exporter: containerimage: Add an option to unlazy image blobs

[ktock]

Some blobs in the result image can be lazy (i.e. not existing in the local content store).
This doesn't allow non-buildkit containerd clients (e.g. ctr, nerdctl, ...) fetching the resulting image from containerd.
Unpack doesn't solve this because it only unlazies the default platform of the image.

# mkdir -p /tmp/ctx && cat <<EOF > /tmp/ctx/Dockerfile
FROM ubuntu:20.04
CMD echo hello
EOF
# buildctl build --progress=plain --frontend=dockerfile.v0 \
               --local context=/tmp/ctx --local dockerfile=/tmp/ctx \
               --opt platform=linux/amd64,linux/arm64 \
               --output=type=image,unpack=true,name=foo
# ctr image export --all-platforms /tmp/out3.tar foo
ctr: failed to get reader: content digest sha256:185e8a4c100571f111d924b5d4399d89f163bf95d71ce2c6a33f656a66c52f0a: not found

This commit fixes this by adding a new option ensure-blobs to containerimage exporter.
This option unlazies blobs of the build result.

[AkihiroSuda]

"locally" needs to be explained

[ktock]

Thank you for the comment. Fixed the explanation to "exist in the content store" instead of "locally available".

[tonistiigi]

Why do we need the extra key? Don't we always need to run this when exporting images to containerd?

[ktock]

@tonistiigi Thank you for the comment. This is because tests require blobs being lazy even after exporting it with type=image,push=true https://github.com/moby/buildkit/runs/6000088966?check_suite_focus=true

[tonistiigi]

If it creates a broken image in containerd then it looks wrong. Maybe we need an option that would allow to push the image without adding it to the containerd image store. In that case blobs could remain lazy.

[ktock]

an option that would allow to push the image without adding it

It won't pass some tests like testLazyImagePush which performs the check using lazy images in the image store.
How about making ensure-blobs=true the default behaviour when a client creates an image in the image store?

[tonistiigi]

Maybe better would be store=false that would skip saving image to the image store.

[ktock]

Added store option. I think this should be store=true by default for keeping the backward-compatibility of type=image behaviour.

https://github.com/moby/buildkit#containerd-image-store

The containerd worker needs to be used
buildctl build ... --output type=image,name=docker.io/username/image
ctr --namespace=buildkit images ls

[tonistiigi]

the worker's (e.g. containerd)

[ktock]

Fixed this.

[tonistiigi]

I don't think we need "store-allow-incomplete" as it creates broken images that can't be pushed or extracted. The user has the option to store with blobs or not store at all.

If it is only for tests (and there is no other way), then prefix with unsafe-internal-

[ktock]

Added unsafe-internal- prefix.