Repository navigation
fix: a digest-pinned clone source gets a valid, content-named local snapshot - #118
Merged
Merged
Conversation
…napshot A clone ref written as repo@sha256:<hex> was split at its first colon, which turned the repo into repo@sha256 and the local snapshot name into a string with an @, outside cocoon's snapshot-name grammar, so the import could not land. snapshotSource splits on @ first, pulls by digest, and names the local copy after the digest, so an existing local copy is by construction the same content and is reused without a registry round trip. The GC keep-set uses the same derivation so it keeps what the clone path created.
This was referenced Sep 28, 2026
Merged
cocoon-common#37 teaches ParseRef the repo@digest form, and cocoon-webhook needs the same grammar, so the split has one owner. Drops the local snapshotSource and pins cocoon-common to #37's branch commit; the clone path and the GC keep-set are back to ParseRef plus localSnapshotName, which yields a valid, digest-bound local name. Run mode's resolveRunImage now splits digest refs correctly too.
CMGS
added a commit
that referenced
this pull request
Sep 29, 2026
The reclaimer treated every unused vk- snapshot as a VM's hibernate copy and verified it against <name>:hibernate in the registry. A clone-source copy of a non-default tag or a digest carries a colon in its local name, so that lookup built an invalid reference, the error was not errStaleLocalSnapshot, and the copy was kept forever with no log line. #118 made every digest clone source land on this path; the kit's N28 run left two 1 GiB digest copies on the node. VM names never contain a colon, so a colon in the name marks a pulled clone-source copy: re-pullable, owned by no VM, and safe to drop once no pod on the node clones from it. Verify errors that are not staleness now log at Warn instead of vanishing.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bug
A CocoonSet clone source pinned by digest,
repo@sha256:<hex>, went throughociutil.ParseRef, which split at the first colon: repo becamerepo@sha256and the tag the bare hex. The local snapshot name then contained@, outside cocoon's snapshot-name grammar^[a-zA-Z0-9][a-zA-Z0-9._:/-]{0,62}$, sococoon snapshot importrejected it. Digest-pinned clone sources did not work.Fix
The split now has one owner: cocoonstack/cocoon-common#37 teaches
ParseReftherepo@digestform (andIsRelativeRefits grammar). This PR pins cocoon-common to #37's branch commit; the clone path, the GC keep-set and run mode'sresolveRunImageall go throughParseRefunchanged.localSnapshotName(repo, "sha256:<hex>")yields a valid name bound to the content (hash-suffixed to 63 characters), so an existing local copy is always the same content, and the registry fetch goes by digest.The first commit carried a local splitter; the second drops it in favour of cocoon-common, so the net diff is the pin plus a test.
Companion
cocoonstack/cocoon-webhook#28: admission rejected every digest clone source before it reached vk-cocoon; it bumps to the same cocoon-common commit.
Order
cocoon-common#37 → re-pin this PR and webhook#28 to the merge commit or tag → merge both. vk-cocoon#117 pins cocoon-common#36; whichever of #117/#118 lands second takes one re-pin.
Evidence
TestLocalSnapshotNameForDigestRefs:ParseRefsplits the digest ref correctly; the derived names match cocoon's grammar, differ per digest, and keep the repo prefix.make lint0 issues on linux and darwin,make fmt-checkclean,asl ./...clean on both GOOS,go test -race ./...green.strings.Cutper parse.