Add support for multi-arch image indexes by jsing-canva · Pull Request #503 · GoogleContainerTools/container-structure-test

jsing-canva · 2025-07-14T02:12:03Z

The image loaded is based on the platform flag passed to the structure test
binary, which defaults to linux/GOARCH. On hosts that are multi-platform
capable, specifying an different platform flag will result in an alternate
image being loaded from the index.

Fixes #435

gemini-code-assist

Summary of Changes

Hello @jsing-canva, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly enhances the container-structure-test tool by adding robust support for multi-architecture image indexes. It enables the tool to intelligently select and load the appropriate image variant from an index based on a specified platform, resolving a long-standing limitation and improving its utility in diverse container environments.

Highlights

Multi-architecture Image Support: The container-structure-test tool now supports loading images from multi-architecture image indexes (manifest lists). Previously, it would terminate with a fatal error when encountering such indexes.
Platform-Specific Image Selection: Introduced new logic to parse a specified platform (e.g., linux/amd64) and recursively search within an image index to find an image that satisfies the given platform requirements. This allows the tool to select the correct image variant from a multi-arch index.
New Helper Functions: Added parsePlatform to convert platform strings into gcrv1.Platform objects and findImageInIndex to traverse image indexes and locate compatible images based on platform requirements, including handling nested indexes up to a defined depth.
Expanded Test Coverage: New test configurations (fluent_bit_test.yaml for amd64 and arm64) and an updated shell script test (structure_test_tests.sh) have been added to validate the multi-architecture image index loading functionality, ensuring the tool correctly identifies and tests platform-specific images.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in issue comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist is currently in preview and may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments to provide feedback.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request introduces support for multi-arch image indexes. There are a few critical issues in the Go implementation and a bug in the test script.

gemini-code-assist · 2025-07-14T02:14:45Z

+		return nil, fmt.Errorf("failed to read index manifest: %w", err)
+	}
+
+	for _, desc:= range manifest.Manifests {


Typo in the for loop declaration. desc:= is not valid Go syntax. It should be desc := with a space.

Suggested change

for _, desc:= range manifest.Manifests {

for _, desc := range manifest.Manifests {

gemini-code-assist · 2025-07-14T02:14:45Z

+		var img gcrv1.Image
 		if desc.MediaType.IsIndex() {
-			logrus.Fatal("multi-arch images are not supported yet.")
-		}
-
-		img, err := l.Image(desc.Digest)
+			platform, err := parsePlatform(opts.Platform)
+			if err != nil {
+				logrus.Fatalf("%s", err)
+			}

-		if err != nil {
-			logrus.Fatalf("could not get image from %s: %v", opts.ImageFromLayout, err)
+			img, err = findImageInIndex(l, platform, 0)
+			if err != nil {
+				logrus.Fatalf("could not get image from %s (platform %v): %v", opts.ImageFromLayout, opts.Platform, err)
+			}


The logic for finding an image within an OCI layout is flawed. It depends on desc := m.Manifests[0] from line 175, which means it only ever considers the first manifest in the layout's index. For a multi-arch image, this may not be the correct platform. Instead, use findImageInIndex directly on the loaded layout index l.

var img gcrv1.Image platform, err := parsePlatform(opts.Platform) if err != nil { logrus.Fatalf("%s", err) } img, err = findImageInIndex(l, platform, 0) if err != nil { logrus.Fatalf("could not get image from %s (platform %v): %v", opts.ImageFromLayout, opts.Platform, err) }

gemini-code-assist · 2025-07-14T02:14:45Z

+
+  res=$(./out/container-structure-test test --image-from-oci-layout="$tmp" --default-image-tag="test.local/$test_index" --config "${test_config_dir}/fluent_bit_test.yaml" 2>&1)
+  code=$?
+  if ! [[ ("$res" =~ "PASS" && "$code" == "0") ]];


The condition in this if statement is syntactically incorrect. Remove the parentheses (...) and use -eq for numerical comparisons.

Suggested change

if ! [[ ("$res" =~ "PASS" && "$code" == "0") ]];

if ! [[ "$res" =~ PASS && "$code" -eq 0 ]];

jsing-canva · 2025-09-09T08:41:22Z

@thesayyn are you able to review (or suggest someone else who can)?

thesayyn · 2025-09-09T16:41:42Z

do you mind force pushing here?

jsing-canva · 2025-09-10T02:12:52Z

do you mind force pushing here?

