buildx: Default image output in buildx v0.10 cannot be pushed to Yandex Cloud Container Registry

exporting to image
exporting manifest sha256:633baadaa74008615f4fd0d19eba63a696a847c6ec3b7058a883204418b68192 0.0s done
exporting config sha256:77db7689ffdb022a9a9d03ccf73f86aa17f2c4ecd7103e6440c5495df7fc20f6 done
exporting attestation manifest sha256:4d8160c1d02c9276d0a44f813f9ffe7006754e7b160da44c716b956d43b97a53 0.0s done exporting manifest list sha256:c16a5d9f9dabeaf910344ed6a032bc53841b88dc44a51869ff94204ae53488e done
pushing layers
pushing layers 14.4s done
pushing manifest for registry.url/namspace/image:bb8432e8cce2b213e21251732c7d3edcb7c58d3@sha256:c16a5d99dabeaf910344ed6a032bc53841b838dc44a51869ff94204ae53488e 0.1s done
ERROR: failed to push registry.url/namspace/image:bb8432e8cce2b213e21251732c7d3edcb7cb58d3: failed commit on ref "manifest-sha256:633baadaa74008615f4fd0d19eba63a696a847c6ec3b7058a883204418b68": unexpected status: 400 Bad Request

buildx failed with: ERROR: failed to solve: failed to push <registry_url>/<namespace>/<imagename>:341aa798b8365346c3e32b2024bb62d99652f4a6: failed commit on ref "manifest-sha256:d6d1f20cd9c061daec67cf71af16544bae42f4f1652bb0771d78c6ad8cc8b336": unexpected status: 400 Bad Request

Below are the steps:

  - name: Checkout repository
    uses: actions/checkout@v3
  - name: Set up Docker Buildx
    uses: docker/setup-buildx-action@v2
  - name: Login to DockerHub
    uses: docker/login-action@v2
    with:
      registry: ${{ env.DOCKER_REGISTRY }}
      username: ${{ secrets.DOCKER_USERNAME }}
      password: ${{ secrets.DOCKER_PASSWORD }}
  - name: Build and push
    uses: docker/build-push-action@v3
    with:
      context: .
      file: ./tools/path/Dockerfile
      push: true
      tags: ${{ env.DOCKER_REGISTRY }}/${{ env.DOCKER_NAMESPACE }}/${{ env.DOCKER_IMAGE }}:${{ env.GITHUB_SHA }}
      outputs: type=image,oci-mediatypes=true,push=true

About this issue

Original URL
State: open
Created a year ago
Reactions: 2
Comments: 38 (9 by maintainers)

Commits related to this issue

Disable provenence per https://github.com/docker/buildx/issues/1513#issuecomment-1398340039 Signed-off-by: Adam Warner <me@adamwarner.co.uk> — committed to pi-hole/docker-pi-hole by PromoFaux a year ago
Disable provenance in the build-push-action https://github.com/docker/buildx/issues/1513#issuecomment-1398340039 — committed to shartge/testssl-web by shartge a year ago
Disable provenence per https://github.com/docker/buildx/issues/1513#issuecomment-1398340039 (#172) Workaround to opt-out of unsupported manifest until it's supported. Fix is from: https://github.com/... — committed to deconz-community/deconz-docker by niawag a year ago
Disable provenance in the build-push-action Context: docker/buildx#1513 (comment) — committed to devzwf/pihole-dot-doh by devzwf a year ago

Most upvoted comments

After GitHub Actions updated Ubuntu image (actions/runner-images/pull/6942, buildx was upped to v.0.10.0) — I get same error.

If I lock buildx version to v0.9.1 by action docker/setup-buildx-action@v2 it works well.

I use cr.yandex container registry. It is Yandex Cloud Container Registry.

langovoi on Jan 20, 2023

@crazy-max I tested cr.yandex with provenance: false in docker/build-push-action@v3 and removed pin to v0.9.1 in docker/setup-buildx-action@v2.

It works.

langovoi on Jan 20, 2023

Returning to buildx v0.10.0 and using the undocumented --provenance false option also fixes our issue. Will this option be documented or is intentionally undocumented?

😱 oops, yup, that’s an oversight, I’ve PRed some docs in.

I’ve attached the buildkit log. One discrepancy I noted is the logs mention request.header.user-agent=buildkit/v0.11 while the output of docker buildx version is github.com/docker/buildx v0.10.0-docker 876462897612d36679153c3414f7689626251501

Version mismatch is because buildkit and buildx releases do not necessarily line up. It’s slightly unfortunate they’re so close to each other, since it means it’s easy to mistake one for the other - but this is expected, those are both part of the latest release series for their respective projects.

jedevc on Feb 6, 2023

Clear. I’ll try that block, as the buildx command is generated by code, and I currently don’t have access to that part. I’ll keep you posted

pimvandenbroek on Jan 20, 2023

@pimvandenbroek This is a build option so in build-push-action:

      -
        name: Build and push
        uses: docker/build-push-action@v3
        with:
          push: true
          provenance: false
          tags: user/app:latest

Or if you invoke buildx directly then docker buildx build --provenance false ....

Not sure, I will have to test.

Please that would help thx!

crazy-max on Jan 20, 2023