jonjonsonjr

This is very work in progress, but for folks looking for a deeper explanation of how dynamic blocks are encoded, this is my attempt to visualize them.

(This all happens locally with way too much wasm, so attempting to upload a large gzip file will likely crash the tab.)

tl;dr for btype 2 blocks:

3 bit block header.

Three values telling you how many extra (above the minimum number) symbols are in each tree: HLIT, HDIST, and HCLEN.

First, we read (HCLEN + 4) * 3 bits.

These are the bit counts for symbols 0-18 in the code length tree, which gives you the bit patterns for a little mini-language used to compactly encode the literal/length and distance trees. 0-15 are literal bit lengths (0 meaning it's omitted). 16 repeats the previous symbol 3-6 times. 17 and 18 encode short (3-10) and long (11-138) runs of zeroes, which is useful for encoding blocks with sparse alphabets.

These bits counts are in a seemingly strange order that tries to push less-likely bit counts towards the end of the list so it can be truncated.

Knowing all the bit lengths for values in this alphabet allows you to reconstruct a huffman tree (thanks to canonical huffman codes) and decode the bit patterns for these code length codes.

That's followed by a bitstream that you decode to get the bit counts for the literal/length and distance trees. HLIT and HDIST (from earlier) tell you how many of these to expect.

Again, you can reconstruct these trees using just the bit lengths thanks to canonical huffman codes, which gives you the bit patterns for the data bitstream.

Then you just decode the rest of the bitstream (using LZSS) until you hit 256, the end of block (EOB).

If you're not already familiar with deflate, don't be discouraged if none of that made any sense. Bill Bird has an excellent (long) lecture that I recommend to everyone: https://www.youtube.com/watch?v=SJPvNi4HrWQ

I wrote a little more context for how this (and some related tools) came to be at https://dag.dev for the curious.

Happy to answer any questions, of course, but I imagine this is a pretty niche tool.

I still instinctively start my pipelines with cat half the time, but now I have complicated feelings about it.

https://github.com/emojisum/emojisum

Pleasantly surprised to come across this PR: https://github.com/safe-waters/docker-lock/pull/73

This is a perfect application of crane :)

I'll agree that docker makes it _really_ difficult to build and consume reproducible images (for a variety of reasons, see https://github.com/google/go-containerregistry/issues/895#is... and https://twitter.com/lorenc_dan/status/1343921451792003073 for a sampling of interesting ones), but there is more to the container ecosystem than docker or Dockerfiles.

Shameless plug: I help maintain ko (https://github.com/google/ko), which can achieve reproducible builds for go projects without much fuss. It also leans heavily on go's excellent support for cross-compilation to produce multi-platform images, trivially.

> There are two cases where the container-diff tool will report that the registry and local images that you are comparing are the same (in terms of Docker history lines), but will be misleading because the images are actually different.

While container-diff is great, it can obscure what's really going on a bit. If you're interested in uncovering exactly why the digest of the image you built is different from what was published, please forgive another shameless plug for crane (https://github.com/google/go-containerregistry/blob/main/cmd...), a tool I wrote to expose most of the functionality of go-containerregistry (https://github.com/google/go-containerregistry), which is the library both container-diff and ko use under the hood.

Forgive the sparse documentation, but it should be relatively straightforward for anyone familiar with the registry API and data structures, as the commands map pretty directly to registry functionality. Using crane, you can easily inspect the image in the registry directly to compare the manifests and blobs that make up an image.

For example, one reason that the digests might never match is that these images are somewhat strangely wrapped as singleton manifest lists: https://gist.github.com/jonjohnsonjr/ffba104ca504b5bb4a1f227...

It makes some sense to me that they might want to do this to prevent folks from pulling this on windows, but usually you would only encounter manifest lists for multi-platform images. Even if these builds were reproducible, you would have to compare the digest of what you built with sha256:9a210bb9cbbdba5ae2199b659551959cd01e0299419f4118d111f8443971491a -- not the sha256:fb1a43b50c7047e5f28e309268a8f5425abc9cb852124f6828dcb0e4f859a4a1 that docker outputs, as shown in the article.

The tag used for this example (mcr.microsoft.com/dotnet/sdk:5.0-alpine) has since been updated. Comparing this with the original using container-diff just tells us that the size changed: https://gist.github.com/jonjohnsonjr/90c2def551833c8cacf3264...

But looking at the actual manifests, config blobs, and layers using crane is often faster and more interesting: https://gist.github.com/jonjohnsonjr/283eab27d996b2f4cc04553...

My intention with crane is to be easily composable so that you can use familiar tools like tar, sort, diff, jq, etc.

(To be fair to container-diff, you can use the -t flag to show similar things.)

I realize this is not really the point of the article, but it's a huge pet peeve of mine that everyone has just given up on understanding what's going on with their images because the tooling UX makes everything so opaque. If the digest of something doesn't match, you should know why! It's as if `git push --force` was on by default and everyone has just accepted that reality.

Now to read the rest of the article :)