Sure, done.

jsing-canva · 2025-10-22T03:52:01Z

@thesayyn what are the next steps here (all of the failures appear unrelated to this change)?

jsing-canva · 2025-11-05T11:31:51Z

@thesayyn what are the next steps here (all of the failures appear unrelated to this change)?

@alexeagle or @loosebazooka perhaps?

alexeagle · 2025-11-05T14:02:20Z

I don't have permission to force-merge this. @loosebazooka maybe we should just fork the bazel rules to bazel-contrib if donation is too hard. (we can leave the Go code in this repo)

loosebazooka · 2025-11-05T14:05:48Z

This repo has been in maintenance mode for years before I even picked it up for distroless. I think a fork is fine if it means active development. I'm not sure what it would mean for users of the raw cli though.

loosebazooka · 2025-11-05T14:06:52Z

I'll take a look at the test failures

The image loaded is based on the platform flag passed to the structure test binary, which defaults to linux/GOARCH. On hosts that are multi-platform capable, specifying an different platform flag will result in an alternate image being loaded from the index. Fixes GoogleContainerTools#435

…#503) Adapts upstream PR GoogleContainerTools#503 ("Add support for multi-arch image indexes") to the fork. Upstream placed the index-selection logic inline in test.go, but the fork's GoogleContainerTools#554 since centralized OCI-layout loading into pkgutil.ImageFromOCILayout (shared by the Docker daemon path and the Tar driver). The platform-based selection is added there instead, so both drivers gain multi-arch support. ImageFromOCILayout now takes a platform string; callers pass opts.Platform / args.Platform. Two fork-authored changes beyond the upstream diff: - Nil-platform guard: v1.Descriptor.Platform is a nil-able *v1.Platform (OCI permits an index descriptor with no platform), and Satisfies has a value receiver, so the upstream desc.Platform.Satisfies(...) call panics with a nil dereference on such descriptors. findImageInIndex now skips any descriptor whose Platform is nil. Covered by a unit test that panics without the guard and passes with it. - parsePlatform replaced with go-containerregistry's v1.ParsePlatform, which accepts variants (e.g. linux/arm/v7) that the hand-rolled parser rejected. Also fixes the bundled shell test: numeric comparison uses -lt instead of the string operator <, and the multi-arch temp dir no longer clobbers the $tmp used by the following tar-driver test. Co-authored-by: Joel Sing <jsing@canva.com> Upstream-PR: GoogleContainerTools#503

gemini-code-assist Bot reviewed Jul 14, 2025

View reviewed changes

jsing-canva force-pushed the multi-arch-upstream branch from b0a368a to a91423d Compare July 14, 2025 02:31

thesayyn approved these changes Sep 9, 2025

View reviewed changes

jsing-canva force-pushed the multi-arch-upstream branch from a91423d to 64df197 Compare September 10, 2025 02:03

jsing-canva force-pushed the multi-arch-upstream branch from 64df197 to 41243d1 Compare November 14, 2025 22:53

jsing-canva force-pushed the multi-arch-upstream branch from 41243d1 to 6b6da63 Compare December 30, 2025 02:17

	for _, desc:= range manifest.Manifests {
	for _, desc := range manifest.Manifests {

	if ! [[ ("$res" =~ "PASS" && "$code" == "0") ]];
	if ! [[ "$res" =~ PASS && "$code" -eq 0 ]];

Uh oh!

Conversation

jsing-canva commented Jul 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot Jul 14, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Jul 14, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Jul 14, 2025

Choose a reason for hiding this comment

Uh oh!

jsing-canva commented Sep 9, 2025

Uh oh!

thesayyn commented Sep 9, 2025

Uh oh!

jsing-canva commented Sep 10, 2025

Uh oh!

jsing-canva commented Oct 22, 2025

Uh oh!

jsing-canva commented Nov 5, 2025

Uh oh!

alexeagle commented Nov 5, 2025

Uh oh!

loosebazooka commented Nov 5, 2025

Uh oh!

loosebazooka commented Nov 5, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

jsing-canva commented Jul 14, 2025 •

edited

Loading