Advice requested: rules_oci and most recent version of Docker Desktop on Mac

[simontoens]

Hi, not sure this is a rules_oci issue, this is just a shot in the dark. Wondering if anybody knows anything about this error we are seeing with the latest Mac Docker Desktop version.

We (developers at our company) were recently required to upgrade our Mac Docker Desktop version to 4.27.2 (to pick up security fixes). All users with older Intel-based Macs are now unable to "bazel run" rules_oci targets. More recent arm64-based Macs seem fine. The error we're seeing is:

setxattr com.apple.provenance /manifest.json: operation not supported

The file path may be different, but usually it is manifest.json.

Downgrading to a lower version of Docker Desktop (below 4.27.0) works, but isn't an option for us (because security requires us to be on the higher Docker version).

Has anybody here seen this? Thank you!

[thesayyn]

I have never seen that error before. but my educated guess is that it has something to do with how we create tars. When the tarball (oci_tarball) is created on a mac with bsdtar, it will include macos specific xattrs. on linux these are pretty much ignored by gnutar by default --no-xattrs.

Before i can make my conclusions, does this happen after you do bazel run and the tarball is already on the docker daemon but fails during extraction?

[thesayyn]

Related: #328. Probably will be fixed by #385

[simontoens]

Thanks for the reply @thesayyn. This fails during "bazel run", specifically when executing this cmd in the generated script:

"$CONTAINER_CLI" load --input "$IMAGE"

$CONTAINER_CLI is "docker"

[Strum355]

Issue has been reported upstream as well moby/moby#47517

[jsn-li]

I'm running into this issue now on an M1 mac.

[jasonschroeder-sfdc]

bazel clean --expunge and re-build has cleared it up for me so far 🤞

[agirorn]

Using bazel clean --expunge does not resolve this for me. Is there no workaround for this on the Mac?

[Strum355]

Fwiw we have worked around this (with rules_oci 1.7.2, aspect-build/bazel-lib 1.40.3 and rules_pkg 0.10.1) with the following patch to rules_oci https://github.com/sourcegraph/sourcegraph/blob/b870d3bc611144b62e43b3af46ddbf68b1b671b6/third_party/rules_oci/no_xattr.patch

[agirorn]

Thanks @Strum355.

Do you by any chance, know if there is a similar patch available for rules_docker?
Or is it just time to move over to OCI completely?

[Strum355]

Do you by any chance, know if there is a similar patch available for rules_docker? Or is it just time to move over to OCI completely?

I've never looked at rules_docker before, so Im afraid I dont know
rules_docker is marked as archived 😅

[thesayyn]

This is fixed in 2.0 branch by #385