Docker如何计算每一层的hash?它是确定性的吗? [英] How Docker calculates the hash of each layer? Is it deterministic?

问题描述

我试图在 Docker 官方文档中找到这些信息，但没有成功.

I tried to find this information around the Docker official docs, but had no success.

Docker 在计算每个提交/层的哈希时会考虑哪些信息?

Which pieces of information does Docker take into account when calculating the hash of each commit/layer?

很明显，Dockerfile 中的行是哈希的一部分，当然，也是父提交哈希的一部分.但是在计算这个哈希值时是否考虑了其他因素?

It's pretty obvious that the line in the Dockerfile is part of the hash and, of course, the parent commit hash. But is something else take into account when calculating this hash?

具体用例:假设我有两个开发人员在不同的机器上，在不同的时间点(因此，不同的 docker 守护进程和不同的缓存)运行 $ docker build ...相同的 Dockerfile.FROM ... 指令将为它们提供相同的起点，但每个操作的结果哈希是否会在相同的哈希上产生?它是确定性的吗?

Concrete use case: Let's suppose I have two devs in different machines, at different points in time (and because of that, different docker daemons and different caches) running $ docker build ... against the same Dockerfile. The FROM ... directive will give them the same starting point, but will the resulting hash of each operation result on the same hash? Is it deterministic?

推荐答案

感谢@thaJeztah.答案在 https://gist.github.com/aaronlehmann/b42a2eaf633fc949f93b#id 定义和计算

Thanks @thaJeztah. Answer is in https://gist.github.com/aaronlehmann/b42a2eaf633fc949f93b#id-definitions-and-calculations

1. layer.DiffID:单个图层的 ID

计算:DiffID = SHA256hex(未压缩层tar数据)

Calculation: DiffID = SHA256hex(uncompressed layer tar data)

layer.ChainID:层及其父层的 ID.此 ID 唯一标识由一组层组成的文件系统.

layer.ChainID: ID for a layer and its parents. This ID uniquely identifies a filesystem composed of a set of layers.

计算:

• 对于底层:ChainID(layer0) = DiffID(layer0)
• 对于其他层:ChainID(layerN) = SHA256hex(ChainID(layerN-1) + " " + DiffID(layerN))

image.ID:图片的 ID.由于映像配置引用映像使用的层，因此此 ID 包含文件系统数据和映像配置的其余部分.

image.ID: ID for an image. Since the image configuration references the layers the image uses, this ID incorporates the filesystem data and the rest of the image configuration.

计算:SHA256hex(imageConfigJSON)

Calculation: SHA256hex(imageConfigJSON)

这篇关于Docker如何计算每一层的hash?它是确定性的吗?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！