Github Container Registry Packages lists the architecture unknown/unknown when manifest attestations are present

[kirkbrauer]

Select Topic Area

Bug

Body

I recently noticed that packages that have been pushed to the container registry using docker buildx build now have a new architecture listed, unknown/unknown. After some further investigation, I discovered that what is happening is that the Docker Buildx CLI is including image attestations for these images, which seems harmless, but causes GitHub Packages to list the unknown/unknown arch used for these attestations under the "OS / Arch" tab. This is similar to another topic recently posted, but this is more of a UI bug rather than an issue inspecting or pulling the manifests.

The current behavior means that if you push an image for linux/arm64 and linux/amd64, you'll get three architectures listed, linux/arm64, linux/amd64, and unknown/unknown. The unknown/unknown arch has a hash listed, but that is not shown in the version list anywhere unless you dig deep to find it. This appears to inconsistent with what the Docker Hub shows, which, in this case, would be only two architectures linux/arm64 and linux/amd64.

The behavior that I expect is to see only the number of architectures I built, potentially with the additional metadata included under those hashes, but the unknown/unknown arch should not be listed anywhere since it is not a real architecture.

[jge162]

appears to be a UI bug in GitHub Packages

[ghost]

Take a look at docker/build-push-action#755. I was seeing the same issue. Pinning the build kit sorted it

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@15c905b16b06416d2086efa066dd8e3a35cc7f98
        with:
          driver-opts: 'image=moby/buildkit:v0.10.5'

[kirkbrauer]

Yes, you can also disable the attestations in the buildx output using the arguments: --provenance=false --sbom=false, this should work if you don't want to pin the version.

[cederberg]

Another (perhaps easier) way, is to just set an environment variable:

env:
  BUILDX_NO_DEFAULT_ATTESTATIONS: 1

https://docs.docker.com/build/building/env-vars/#buildx_no_default_attestations

[cgawron]

For images with an attestation, ghcr also does not display metadata – to me, this is actually more annoying than the additional unknown platform.

[alundiak]

If it's UI bug then I still have it in Jan-2024. And BUILDX_NO_DEFAULT_ATTESTATIONS: 1 didn't help to avoid unknown/unknown.
My config:

    strategy:
      matrix:
        os: [ubuntu-latest]
        arch: [x64, arm64, linux/arm64/v8]

which give mes linux/amd64 + unknown/unknown

PS. Source Setting proveance: false under uses: docker/build-push-action helped me to get rid of unknown/unknown BUT all other platforms also disappeared (looks like were build by GitHub Actions based on YAML config, but NOT shown on GitHub Package page).

BTw I used docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 version which 5.x version as Suggested GitHub Actions template.

[jimisola]

Any updates (solutions or workarounds) on this matter?

I'm generating linux/amd64 and linux/arm64 using matrix but only one shows up in ghcr packages and there is the additional "unknown/unknown" as well.

[krystof-k]

I ended up with this. Beside it still lists unknown/unknown it seems fine:

name: Build & push Docker image
on:
  workflow_dispatch:
  workflow_call:
    outputs:
      image:
        value: ${{ jobs.publish-manifest-list.outputs.image }}
env:
  DOCKER_REGISTRY: ghcr.io
jobs:
  build:
    name: Build Docker image
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    strategy:
      matrix:
        platform:
          - linux/amd64
          - linux/arm64
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3
        with:
          platforms: ${{ matrix.platform }}
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.DOCKER_REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Prepare Docker image name
        id: docker-image-name
        env:
          REPOSITORY: ${{ github.repository }}
        run: echo "value=${DOCKER_REGISTRY}/${REPOSITORY,,}" >> $GITHUB_OUTPUT
      - name: Build and push Docker image
        uses: docker/build-push-action@v5
        id: build-and-push-docker-image
        with:
          context: .
          platforms: ${{ matrix.platform }}
          outputs: type=registry,name=${{ steps.docker-image-name.outputs.value }},push-by-digest=true
          cache-from: type=gha,scope=buildkit-${{ matrix.platform }}
          cache-to: type=gha,mode=max,scope=buildkit-${{ matrix.platform }}
      - name: Export digest
        run: |
          mkdir -p /tmp/digests
          digest="${{ steps.build-and-push-docker-image.outputs.digest }}"
          touch "/tmp/digests/${digest#sha256:}"
      - name: Upload digest
        uses: actions/upload-artifact@v3
        with:
          name: digests
          path: /tmp/digests/*
          if-no-files-found: error
          retention-days: 1
  publish-manifest-list:
    name: Publish Docker manifest list
    runs-on: ubuntu-latest
    permissions:
      packages: write
    needs:
      - build
    outputs:
      image: ${{ steps.retrieve-image.outputs.value }}
    steps:
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.DOCKER_REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Prepare Docker metadata
        uses: docker/metadata-action@v5
        id: docker-metadata
        with:
          images: ${{ env.DOCKER_REGISTRY }}/${{ github.repository }}
          tags: |
            type=ref,event=branch
            type=ref,event=pr
            type=sha
          flavor: |
            latest=true
      - name: Download digests
        uses: actions/download-artifact@v3
        with:
          name: digests
          path: /tmp/digests
      - name: Prepare Docker image name
        id: docker-image-name
        env:
          REPOSITORY: ${{ github.repository }}
        run: echo "value=${DOCKER_REGISTRY}/${REPOSITORY,,}" >> $GITHUB_OUTPUT
      - name: Create and push manifest list
        run: |
          docker buildx imagetools create \
            $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
            $(printf '${{ steps.docker-image-name.outputs.value }}@sha256:%s ' $(ls /tmp/digests)) \
      - name: Retrieve image
        id: retrieve-image
        run: echo "value=$(echo "$DOCKER_METADATA_OUTPUT_JSON" | jq -r '.tags[1]')" >> $GITHUB_OUTPUT
      - name: Inspect image
        run: |
          docker buildx imagetools inspect ${{ steps.retrieve-image.outputs.value }}