From 022316fca6d98b05841d8600c7245f052bed2677 Mon Sep 17 00:00:00 2001 From: rcourtman Date: Sun, 2 Aug 2026 12:31:53 +0100 Subject: [PATCH] Name both digests when a container update preflight refuses The digest-drift refusal only said the digest no longer matched, which left no way to tell a genuine plan/image drift from a comparison bug (#1666 shipped refusals on every classic-overlay2 host for exactly that reason, and the report had to correlate image stores to get close). Include the planned digest plus the local image id and repo digest in the refusal so the action record itself carries the evidence. Contract-Neutral: agent preflight refusal message detail only; no payload or schema change, error stays within the existing 1024-byte bounded field --- internal/dockeragent/container_update_typed.go | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/internal/dockeragent/container_update_typed.go b/internal/dockeragent/container_update_typed.go index 0f83688089..26dfc8d122 100644 --- a/internal/dockeragent/container_update_typed.go +++ b/internal/dockeragent/container_update_typed.go @@ -34,16 +34,21 @@ func (a *Agent) TypedContainerUpdate(ctx context.Context, runtime, containerID, localImageID := strings.TrimSpace(inspect.Image) matchesLocalID := strings.EqualFold(localImageID, expectedImageDigest) matchesRepoDigest := false + repoDigest := "" if !matchesLocalID { imageName := "" if inspect.Config != nil { imageName = inspect.Config.Image } - repoDigest, _, _, _ := a.getImageRepoDigest(ctx, localImageID, imageName) - matchesRepoDigest = strings.EqualFold(strings.TrimSpace(repoDigest), expectedImageDigest) + repoDigest, _, _, _ = a.getImageRepoDigest(ctx, localImageID, imageName) + repoDigest = strings.TrimSpace(repoDigest) + matchesRepoDigest = strings.EqualFold(repoDigest, expectedImageDigest) } if !matchesLocalID && !matchesRepoDigest { - return agentexec.DockerContainerUpdateOutcome{}, fmt.Errorf("container image digest no longer matches the planned update") + if repoDigest == "" { + repoDigest = "unavailable" + } + return agentexec.DockerContainerUpdateOutcome{}, fmt.Errorf("container image digest no longer matches the planned update (expected %s, local image id %s, local repo digest %s)", expectedImageDigest, localImageID, repoDigest) } }