Extracting base image from llbdefinition

[jgarec]

Hello,

Trying to find the base image name and its digest, I try to evaluate if I can get this from the metadata file with provenance=max.

"buildConfig": {
      "llbDefinition": [
        {
          "id": "step0",
          "op": {
            "Op": {
              "source": {
                "identifier": "docker-image://docker.io/library/busybox:latest@sha256:9ae97d36d26566ff84e8893c64a6dc4fe8ca6d1144bf5b87b2b85a32def253c7",
                "attrs": {
                  "image.resolvemode": "local"
                }
              }
            },
            "platform": {
              "Architecture": "arm64",
              "OS": "linux"
            },
            "constraints": {}
          }
        }

With docker, I do this :

BUILDX_METADATA_PROVENANCE=max docker buildx build --metadata-file=metadata.json .
jq -r '.["buildx.build.provenance"].buildConfig.llbDefinition[0].op.Op.source.identifier' metadata.json


docker-image://docker.io/library/busybox:latest@sha256:9ae97d36d26566ff84e8893c64a6dc4fe8ca6d1144bf5b87b2b85a32def253c7

After some tests, it seems always true (no matter if this is a multi stage build or not) except if the base image is scratch.

Do you think this is reliable ?

Regards,

[tonistiigi]

The correct way to get the base image is to look at the materials section of the provenance attestation (does not need to be mode=max) and find a dependency that is the subarray of your image layers. You can combine it with llbDefinition if you need to extract more info about the steps layout/config. In mode=max you also have the layer arrays of all build steps (if they have layers) in the provenance that you can use for subarray comparison. Do not make assumptions about the order of steps in the llbDefinition, except that the last step is the pointer to the build result.