--cache-from: keep history comments deterministic (emit a static placeholder instead of the cache image reference)

Summary

For reproducible builds, --source-date-epoch + --rewrite-timestamp make timestamps deterministic. However, when a stage/layer is restored from a --cache-from cache image, a reference to that cache image can end up in a history entry's comment. Because cache image references (names/digests) can vary between builds (cold cache vs warm cache), this makes the resulting image config non-deterministic.

This is an enhancement / feature request rather than a bug report: the build output is functionally correct; only the determinism of the history metadata is affected.

Detail

• The issue affects non-squashed images, which preserve the build history, so the cache reference survives into the final image. For squashed images it is moot: squash clears the inherited history and writes a single fresh entry.

• The likely write site is the FROM-comment assembly in buildHistory (image.go):

  go复制

  fromComment += "FROM " + mb.i.fromImageName

  When the parent is a cache-restored image, mb.i.fromImageName is the cache image reference, so the comment becomes FROM <cache image reference>.

Proposal

When the parent is known to be a cache image, emit a static placeholder instead of the cache image reference, e.g.:

fromComment += "FROM build cache image"

so the comment, and therefore the image config, stays deterministic across builds.

Context

• Arose in a reproducible-builds pipeline using --source-date-epoch + --rewrite-timestamp together with --cache-from / --cache-to.
• Somehow related to the history-handling issues around --omit-history (#7037) and history-less base images (#7039)