[BUG] Melange fails to saving OCI image locally when using docker runner on MacOS

System Specifications

CPU: Apple M4 Pro
Arch: aarch64
Docker Desktop: v4.40.0 (187762)

Melange version:

❯ melange version
...
GitVersion:    v0.23.5
GitCommit:     unknown
GitTreeState:  unknown
BuildDate:     unknown
GoVersion:     go1.24.2
Compiler:      gc
Platform:      darwin/arm64

Description

While running tests using make test/<package> in WolfiOS.

MELANGE_EXTRA_OPTS="--log-level=debug --runner=docker" make test/jq

Melange fails to save OCI image locally with docker runner with the following log:

2025/04/10 14:54:12 DEBU docker daemon response: {"status":"Loading layer","progressDetail":{"current":98304,"total":7644644},"progress":"[\u003e                                                  ]   98.3\n{"errorDetail":{"message":"lsetxattr /usr/bin/jq: xattr \"com.docker.grpcfuse.ownership\": operation not supported"},"error":"lsetxattr /usr/bin/jq: xattr \"com.docker.grpcfuse.ownership\": operation n\n supported"}

The error changes slightly when different VMMs (Docker VMM, Apple Virtualization framework, QEMU (Legacy)) and file sharing implementations (VirtioFS, gRPC FUSE, osxfs) are used.

Example:

2025/04/10 16:16:43 DEBU docker daemon response: {"status":"Loading layer","progressDetail":{"current":98304,"total":7643959},"progress":"[\u003e                                                  ]   98.3\n{"errorDetail":{"message":"lsetxattr /usr: xattr \"com.apple.provenance\": operation not supported"},"error":"lsetxattr /usr: xattr \"com.apple.provenance\": operation not supported"}4b9"}

Here the error is "error":"lsetxattr /usr: xattr \"com.apple.provenance\": operation not supported" instead of "error":"lsetxattr /usr/bin/jq: xattr \"com.docker.grpcfuse.ownership\": operation n\n supported"

It fails to run with all the other combinations that I tried.

QEMU runner works fine for this. This command works MELANGE_EXTRA_OPTS="--log-level=debug --runner=qemu" make test/jq

Start with the Makefile test/ target and the Docker runner entry point, reproducing make test/jq with MELANGE_EXTRA_OPTS="--log-level=debug --runner=docker" on macOS. Compare the Docker-runner failure with the working QEMU command and inspect the debug response around OCI image loading. Done means the Docker runner saves and loads the local OCI image without the reported xattr errors.