Docker pull from gh packages fail with "no matching manifest for linux/amd64"

[abelsromero]

Tried to pull from packages page and the following error is shown from Linux x86_64 machine.

/github/docker-asciidoctor >>> docker pull ghcr.io/asciidoctor/asciidoctor:cache                                                                                                                                                                                                                                                          ±[●●][add-image-cve-scan]
cache: Pulling from asciidoctor/asciidoctor
no matching manifest for linux/amd64 in the manifest list entries

[dduportal]

Hello @abelsromero , the official distribution channel is the DockerHub. We are using the ghcr repository for a temporary cache only, not sur if we can mask the « packages » page though.

[abelsromero]

But still, the command should work right? It seems like maybe some metadata is not 100% accurate and DockerHub (which works) is making some fix under-the-hood.

[dduportal]

Never tried to pull the image directly, as I expect it to be fully managed by Docker Buildx.

As you can see here: https://github.com/asciidoctor/docker-asciidoctor/blob/main/docker-bake.hcl#L28-L30 , the pull.push part is managed by the cache engine of BuildX.

I have the same error as you when trying to pull the image: my gut feeling is that buildx only pushes the layers without a manifest (because there is no need to).

What is the goal you would want to achieve by pulling this image directly?

[abelsromero]

Related to #224, my first plan was pulling from cache to avoid network issues with dockerhub. But that's no longer the approach now.

[dduportal]

Oh I see, thanks for explaining!

It might also be interesting to check for vulnerabilities in the cache image if we do it on the final image (ref. supply chain attacks...).

When you say that you had netork issue with the dockerhub, was it during the build, or during usage of the final image?
I'm asking because we could publish the final image on both Dockerhub and GitHub quite easily since buildx and the bake file allows that.
If it us during the "build", it might be more complicated to improve though (since we rely on official and trusted images from DockerHub...).

Also, is the usage of docker buildx an obstacle for you?

[dduportal]

Closing as "obsolete". Feel free to reopen with details if you still have the problem.