#17458 New default of `pull=True` on `docker_image` target breaks use of transitive base images Issue created by danxmoran Describe the bug (Sorry for the wordy title, couldn't think of a better way to put it) In our repo, we have a "base"

Dockerfile

containing common build steps. It's a lightweight image, so we don't push it anywhere - instead, all images that use it build off of it using:

ARG BASE=src/infra/docker/color-base-python:color-base-python
FROM $BASE

On Pants 2.14, if I

./pants package some/top-level/Dockerfile

then Pants will see the

FROM

dependency and build

src/infra/docker/color-base-python

first. When trying out Pants 2.15.0a0 this no longer happens, so the top-level

package

fails with:

#3 [internal] load metadata for <http://docker.io/color/color-base-python:latest|docker.io/color/color-base-python:latest>
#3 ERROR: pull access denied, repository does not exist or may require authorization: server message: insufficient_scope: authorization failed
------
 > [internal] load metadata for <http://docker.io/color/color-base-python:latest|docker.io/color/color-base-python:latest>:
------
ERROR: failed to solve: rpc error: code = Unknown desc = failed to solve with frontend dockerfile.v0: failed to create LLB definition: pull access denied, repository does not exist or may require authorization: server message: insufficient_scope: authorization failed

./pants dependencies

of the top-level image still shows

src/infra/docker/color-base-python:color-base-python

so dependency inference still works, but something in the sequencing of

docker build

commands has broken. Pants version v2.15.0a0 OS Both Additional info https://app.toolchain.com/organizations/color/repos/color/builds/pants_run_2022_11_03_12_17_40_671_7f0821ce4406484b85bbbd6bf52264e0/type/goal/?subTab=package pantsbuild/pants

#17458 New default of `pull=True` on `docker_image` target breaks use of transitive base images Issue closed as completed by stuhood pantsbuild/pants