openstack/kolla.git/kolla/image/tasks.py, branch stable/2026.2

Ensure git cloned dirs are writable for the executing user

2026-09-16T12:19:40+00:00

Closes-Bug: #2167377 Change-Id: Ic5e32b79d058223634d990fb2e33041692f682ce Signed-off-by: Michal Nasiadka

Move PIP_* env variables to ARG and config

2026-07-30T13:55:31+00:00

Leaving empty CI template_overrides file in case we need to use it in future. Change-Id: Ic46f1a594bcc330536bc78d93ece10e60622f6d4 Signed-off-by: Michal Nasiadka

Rework tar normalization to a shared function

2026-07-23T09:50:16+00:00

Add missing tests Change-Id: I91b42fe530f87af7d78bb1a543b29a4b0d50872e Signed-off-by: Michael Sherman

kolla-build: normalize mtime in archive creation

2026-06-24T13:00:46+00:00

The reset_userinfo tar filter used when creating plugins and additions archives normalized uid/gid but left mtime untouched. Since archives are created after set_time() has already run, and the default working directory is a fresh temp dir per invocation, the embedded directory mtime was always the current time. Docker computes a content checksum for ADD instructions, so a different mtime in the tar produced a different checksum on every run. Fix by setting tarinfo.mtime = 0 in both reset_userinfo filters and calling os.utime(arc_path, (0, 0)) on the archive file after creation, making the archives binary-identical across runs for the same content. Change-Id: I205dab2c4a74fb9e3cb15c421d5c025849f5632a Signed-off-by: Michal Nasiadka

kolla-build: fix build-date LABEL invalidating Docker layer cache

2026-06-24T13:00:26+00:00

The build-date label was rendered into a LABEL instruction on line 3 of every Dockerfile template, immediately after FROM. Because Docker invalidates the cache for a changed instruction and all subsequent layers, a date change caused a full rebuild of every image on each new calendar day, even when nothing else had changed. Fix this by removing build-date from the Dockerfile templates and applying it as a --label argument at build time via image.labels. Labels passed on the build command line are not part of the Dockerfile cache key, so the date is still recorded in the image metadata without affecting layer caching. Change-Id: I8ef0d85bab1a999a4d09f7cbf0c088ca00fdcf77 Signed-off-by: Michal Nasiadka

kolla-build: Add Docker BuildKit support via docker buildx build

2026-06-18T08:54:32+00:00

Add --buildkit flag to use docker buildx build instead of the docker-py SDK. An optional --buildkit-builder selects a named buildx builder instance, enabling docker-container or remote drivers for multi-arch builds. --buildkit and --squash are mutually exclusive and rejected at startup. PushTask is skipped when buildkit is active; push is handled inline. Set buildkit as the new default. Change-Id: Idbf1d1bdc091bb84721f8006c2b916731b999859 Signed-off-by: Michal Nasiadka

Add OCI standard labels to container images

2026-03-30T18:47:21+00:00

Currently, Kolla images lack standard metadata, making it difficult to identify their build source, creation time, or exact version solely by inspecting the image artifact. This patch introduces the addition of Open Container Initiative (OCI) standard labels to all generated images. The build process now detects metadata (utilizing `direct_url.json` for pip-installed packages to avoid subprocess calls) and injects the following labels into the container runtime config: * org.opencontainers.image.authors * org.opencontainers.image.created * org.opencontainers.image.description * org.opencontainers.image.licenses * org.opencontainers.image.revision * org.opencontainers.image.source * org.opencontainers.image.title * org.opencontainers.image.url * org.opencontainers.image.version Example output: "Labels": { "org.opencontainers.image.authors": "Kolla Project (https://launchpad.net/kolla)", "org.opencontainers.image.created": "2025-12-22T14:02:47.015819", "org.opencontainers.image.description": "OpenStack Kolla keystone-ssh image", "org.opencontainers.image.licenses": "Apache-2.0", "org.opencontainers.image.revision": "96b54022857ccef8dc6bb11789abe32119827109", "org.opencontainers.image.source": "https://opendev.org/openstack/kolla", "org.opencontainers.image.title": "keystone-ssh", "org.opencontainers.image.url": "https://opendev.org/openstack/kolla", "org.opencontainers.image.version": "master-ubuntu-noble" } This enhancement improves the interoperability of Kolla images with standard container tools and registries that display OCI metadata. Change-Id: I3451940c90180ba91759c839987434e94251e32e Signed-off-by: Piotr Milewski

send empty X-Registry-Auth for anonymous pushes

2025-08-06T09:50:39+00:00

Since Docker 28.3.3 the daemon rejects a push that carries no `X-Registry-Auth` header [1]. The SDK already sets this header when it finds credentials, so the breakage happens only on anonymous pushes. During `PushTask.push_image()` we now check whether the SDK can resolve credentials for the target registry; if it cannot, we inject `auth_config={}`, causing the SDK to send the minimal "{}" header that satisfies the daemon while leaving authenticated pushes unchanged. Drop this addition when [2] is fixed. [1] https://github.com/moby/moby/pull/50371 [2] https://github.com/docker/docker-py/issues/3348 Closes-Bug: #2119619 Change-Id: I7a2f3fce223afd74741b40bf62836b325fca5b19 Signed-off-by: Bartosz Bezak

Remove Git remote origin after cloning sources

2025-02-19T22:43:19+00:00

When kolla is cloning a Git repository during the build process, the `.git/config` file retains the remote origin URL, which may expose sensitive credentials if authentication tokens are embedded in the URL. This fix ensures that the remote is removed after cloning to prevent unintended exposure of credentials. Closes-Bug: #2098904 Change-Id: Iec21fc2363e03133ec77326da7392bc25b40132a

Check if archive is tarfile

2024-08-27T20:20:32+00:00

Change-Id: I802267d848c1dee722015b0d379bd9210f6c103e