Unable to use dynamic build property

[wvanderdeijl]

What happened?

When the build property to the Image resource is dynamic a pulumi preview fails since all command line arguments appear to be missing. This means our custom foo.Dockerfile is not being used and docker tries to use the default Dockerfile resulting in the following error:

Previewing update (skunkteam/dev)

View in Browser (Ctrl+O): https://app.pulumi.com/skunkteam/docker/dev/previews/053b8fb3-47c5-4c1c-956d-070192fa0953

     Type                        Name        Plan       Info
 +   pulumi:pulumi:Stack         docker-dev  create     
 +   ├─ random:index:RandomUuid  guid        create     
     └─ docker:index:Image       image                  1 error


Diagnostics:
  docker:index:Image (image):
    error: could not open dockerfile at relative path Dockerfile: stat Dockerfile: no such file or directory

Expected Behavior

pulumi preview should not fail.

Steps to reproduce

Full example at https://github.com/wvanderdeijl/docker-pulumi-issue

import * as docker from "@pulumi/docker";
import { interpolate, output } from "@pulumi/pulumi";
import * as random from '@pulumi/random';

const apiKey = new random.RandomUuid('guid', {}).result

new docker.Image(
    'image',
    {
        imageName: 'eu.gcr.io/my-project/foo:v1.0.0',
        build: {
            dockerfile: interpolate`./foo.Dockerfile`,
            platform: 'linux/arm64',
            args: {
                KEY: apiKey,
            },
        },
        skipPush: true,
    },
);

Output of pulumi about

CLI
Version 3.65.1
Go Version go1.20.3
Go Compiler gc

Plugins
NAME VERSION
docker 4.2.0
nodejs unknown
random 4.13.0

Host
OS darwin
Version 13.3.1
Arch arm64

This project is written in nodejs: executable='/Users/*****/.nvm/versions/node/v16.17.1/bin/node' version='v16.17.1'

Backend
Name pulumi.com
URL https://app.pulumi.com/*****
User *****
Organizations *****, *****

Dependencies:
NAME VERSION
@pulumi/docker 4.2.0
@pulumi/pulumi 3.65.1
@pulumi/random 4.13.0
@types/node 16.18.25

Pulumi locates its logs in /var/folders/16/6r7yw0gd7593qv1z1zsp6xbh0000gn/T/ by default
warning: Failed to get information about the current stack: No current stack

Additional context

When running a pulumi preview or pulumi up with --logtostderr --logflow -v=9 2> out.txt we can see in the logging that the build property is now a simple output<string> meaning the information for dockerfile (and platform) have been lost:

I0502 15:17:55.251320   89165 log.go:75] Unmarshaling property for RPC[ResourceMonitor.RegisterResource(docker:index/image:Image,image)]: build=output<string>{}
I0502 15:17:55.251336   89165 log.go:75] Unmarshaling property for RPC[ResourceMonitor.RegisterResource(docker:index/image:Image,image)]: imageName={eu.gcr.io/my-project/foo:v1.0.0}
I0502 15:17:55.251339   89165 log.go:75] Unmarshaling property for RPC[ResourceMonitor.RegisterResource(docker:index/image:Image,image)]: skipPush={true}

Contributing

Vote on this issue by adding a 👍 reaction.
To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).

[wvanderdeijl]

We tried creating a fake Dockerfile that would be used during preview die to this bug. But build.context is also lost when build.args contains a dynamic output due to this bug. This means the current workdir (project root) is used as context which means the hash is calculated over the entire 21GB workspace. And it does that for 15+ docker images in the same pulumi stack resulting in over 1 hour for a pulumi preview.

[AaronFriel]

Hey @wvanderdeijl thanks for reporting this. I can suggest a workaround to try here:

import * as docker from "@pulumi/docker";
import { interpolate, output, runtime } from "@pulumi/pulumi";
import * as random from '@pulumi/random';

const apiKey = new random.RandomUuid('guid', {}).result

if (!runtime.isDryRun()) {
    new docker.Image(
        'image',
        {
            imageName: 'eu.gcr.io/my-project/foo:v1.0.0',
            build: {
                dockerfile: interpolate`./foo.Dockerfile`,
                platform: 'linux/arm64',
                args: {
                    KEY: apiKey,
                },
            },
            skipPush: true,
        },
    );
}

This will skip evaluating the Docker.Image during previews, ensuring that the apiKey is known during the deployment ("up") phase.

If this works for you, let us know - we may file a follow up issue to track improving preview behavior.

[wvanderdeijl]

That's a great tip. I'm now using that in a slightly different way. Still creating the docker.Image resource during preview but without the dynamic arguments. Otherwise the preview would show that the Image resource would be deleted. I've then added {dependsOn:apiKey} to explicitly define the dependency during preview.