Conversation
Export deferred tw.Close() before writer.Close(). Deferred calls run last-in, first-out, so the pipe was closed first, and tw.Close() failed with io.ErrClosedPipe before it could write the padding after the last file and the end-of-archive marker. The error was ignored. "docker context import" still reads these archives, because Go's archive/tar stops at EOF. Stricter readers don't: with TLS files in the context, Python's tarfile rejects the export, and so does the macOS tar when reading it from a pipe. Close the tar writer before closing the pipe, and pass its error to CloseWithError instead of dropping it. Signed-off-by: Arian Boukani <arbo@yorku.ca>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
docker context exportwrites a truncated tar archive #7332Summary
Export()deferredtw.Close()beforewriter.Close(). Deferred calls run last-in, first-out, so the pipe was closed first, andtw.Close()failed withio.ErrClosedPipebefore it could write the padding after the last file and the end-of-archive marker. That error was ignored, so everydocker context exportproduced an incomplete archive.docker context importstill reads these, but when the context has TLS files, stricter tar readers reject them. The issue has a reproducer.This closes the tar writer before the pipe, and passes its error to
CloseWithErrorinstead of dropping it. The new test fails without the change: the exported archive isn't a multiple of 512 bytes, and it has no end-of-archive marker.With this change, the reproducer from the issue produces a complete archive that Python's
tarfileand the macOStarboth read, anddocker context importstill works. Errors, such as exporting a context that doesn't exist, are reported the same way as before.Release notes (optional)