ko only builds one platform when -L is specified

[marcintustin]

I'm building with

KO_CONFIG_PATH=ko.yaml KO_DOCKER_REPO='repo.artifactory.prod.gcp.bvnt.co/federated-docker-rase/cubestoredumper' ko build --bare --tags=9715bf2e-dirty --sbom=none -L --platform linux/amd64,linux/arm64

The base image brings these labels in

            "Labels": {
                "dev.chainguard.image.title": "go",
                "dev.chainguard.package.main": "go-1.24",
                "org.opencontainers.image.authors": "Chainguard Team https://www.chainguard.dev/",
                "org.opencontainers.image.base.digest": "sha256:9ab908e8995d90f23d96dffc1590e4ab0bb7940c61c94014bfca89f479f52bec",
                "org.opencontainers.image.created": "2025-12-09T16:15:39Z",
                "org.opencontainers.image.source": "https://github.com/chainguard-images/images-private/tree/main/images/go",
                "org.opencontainers.image.title": "go",
                "org.opencontainers.image.url": "https://images.chainguard.dev/directory/image/go/overview",
                "org.opencontainers.image.vendor": "Chainguard"
            },

But docker image inspect shows only one platform:

[
    {
        "Id": "sha256:55cf2c1b5ee0725c6b466c6605508b9d379680531fd108c16ffbfc1c7c9c68c1",
        "RepoTags": [
            "repo.artifactory.prod.gcp.bvnt.co/federated-docker-rase/cubestoredumper:9715bf2e-dirty",
            "repo.artifactory.prod.gcp.bvnt.co/federated-docker-rase/cubestoredumper:aa38f729dbf58476563e6149bafe458b6f6540aebc5f7a63e14783ac0b097037",
            "repo.artifactory.prod.gcp.bvnt.co/federated-docker-rase/cubestoredumper:tf-awb-project-9715bf2e-dirty"
        ],
        "RepoDigests": [
            "repo.artifactory.prod.gcp.bvnt.co/federated-docker-rase/cubestoredumper@sha256:55cf2c1b5ee0725c6b466c6605508b9d379680531fd108c16ffbfc1c7c9c68c1"
        ],
        "Parent": "",
        "Comment": "go build output, at /ko-app/cubestoredumper",
        "Created": "0001-01-01T00:00:00Z",
        "DockerVersion": "",
        "Author": "github.com/ko-build/ko",
        "Architecture": "amd64",
        "Os": "linux",
        "Size": 286740208,

Is there something I'm missing to get this all together as one image?

I've tried with v0.17.1 and v0.18.1

[imjasonh]

Can you run

crane manifest repo.artifactory.prod.gcp.bvnt.co/federated-docker-rase/cubestoredumper | jq .mediaType

If the response is:

• ..application/vnd.oci.image.manifest.v1+json then it means the image you're building on top of is only a single-architecture image. When asked to build on top of a single-arch image, ko can only build a single-arch image for that platform.
• ...application/vnd.oci.image.index.v1+json then it means the image you're building on top of is a multi-arch image, and ko should be able to build for the requested architectures. If that's the case, I'd be curious about the results of crane manifest chainguard/static | jq ".manifests[].platform" which would tell us what platforms that base image has. If it has both requested platforms, that might indicate a bug in ko, but this is something I use ko for regularly without issue.

I suspect that the image you're building on top of only provides a single architecture, and that's why ko is only building a single-arch image on top of it.

[marcintustin]

@imjasonh Here are those outputs. repo.artifactory.prod.gcp.bvnt.co/federated-docker-infra/armed-atk/infrastructure/golden-images/golang/chainguard-1.24:v5 is the base.

~/dev/repos/scimitar/tools/cubestorescraper 🌳preaggmaker-resume-harder$ crane manifest repo.artifactory.prod.gcp.bvnt.co/federated-docker-rase/cubestorescraper:tf-awb-staging-030646e5 | jq .mediaType
"application/vnd.docker.distribution.manifest.v2+json"
~/dev/repos/scimitar/tools/cubestorescraper 🌳preaggmaker-resume-harder$ crane manifest repo.artifactory.prod.gcp.bvnt.co/federated-docker-infra/armed-atk/infrastructure/golden-images/golang/chainguard-1.24:v5 | jq .mediaType
"application/vnd.docker.distribution.manifest.list.v2+json"
~/dev/repos/scimitar/tools/cubestorescraper 🌳preaggmaker-resume-harder$ crane manifest repo.artifactory.prod.gcp.bvnt.co/federated-docker-infra/armed-atk/infrastructure/golden-images/golang/chainguard-1.24:v5 | jq ".manifests[].platform"
{
  "architecture": "amd64",
  "os": "linux"
}
{
  "architecture": "arm64",
  "os": "linux"
}
~/dev/repos/scimitar/tools/cubestorescraper 🌳preaggmaker-resume-harder$ 

here's my ko.yaml

defaultBaseImage: repo.artifactory.prod.gcp.bvnt.co/federated-docker-infra/armed-atk/infrastructure/golden-images/golang/chainguard-1.24:v5
builds:
- id: cubestorescraper
  dir: .
  env:
    - GOPROXY=direct
  ldflags:
    - -s -w
  flags:
    - -trimpath
  main: .
  # Specify the image repository
  image: federated-docker-rase/cubestorescraper

# Platform-specific settings
defaultPlatforms:
  - linux/amd64
  - linux/arm64

[marcintustin]

Also, it looks like I don't have this problem if I leave off the -L flag

[imjasonh]

Ah that's the issue!

When building from a multi arch base image, then loading it into your docker daemon, you end up with only the platform you're running on.

There might be a way to convince docker to load the multi arch image, but afaik you won't be able to run anything but the native platform.

If you want to build a multi arch image, I recommend publishing it to a remote registry, where the details of your local platform will be inconsequential.