Some questions about Talos Imager (boot assets)

[ossfellow]

Building the Talos Installer image, using the new Imager will produce a tar file, which if inspected reveals the following:

• It's in Docker format, not OCI layout format.
• The os metadata attribute is not set.
• The architecture metadata attribute is not set.

The format choice necessitates format conversion using tools like skopeo, when using an OCI compliant registry (e.g. Zot), which seems redundant given that even Docker supports OCI format.
The other two directly impact usability, as the registry cannot differentiate between the architectures based on the metadata, and the user has to resort to using differentiating names to distinguish between various architectures.

So, I have 2 questions:

1. Was there a reason for using Docker format instead of OCI layout?
2. Is there a straightforward way of adding the missing metadata after the tar is generated, as I could not find any way to do it without manual manipulation and regeneration of SHA checksums, which is not automation friendly?

As a side note, one has to check Talos code to find out about supported profiles; if there are no plans to add this to boot assets in v1.5.x/v1.6.0, then I can do a PR to have it included; so, please let me know.

Thank you for the insights and help.

[smira]

This boot asset generation is mostly supposed to be used by people who run customized Linux kernel/in-house Talos modifications.

The final product (which is based on the imager) is Image Factory, which (once launched) will remove the need of running imager for 99% of Talos users.

So some of your questions might make sense, we used something which crane outputs natively, and this might not be compatible with other tools, probably it can be adjusted, but it also works fine with crane push.

Multi-arch images anyways require creating two images for each arch and pushing a multi-arch manifest, so the os in each image makes little sense.

[ossfellow]

Thanks for the quick feedback @smira. The reason I'm using the Imager is because I need some extensions, so, I'm following the recommended approach of creating custom images.
By the way, after I asked on Slack about the tooling, I tried using crane, oras, regctl and skopeo, and only the last one could directly push it to the OCI registry, without resorting the intermediary steps or additional tools. crane seems to be missing the format conversion feature.

[frezbo]

you don't need to convert with crane, just crane push _out/installer-amd64.tar 127.0.0.1:5010/frezbo/installer:v1.6.0-alpha.0-43-g4874cfb95-dirty works as an example, so it takes care of adding os info and all

[ossfellow]

Thanks @frezbo; I know the command, but if the destination registry is OCI compliant and doesn't support Docker format, it will fail. You can give it try if you think I might be missing something.

[frezbo]

crane push should be an oci image, i think it's becuase the tarball itself is not oci complaint, but i think we should fix it from our side

[ossfellow]

That will be awesome; and while you're doing it, please add the metadata, which directly impacts usability.

[smira]

OCI layout is not a tarball, it's a directory structure which is hard to emit as a single file, it has to be 'tarred' once again. As the formats are convertible, I see no issue with it. Probably in the future we could emit OCI layout images, but that is not an immediate priority at the moment.

Same thing with os tags or anything like that - you can freely mutate the annotation using available tools, what imager provides is the contents, and that is important, everything else is easily changeable with existing tooling.

[ossfellow]

While I can certainly convert the docker-archive tarball to an OCI image, using skopeo, I could not find any way using the aforementioned tools to add os/architecture metadata. The Imager accepts arch as an input argument, but then it doesn't add it to the metadata (not an annotation).
If there is a way to add it please provide a hint (i.e. which tool) and I'll dig into how it can be done.
Thank you.

[smira]

I think crane should be able to do that as part of some of the commands, but once again there's no point in arch for a single-arch image. When pushing multi-arch, crane can correctly combine and label images.

https://github.com/google/go-containerregistry/tree/main/cmd/crane