https://peng.fyi/tags/containers/ Recent content in Containers on Hugo -- gohugo.io en map[name:Peng Zhang] map[name:Peng Zhang] Peng Zhang Thu, 11 Jun 2026 00:00:00 +0000 https://peng.fyi/post/when-enforcing-image-spec-broke-customer-containers/ Thu, 11 Jun 2026 00:00:00 +0000 map[name:Peng Zhang] https://peng.fyi/post/when-enforcing-image-spec-broke-customer-containers/ A container platform shipped a change to detect CPU architecture mismatches at image pull time. If an image's config says arm64 but the host is amd64, fail fast instead of letting the container start and die with exec format error. The implementation is correct, tests passed and reviewers approved. However, it caused a production impact and a quick rollback. It turns out customers had been running mislabeled images for years. The existing code is permissive: it uses the architecture in image manifest (single-arch) or manifest index (multi-arch) as a hint to pull the image.