containerd / containerd/nerdctl
Push requires `--all-platforms` to support the attestation content created by BuildKit >= 0.11
- Dominant language
- Go
- Stars
- 10.4k
- Forks
- 826
- Avg merge
- 1d 23h
- Merged PRs (30d)
- 44
Description
### Description
[This line](https://github.com/containerd/nerdctl/blob/main/pkg/cmd/image/push.go#L93) will cause attestation data to be discarded and the index created by BuildKit to be reduced to a single manifest image of just the image for the current platform. Given the comment this looks like it was to save confusion for those pulling an image (without pulling all platforms) and then getting an error on push because all the index contents weren't locally available.
It nerdctl wants to support BuildKit attestation seamlessly, this code will have to see if the index actually contains additional platform content versus containing a single image with additional artifacts (like an image manifest with the `vnd.docker.reference.type` annotation set to `attestation-manifest` that BuildKit 0.11 and above creates)
### Steps to reproduce the issue
1. Build a simple `Dockerfile` that creates an image in the local cache
2. Use `nerdctl push` to push this to a registry; note that the output mentions "pushing as a reduced-platform image"
3. Inspect the image in the registry to see that no attestation data is available with the image
### Describe the results you received and expected
Should preserve the attestation data created by BuildKit when pushing images
### What version of nerdctl are you using?
nerdctl 1.2.1
### Are you using a variant of nerdctl? (e.g., Rancher Desktop)
None
### Host information
Host information is not applicable to this issue
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.