az confcom acipolicygenerate doesnt work for some images.

[tanaybaswa]

Describe the bug

The az confcom acigeneratepolicy command is not able to pull the image properly.

Related command

az confcom acipolicygenerate

Errors

Pulling and hashing images...: 0%| | 0/2 [00:00<?, ?percent/s]
Cannot get layer hashes
Pulling and hashing images...: 50%|▌| 1/2 [00:35<00:35, 35.59s/perc

Issue script & Debug output

This is an image showing my output.

Expected behavior

The expected behaviour is for the command to return with the base64 signature that can be used as the ccepolicy for the arm template.

Environment Summary

azure-cli 2.51.0

core 2.51.0
telemetry 1.1.0

Extensions:
confcom 0.2.15
containerapp 0.3.36

Dependencies:
msal 1.24.0b1
azure-mgmt-resource 23.1.0b2

Python location '/opt/az/bin/python3'
Extensions directory '/home/tanaybaswa/.azure/cliextensions'

Python (Linux) 3.10.10 (main, Jul 27 2023, 07:10:25) [GCC 11.3.0]

Legal docs and information: aka.ms/AzureCliLegal

Your CLI is up-to-date.

Additional context

No response

[yonzhan]

Thank you for opening this issue, we will look into it.

[microsoft-github-policy-service]

Thank you for your feedback. This has been routed to the support team for assistance.

[jsntcy]

@SethHollandsworth, could you please take a look at this issue?

[SethHollandsworth]

Hi @tanaybaswa, could you please provide more information on how big the image in the ARM template is and how much memory the machine running the az CLI has? I've seen this happen before where the machine runs out of memory while creating layer hashes, so the process gets killed. thanks!

The other time I saw this, increasing the memory on the VM running the az CLI fixed the issue. I'll work on making the error messaging clearer for this scenario.