containerd / containerd/nerdctl

Push requires `--all-platforms` to support the attestation content created by BuildKit >= 0.11

Open
#2,100 1 comment 0 reactions 1 assignee Claimed by @manugupt1 View on GitHub
enhancement
Dominant language
Go
Stars
10.4k
Forks
826
Avg merge
1d 23h
Merged PRs (30d)
44

Description

### Description

[This line](https://github.com/containerd/nerdctl/blob/main/pkg/cmd/image/push.go#L93) will cause attestation data to be discarded and the index created by BuildKit to be reduced to a single manifest image of just the image for the current platform. Given the comment this looks like it was to save confusion for those pulling an image (without pulling all platforms) and then getting an error on push because all the index contents weren't locally available.

It nerdctl wants to support BuildKit attestation seamlessly, this code will have to see if the index actually contains additional platform content versus containing a single image with additional artifacts (like an image manifest with the `vnd.docker.reference.type` annotation set to `attestation-manifest` that BuildKit 0.11 and above creates)

### Steps to reproduce the issue

1. Build a simple `Dockerfile` that creates an image in the local cache
2. Use `nerdctl push` to push this to a registry; note that the output mentions "pushing as a reduced-platform image"
3. Inspect the image in the registry to see that no attestation data is available with the image

### Describe the results you received and expected

Should preserve the attestation data created by BuildKit when pushing images

### What version of nerdctl are you using?

nerdctl 1.2.1

### Are you using a variant of nerdctl? (e.g., Rancher Desktop)

None

### Host information

Host information is not applicable to this issue

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.