Warn if anonymous token is fetched (#4042)

Using a registry without logging in may lead to rate limiting; display a warning if that's the case. Note that this will be done in all instances even when using a local buildkit instance. fixes #3009 --------- Signed-off-by: Alex Couture-Beil <[email protected]>
earthly · Apr 24, 2024 · 37134bf · 37134bf
1 parent a2fc61e
commit 37134bf
Show file tree

Hide file tree

Showing 11 changed files with 87 additions and 6 deletions.
diff --git a/.buildkite/tests.sh b/.buildkite/tests.sh
@@ -139,6 +139,7 @@ for target in \
         +test-no-qemu-group9 \
         +test-no-qemu-group10 \
         +test-no-qemu-group11 \
+        +test-no-qemu-group12 \
         +test-no-qemu-slow \
         +test-qemu \
         ; do

diff --git a/.github/workflows/ci-docker-ubuntu.yml b/.github/workflows/ci-docker-ubuntu.yml
@@ -333,6 +333,20 @@ jobs:
       EXTRA_ARGS: "--auto-skip"
     secrets: inherit
 
+  docker-tests-no-qemu-group12:
+    needs: build-earthly
+    if: ${{ !failure() }}
+    uses: ./.github/workflows/reusable-test.yml
+    with:
+      TEST_TARGET: "+test-no-qemu-group12"
+      BUILT_EARTHLY_PATH: "./build/linux/amd64/earthly"
+      RUNS_ON: "ubuntu-latest"
+      BINARY: "docker"
+      SUDO: ""
+      SKIP_JOB: ${{ needs.build-earthly.result != 'success' }}
+      EXTRA_ARGS: "--auto-skip"
+    secrets: inherit
+
   docker-tests-no-qemu-slow:
     needs: build-earthly
     if: ${{ !failure() }}

diff --git a/.github/workflows/ci-podman-ubuntu.yml b/.github/workflows/ci-podman-ubuntu.yml
@@ -209,6 +209,19 @@ jobs:
       SKIP_JOB: ${{ needs.build-earthly.result != 'success' }}
     secrets: inherit
 
+  podman-tests-no-qemu-group12:
+    needs: build-earthly
+    if: ${{ !failure() }}
+    uses: ./.github/workflows/reusable-test.yml
+    with:
+      TEST_TARGET: "+test-no-qemu-group12"
+      BUILT_EARTHLY_PATH: "./build/linux/amd64/earthly"
+      RUNS_ON: "ubuntu-latest"
+      BINARY: "podman"
+      SUDO: "sudo -E"
+      SKIP_JOB: ${{ needs.build-earthly.result != 'success' }}
+    secrets: inherit
+
   podman-tests-no-qemu-slow:
     needs: build-earthly
     if: ${{ !failure() }}

diff --git a/Earthfile b/Earthfile
@@ -661,6 +661,7 @@ test-no-qemu:
     BUILD --pass-args +test-no-qemu-group9
     BUILD --pass-args +test-no-qemu-group10
     BUILD --pass-args +test-no-qemu-group11
+    BUILD --pass-args +test-no-qemu-group12
     BUILD --pass-args +test-no-qemu-slow
 
 # test-misc runs misc (non earthly-in-earthly) tests
@@ -748,6 +749,11 @@ test-no-qemu-group11:
     BUILD --pass-args ./tests+ga-no-qemu-group11 \
         --GLOBAL_WAIT_END="$GLOBAL_WAIT_END"
 
+# test-no-qemu-group12 runs the tests from ./tests+ga-no-qemu-group12
+test-no-qemu-group12:
+    BUILD --pass-args ./tests+ga-no-qemu-group12 \
+        --GLOBAL_WAIT_END="$GLOBAL_WAIT_END"
+
 # test-no-qemu-slow runs the tests from ./tests+ga-no-qemu-slow
 test-no-qemu-slow:
     BUILD --pass-args ./tests+ga-no-qemu-slow \

diff --git a/buildkitd/Earthfile b/buildkitd/Earthfile
@@ -12,7 +12,7 @@ buildkitd:
             ARG BUILDKIT_BASE_IMAGE=$BUILDKIT_PROJECT+build
         END
     ELSE
-        ARG BUILDKIT_BASE_IMAGE=github.com/earthly/buildkit:422af4977207d5a65ea59c25526a7a7782655df4+build
+        ARG BUILDKIT_BASE_IMAGE=github.com/earthly/buildkit:594835b598b9140741472bd8f3524cb502aa49f8+build
     END
     ARG EARTHLY_TARGET_TAG_DOCKER
     ARG TAG="dev-$EARTHLY_TARGET_TAG_DOCKER"

diff --git a/go.mod b/go.mod
@@ -149,6 +149,6 @@ replace (
 	github.com/jdxcode/netrc => github.com/mikejholly/netrc v0.0.0-20221121193719-a154cb29ec2a
 	github.com/jessevdk/go-flags => github.com/alexcb/go-flags v0.0.0-20210722203016-f11d7ecb5ee5
 
