Skip to content

fix: disable buildx attestations to prevent orphan parent index in GCR #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
teriusu-ko wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix: disable buildx attestations to prevent orphan parent index in GCR #1

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 15 additions & 1 deletion main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -163,7 +163,21 @@ func run(cfg *config) error {
}

logStep(cfg, "Building Docker...")
if err := runCommandStreaming(cfg.workdir, "docker", "build", "--platform", "linux/amd64", "-t", imageTag, "."); err != nil {
// Use `docker buildx build` with provenance/SBOM attestations disabled so the
// pushed artifact is a single image manifest rather than an OCI image index
// that references separate attestation manifests. When attestations are on
// (the BuildKit default since Docker 23+), GCR ends up with an orphan parent
// index that holds references to the child manifest, which then causes
// `gcloud container images delete` during cleanup to fail with:
// "Manifest is still referenced by one or more parent images".
if err := runCommandStreaming(cfg.workdir, "docker", "buildx", "build",
"--platform", "linux/amd64",
"--provenance=false",
"--sbom=false",
"--load",
"-t", imageTag,
".",
); err != nil {
return fmt.Errorf("docker build: %w", err)
}

Expand Down