full name with tags when used as context with platform results in unresolvable image

Start with the Dockerfile FROM cases and the buildctl commands in the report, comparing context resolution for chain/chain:abc and docker.io/chain/chain:abc with both oci-layout and docker-image contexts. Trace the image-name matching and platform resolution path; done means the fully qualified name resolves the supplied context instead of attempting an unauthorized registry pull.

Problem: passing a fully qualified image name to a context makes it unable to resolve, at least when passing the platform. Holds true for both oci-layout context and docker-image context.

For docker-image, I will just alias to docker.io/library/alpine:3.16; for oci-layout, I have a layout directory with just a few files in it. The important one is the OCI index, at /tmp/cache/blobs/sha256/bd04a5b26dec16579cd1d7322e949c5905c4742269663fcbc84dcb2e9f4592fb.

Single name, no qualifier or tags (works)

Create a Dockerfile:

FROM --platform=linux/amd64 chain as src

and try to build from it. It works:

$ image=chain
$ buildctl build --frontend dockerfile.v0 --output type=image,name=docker.io/foo/bar --local context=/tmp/build/b2 --local dockerfile=/tmp/build/b2 --opt context:${image}=oci-layout://dump@sha256:bd04a5b26dec16579cd1d7322e949c5905c4742269663fcbc84dcb2e9f4592fb --oci-layout dump=/tmp/cache
$ buildctl build --frontend dockerfile.v0 --output type=image,name=docker.io/foo/bar --local context=/tmp/build/b2 --local dockerfile=/tmp/build/b2 --opt context:${image}=docker-image://docker.io/library/alpine:3.16

Repo name with org (works)

I change the source image to chain/chain in the dockerfile and run again. That works:

FROM --platform=linux/amd64 chain/chain as src

$ image=chain/chain
$ buildctl build --frontend dockerfile.v0 --output type=image,name=docker.io/foo/bar --local context=/tmp/build/b2 --local dockerfile=/tmp/build/b2 --opt context:${image}=oci-layout://dump@sha256:bd04a5b26dec16579cd1d7322e949c5905c4742269663fcbc84dcb2e9f4592fb --oci-layout dump=/tmp/cache
$ buildctl build --frontend dockerfile.v0 --output type=image,name=docker.io/foo/bar --local context=/tmp/build/b2 --local dockerfile=/tmp/build/b2 --opt context:${image}=docker-image://docker.io/library/alpine:3.16

Org and repo with tag (works)

I change the source image to chain/chain:abc in the dockerfile and run again. That works.

FROM --platform=linux/amd64 chain/chain:abc as src

$ image=chain/chain:abc
$ buildctl build --frontend dockerfile.v0 --output type=image,name=docker.io/foo/bar --local context=/tmp/build/b2 --local dockerfile=/tmp/build/b2 --opt context:${image}=oci-layout://dump@sha256:bd04a5b26dec16579cd1d7322e949c5905c4742269663fcbc84dcb2e9f4592fb --oci-layout dump=/tmp/cache
$ buildctl build --frontend dockerfile.v0 --output type=image,name=docker.io/foo/bar --local context=/tmp/build/b2 --local dockerfile=/tmp/build/b2 --opt context:${image}=docker-image://docker.io/library/alpine:3.16

Fully qualified name (fails)

Finally, I fully qualify it to docker.io/chain/chain:abc in the dockerfile and run again. That blows up:

FROM --platform=linux/amd64 docker.io/chain/chain:abc as src

$ image=docker.io/chain/chain:abc
$ buildctl build --frontend dockerfile.v0 --output type=image,name=docker.io/foo/bar --local context=/tmp/build/b2 --local dockerfile=/tmp/build/b2 --opt context:${image}=oci-layout://dump@sha256:bd04a5b26dec16579cd1d7322e949c5905c4742269663fcbc84dcb2e9f4592fb --oci-layout dump=/tmp/cache
[+] Building 0.2s (4/4) FINISHED
 => [internal] load .dockerignore                                                                                                                          0.0s
 => => transferring context: 2B                                                                                                                            0.0s
 => [internal] load build definition from Dockerfile                                                                                                       0.0s
 => => transferring dockerfile: 99B                                                                                                                        0.0s
 => ERROR [internal] load metadata for docker.io/chain/chain:abc                                                                                           0.2s
 => [auth] chain/chain:pull token for registry-1.docker.io                                                                                                 0.0s
------
 > [internal] load metadata for docker.io/chain/chain:abc:
------
Dockerfile:1
--------------------
   1 | >>> FROM --platform=linux/amd64 docker.io/chain/chain:abc as src
   2 |
   3 |
--------------------
error: failed to solve: docker.io/chain/chain:abc: pull access denied, repository does not exist or may require authorization: server message: insufficient_scope: authorization failed
buildctl build --frontend dockerfile.v0 --output type=image,name=docker.io/foo/bar --local context=/tmp/build/b2 --local doc
kerfile=/tmp/build/b2 --opt context:${image}=docker-image://docker.io/library/alpine:3.16
[+] Building 0.2s (4/4) FINISHED
 => [internal] load build definition from Dockerfile                                                                                                       0.0s
 => => transferring dockerfile: 99B                                                                                                                        0.0s
 => [internal] load .dockerignore                                                                                                                          0.0s
 => => transferring context: 2B                                                                                                                            0.0s
 => ERROR [internal] load metadata for docker.io/chain/chain:abc                                                                                           0.2s
 => [auth] chain/chain:pull token for registry-1.docker.io                                                                                                 0.0s
------
 > [internal] load metadata for docker.io/chain/chain:abc:
------
Dockerfile:1
--------------------
   1 | >>> FROM --platform=linux/amd64 docker.io/chain/chain:abc as src
   2 |
   3 |
--------------------
error: failed to solve: docker.io/chain/chain:abc: pull access denied, repository does not exist or may require authorization: server message: insufficient_scope: authorization failed

Ignoring for a moment the fact that chain/chain:abc = docker.io/chain/chain:abc, why is this not accepting docker.io?