-	github.com/moby/buildkit => github.com/earthly/buildkit v0.0.0-20240319224128-422af4977207
+	github.com/moby/buildkit => github.com/earthly/buildkit v0.0.0-20240419223558-594835b598b9
 	github.com/tonistiigi/fsutil => github.com/earthly/fsutil v0.0.0-20231030221755-644b08355b65
 )
diff --git a/go.sum b/go.sum
@@ -190,8 +190,8 @@ github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4
 github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
-github.com/earthly/buildkit v0.0.0-20240319224128-422af4977207 h1:+/eWew9O8P2CJsLJGXQsXZ3AIbqOm5vVkd+2udVkBnw=
-github.com/earthly/buildkit v0.0.0-20240319224128-422af4977207/go.mod h1:1/yAC8A0Tu94Bdmv07gaG1pFBp+CetVwO7oB3qvZXUc=
+github.com/earthly/buildkit v0.0.0-20240419223558-594835b598b9 h1:yN1+9T45k+wyzD2Jaf0xSc7bvE0nx09WH2oLb49+vk4=
+github.com/earthly/buildkit v0.0.0-20240419223558-594835b598b9/go.mod h1:1/yAC8A0Tu94Bdmv07gaG1pFBp+CetVwO7oB3qvZXUc=
 github.com/earthly/cloud-api v1.0.1-0.20240326154259-86278fcedef8 h1:N8MVG7rTzYQ7SYCCTuRzH5sXJgEK+zcvuBWSnLzK9Rc=
 github.com/earthly/cloud-api v1.0.1-0.20240326154259-86278fcedef8/go.mod h1:rU/tYJ7GFBjdKAITV2heDbez++glpGSbtJaZcp73rNI=
 github.com/earthly/fsutil v0.0.0-20231030221755-644b08355b65 h1:6oyWHoxHXwcTt4EqmMw6361scIV87uEAB1N42+VpIwk=

diff --git a/tests/Earthfile b/tests/Earthfile
@@ -212,6 +212,9 @@ ga-no-qemu-group10:
 ga-no-qemu-group11:
     BUILD --pass-args ./autoskip+test-group3
 
+ga-no-qemu-group12:
+    BUILD --pass-args ./warn-if-not-logged-in+test
+
 
 ga-no-qemu-slow:
     BUILD +server
@@ -235,6 +238,10 @@ ga-no-qemu:
     BUILD +ga-no-qemu-group6
     BUILD +ga-no-qemu-group7
     BUILD +ga-no-qemu-group8
+    BUILD +ga-no-qemu-group9
+    BUILD +ga-no-qemu-group10
+    BUILD +ga-no-qemu-group11
+    BUILD +ga-no-qemu-group12
     BUILD +ga-no-qemu-slow
 
 # Note that this target is split up under github action workflows
@@ -1848,16 +1855,22 @@ RUN_EARTHLY:
             exit \$exit_code
         fi
 
-        if $should_fail; then
+        if [ \"$should_fail\" = maybe ]; then
+            # This is for times when we do not care about the exit code
+            echo \"INFO: earthly exited with exit_code=\$exit_code; maybe this is ok?\"
+        elif [ \"$should_fail\" = true ]; then
             if [ \$exit_code -eq 0 ]; then
                 echo ERROR: earthly should have failed but didn\'t.
                 exit 1
             fi
-        else
+        elif [ \"$should_fail\" = false ]; then
             if [ \$exit_code -ne 0 ]; then
                 echo ERROR: earthly failed with exit code \$exit_code.
                 exit \$exit_code
             fi
+        else
+            echo ERROR: unexpected value for should_fail: $should_fail
+            exit 1
         fi
         if [ -n \"$output_contains\" ]; then
             if ! grep $grep_flags \"$output_contains\" earthly.output >/dev/null; then

diff --git a/tests/warn-if-not-logged-in/Earthfile b/tests/warn-if-not-logged-in/Earthfile
@@ -0,0 +1,26 @@
+VERSION 0.8
+FROM --pass-args ..+base
+
+# replace the earthly config.yml (which typically has buildkit_additional_config configured
+# to use the earthly docker hub registry); we want to intentionally use docker hub for thist test
+RUN echo "global:
+  disable_analytics: true" > /etc/.earthly/config.yml
+
+# clear out any docker auth
+RUN rm /root/.docker/config.json
+
+test:
+    RUN mkdir sub
+    COPY hello.earth Earthfile
+    DO --pass-args +RUN_EARTHLY_ARGS --target=+hello --should_fail=maybe # there's a chance we actually get rate limited
+    RUN acbgrep 'Warning: you are not logged into registry-1.docker.io, you may experience rate-limitting when pulling images' earthly.output
+
+RUN_EARTHLY_ARGS:
+    FUNCTION
+    ARG earthfile
+    ARG target
+    ARG should_fail=false
+    DO --pass-args ..+RUN_EARTHLY \
+        --earthfile=$earthfile \
+        --target=$target \
+        --should_fail=$should_fail
diff --git a/tests/warn-if-not-logged-in/hello.earth b/tests/warn-if-not-logged-in/hello.earth
@@ -0,0 +1,5 @@
+VERSION 0.8
+
+hello:
+  FROM alpine
+  RUN echo hello
diff --git a/util/llbutil/authprovider/authprovider.go b/util/llbutil/authprovider/authprovider.go
@@ -128,6 +128,9 @@ func (ap *MultiAuthProvider) FetchToken(ctx context.Context, req *auth.FetchToke
 			}
 			return nil, err
 		}
+		if a.Anonymous {
+			ap.console.Warnf("Warning: you are not logged into %s, you may experience rate-limitting when pulling images\n", req.Host)
+		}
 		ap.setAuthServer(req.Host, as)
 		return a, nil
 	}