Pulling an image with `application/octet-stream` config media type fails

• related to: https://github.com/containerd/containerd/issues/10628
• related to https://github.com/moby/moby/issues/52411

Description

Pulling an image like python:3.5.1-alpine (from 2015) which has a config with media type application/octet-stream fails.

That's not an expected format from the perspective of OCI/Docker spec, and looks to be caused by a bug in distribution: https://github.com/distribution/distribution/pull/1622

However, the graphdriver Docker is able to pull these images.
Also containerd has a "conversion" code that should be able to handle that image on the fly, but it looks like it's broken when used with WithPullUnpack (which we use https://github.com/moby/moby/blob/d8f079deb6d9faf6540b756baec42ede172cd53e/daemon/containerd/image_pull.go#L164 in order for remote snapshotters to work).

{
   "schemaVersion": 2,
   "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
   "config": {
      "mediaType": "application/octet-stream",
      "size": 4648,
      "digest": "sha256:1c7f1bf64dde149e36ffe0bcc0b9f1fbaeacc379dd80e4064c3a1e1f0b4b34b5"
   },
   "layers": [
      {
         "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
         "size": 2310286,
         "digest": "sha256:e110a4a1794126ef308a49f2d65785af2f25538f06700721aad8283b81fdfa58"
      },
      {
         "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
         "size": 20528388,
         "digest": "sha256:30dac23631f0219d44d2f43a5dbfb7ed47aa23e09abed01813510d0f64aa16af"
      },
      {
         "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
         "size": 258,
         "digest": "sha256:202fc3980a369fecd7f39c054b996e033347e441a500b9bb0dd03db6b9cc125c"
      }
   ]
}

Reproduce

$ docker pull python:3.5.1-alpine                                                                                                                                                                                                 
3.5.1-alpine: Pulling from library/python

What's next:
    View a summary of image vulnerabilities and recommendations → docker scout quickview python:3.5.1-alpine
failed to unpack image on snapshotter overlayfs: failed to extract layer sha256:4fe15f8d0ae69e169824f25f1d4da3015a48feeeeebb265cd2e328e15c6a869f: NotFound: failed to get reader from content store: content digest sha256:e110a4a1794126ef308a49f2d65785af2f25538f06700721aad8283b81fdfa58: not found

Expected behavior

No response

docker version

27.2.0

docker info

-

Additional Info

No response

Reproduce the failure with python:3.5.1-alpine on Docker 27.2.0, then read daemon/containerd/image_pull.go around the WithPullUnpack call. Compare the behavior with containerd issue 10628 and the related Moby issue 52411. Done means the image pulls and unpacks successfully despite its application/octet-stream config media type.