run the integration suite against docker 29.6.1

[mzihlmann]

docker 29.5.2 is the last version where --provenance=false alone gets buildkit to emit a dockerv2 manifest. On 29.6.1 that flag only drops the attestation and leaves an OCI manifest behind, so every test whose oracle has to match a dockerv2 image kaniko produced started diverging on the manifest format. The mediatype is now selected explicitly with --output=type=image,oci-mediatypes=false. provenance stays off next to it because buildkit refuses to export attestations once docker mediatypes are pinned.

The bump also exposes mz922 in Dockerfile_test_copyadd_chmod. buildkit now applies ADD --chmod to the destination directory it creates, kaniko still subtracts the umask there, so /dir777 comes out 0755 against docker's 0777. That divergence is ignored per test until mz922 is fixed.

Summary by CodeRabbit

• Tests

  • Updated integration test coverage for stop-signal and healthcheck scenarios.
  • Improved image comparison reliability for tests involving file permissions and Docker manifest formats.

• Chores

  • Updated the Docker version used by integration test workflows.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 367f0007-ed8f-438b-9c43-a252bb39affd

📥 Commits

Reviewing files that changed from the base of the PR and between 96e5a63 and 2d8fc57.

📒 Files selected for processing (2)

• .github/workflows/integration-tests.yaml
• integration/images.go

---

📝 Walkthrough

Walkthrough

The integration workflow now uses Docker 29.7.0. Integration image tests use shared Docker v2 BuildKit flags, cover stop-signal and healthcheck cases, and ignore an expected directory-mode difference.

Changes

Docker compatibility updates

Layer / File(s)	Summary
Docker runtime version .github/workflows/integration-tests.yaml	The integration workflow installs Docker 29.7.0 instead of 29.5.2.
Integration image output handling integration/images.go	Affected tests use shared flags that disable provenance and force Docker v2 media types. The diffoci comparison ignores the expected dir777/ mode difference.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• osscontainertools/kaniko#808: Both modify integration test Docker and Kaniko invocation flags.
• osscontainertools/kaniko#847: Both modify Docker output flags and diffoci comparison exceptions.
• osscontainertools/kaniko#943: Both configure Docker and BuildKit flags for image-format compatibility tests.

Suggested labels: tests

Suggested reviewers: 0hlov3, babs

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch tests-oci-mediatypes

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!