[ContainerRegistry] Internal server error on `docker push <image_name>`

[oxbee]

Description

I want to use Gitea Packages as a Docker registry for one of my repos.

> cat Dockerfile
FROM busybox
CMD ["echo", "Hello Gitea registry! v2"]

> docker login gitea.djmil.dev --username djmil --password-stdin
Login Succeeded

> docker build -t gitea.djmil.dev/djmil/super_unique_version_42 .
[+] Building 1.8s (5/5) FINISHED

> docker push gitea.djmil.dev/djmil/dtest:super_unique_version_42
The push refers to repository [gitea.djmil.dev/djmil/dtest]
ec562eabd705: Pushed
bdb421fc0f9e: Pushed
failed commit on ref "manifest-sha256:5a73daa7ed0f7b9052fa0ea0143ef0f54c8f654f55ae1e1dccc5578e504efb92": unexpected status from PUT request to https://gitea.djmil.dev/v2/djmil/dtest/manifests/super_unique_version_42: 500 Internal Server Error

The cause of an error seems to be this line:

manifest.go:368:createPackageAndVersion() [E] Error inserting package: Error 1062 (23000): Duplicate entry '1-super_unique_version_42' for key 'package_version.UQE_package_version_s'

Non the less, the image seems to appear on the server. It also seems that most of the times I'am able to docker pull it..

Gitea Version

1.22

Can you reproduce the bug on the Gitea demo site?

No (not supported)

Log Gist

https://gist.github.com/oxbee/40ec1dce3a2cba34066f3a72a88335ab

Screenshots

Git Version

the one shipped with docker image

Operating System

MacOS Ventura 13.6.7

How are you running Gitea?

Official docker compose file with zero tweaks

Database

MySQL/MariaDB

[kemzeb]

This looks similar to #30973

[oxbee]

As stated in #27640, the bug seems to be relayed to MacOS docker client.

A functional workaround is to build an image without Provenance attestations:

docker build --provenance false -t gitea.djmil.dev/djmil/dtest:no_provenance .

And here is my little image with all it's layers 🥳

[oxbee]

Until the bug solved, maybe it worth mentioning this workaround as known bugs in the Container Registry documentation? @kemzeb is this a thing at the project? If yes, i would gladly do it.

Any way, i do hope people would be able google this workaround report by keywords:

"createPackageAndVersion() [E] Error inserting package: Error 1062 (23000): Duplicate entry 'some_tag_name' for key 'package_version.UQE_package_version_s'"

[kemzeb]

Until the bug solved, maybe it worth mentioning this workaround as known bugs in the Container Registry documentation? @kemzeb is this a thing at the project? If yes, i would gladly do it.

Looking at the Gitea documentation and the source, this does not appear to be a common practice.

If you wish, you could either discuss this on Discord or send a quick PR editing this page to see what others think about adding this section.

[v-yarotsky]

I have a suspicion that it's also broken for multi-arch images. I'm building an image for linux/amd64 and linux/arm64 using docker buildx on mac, with provenance disabled.

docker buildx build --provenance false --tag $GITEA_HOST/my-image:latest --platform linux/amd64 --platform linux/arm64 --push .

Which fails with

ERROR: failed commit on ref "manifest-sha256:1d6bc70bfa96f2770e0367b84ff1da376df41d7c5712d481fa25df2ee7b9362f": unexpected status from PUT request to <GITEA_HOST>/v2/<org>/<app>/manifests/latest: 500 Internal Server Error

I see the following message in the log:

container/manifest.go:364:createPackageAndVersion() [E] Error inserting package: package version already exists

and I see the following records in the DB:

app=# select version,lower_version,metadata_json::json->>'platform' as platform from package_version where package_id = 20;
                                 version                                 |                              lower_version                              |  platform
-------------------------------------------------------------------------+-------------------------------------------------------------------------+-------------
 _upload                                                                 | _upload                                                                 |
 sha256:7f5b592eb05ad9da6e17d5489c26f3da64b55090b6fc5892c7665b2cf86a9c2a | sha256:7f5b592eb05ad9da6e17d5489c26f3da64b55090b6fc5892c7665b2cf86a9c2a | linux/arm64
 sha256:1d6bc70bfa96f2770e0367b84ff1da376df41d7c5712d481fa25df2ee7b9362f | sha256:1d6bc70bfa96f2770e0367b84ff1da376df41d7c5712d481fa25df2ee7b9362f | linux/amd64
 latest                                                                  | latest                                                                  | linux/arm64

Notice how it fails when pushing the latest reference 1d6bc70bfa96f2770e0367b84ff1da376df41d7c5712d481fa25df2ee7b9362f, which is a manifest for the linux/amd64 build, because there's already another record for version = 'latest', lower_version = 'latest' for the linux/arm64 build.

[lunny]

This should be closed by #32022