients.TestcontainersClient.PullImageAsync(IImage image, CancellationToken ct) in /_/src/Testcontainers/Clients/TestcontainersClient.cs:line 394
   at DotNet.Testcontainers.Clients.TestcontainersClient.BuildAsync(IImageFromDockerfileConfiguration configuration, CancellationToken ct) in /_/src/Testcontainers/Clients/TestcontainersClient.cs:line 365
   at DotNet.Testcontainers.Images.FutureDockerImage.UnsafeCreateAsync(CancellationToken ct) in /_/src/Testcontainers/Images/FutureDockerImage.cs:line 155
   at DotNet.Testcontainers.Images.FutureDockerImage.CreateAsync(CancellationToken ct) in /_/src/Testcontainers/Images/FutureDockerImage.cs:line 122

It seems like Testcontainers is trying to pull the scratch image, but that's not allowed.

Relevant log output

Additional information

No response

[HofmeisterAn]

It seems like Testcontainers is trying to pull the scratch image, but that's not allowed.

Thank you for raising this issue. Indeed, we pre-pull images before building the actual image. Good catch! I think we should skip the scratch image in PullImageAsync(IImage, CancellationToken). We probably only need to skip it if dockerRegistryServerAddress is null (the registry is not https://index.docker.io/v1/). I assume the name scratch is not reserved for private registries.

testcontainers-dotnet/src/Testcontainers/Clients/TestcontainersClient.cs

Lines 363 to 366 in f2397a7

	var uncachedImages = baseImages.Where(baseImage => !repositoryTags.Contains(baseImage.FullName));
	await Task.WhenAll(uncachedImages.Select(image => PullImageAsync(image, ct)))
	.ConfigureAwait(false);

[dennis-iv]

Great! Thanks for the quick fix!

We probably only need to skip it if dockerRegistryServerAddress is null (the registry is not https://index.docker.io/v1/). I assume the name scratch is not reserved for private registries.

Well, from my understanding of docker/docker#8827⁠ (linked from https://hub.docker.com/_/scratch), it seems like the docker image builder indeed treats scratch as no-op and does not try to pull any image, regardless of the registry.
So for consistency with docker itself, I'd say we should skip it in any case.