Unable to pull local multi-arch images built with containerd-snapshotter

[ResRipper]

I found that the scanner doesn't use the image that was built and loaded from the previous step.

While the image is loaded into the runner, the scanner will always try to look for it in the registry, whether I specify the image by using the digest or the tag format.

• Digest format

  • Workflow file
  • Log
  

• Tag format

  • Workflow file
  • Log
  

Related:

• Failed to fetch locally built image scan-action#171

[kzantow]

I'm a little unclear why the digest doesn't work if you are not pushing. If you are pushing, this will change the digest returned and the local won't be found. I don't know enough about the build and push action to understand if there is something else going on that might be related to this and cause it not to work. I don't see the output digest being used; maybe add a docker ls ${{ steps.image-builder.outputs.digest }} and verify it's present locally after the build as you expect.

The tag-based workflow you reference should work to find resripper/shadowsocks-rust:latest, but if you look in the workflow log, there is some redaction: ***/shadowsocks-rust:latest, so it's unclear of this value is actually restripper/shadowsocks-rust:latest or something else. Assuming you have a secret of resripper which is causing some redaction, I wonder if Github is applying this somewhere other than just the logs, causing this issue. Can you try this without this secret causing these redactions? This value is clearly in your workflow, so already public.

[ResRipper]

it's unclear of this value is actually restripper/shadowsocks-rust:latest or something else.

The redaction was due to the DOCKERHUB_USERNAME secret, so GitHub automatically redacted every string that matched it. Since the scanning step will only succeed if the specified image tag already exists on Docker Hub, I'm confident that the value specified in the workflow file was used.

---

So I did some tests with no secrets used, and found out that the issue seems related to the containerd-snapshotter feature (Workflow file):

If the containerd-snapshotter feature which required for exporting multi-architecture image is enabled, the scan will fail (enabled, disabled), with log shows unable to find the image, even when I manually specify the target image platform in CLI:

docker: pull failed: Error response from daemon: manifest for resripper/shadowsocks-rust:test not found: manifest unknown: manifest unknown