push-image.sh built and pushed the per-arch tags, then failed to combine them:
ERROR: gitea.langenoja.se/zegit-zoo/zegit-forgejo-runner:12.11.1-ci6-amd64 is a manifest list
docker manifest create refuses a source that is itself a manifest list. With Dockers containerd image store, docker build --platform linux/amd64 produces an OCI index rather than a plain manifest, so both per-arch tags are lists and the combine step cannot work at all on such a host.
The failure mode is the expensive one: it happens AFTER both multi-hundred-MB pushes succeed, and it leaves the per-arch tags published while the plain tag — the one both runner Deployments reference — does not exist. imagetools inspect ...:12.11.1-ci6 returned "not found" while the -amd64/-arm64 tags were present.
docker buildx imagetools create accepts indexes as sources and combines registry-side, so it works with either image store. Confirmed live: running it by hand against the already-pushed per-arch tags produced 12.11.1-ci6 successfully.
Verification also improves: it now reads back with imagetools inspect and asserts linux/amd64 AND linux/arm64 specifically, instead of counting two distinct architecture strings — which would have been satisfied by any two arches.
Assumptions and decisions:
Kept the per-arch build-and-push loop; only the combine and verify steps change. The loop works and is not implicated.
No /etc/hosts pin is needed for the combine: a manifest push is small JSON, and the Cloudflare body cap only affects blob uploads, which have already happened by then.
Risk: low, and self-verifying — if the combine fails the script now dies with the inspect output rather than reporting success.
push-image.sh built and pushed the per-arch tags, then failed to combine them:
ERROR: gitea.langenoja.se/zegit-zoo/zegit-forgejo-runner:12.11.1-ci6-amd64 is a manifest list
`docker manifest create` refuses a source that is itself a manifest list. With Dockers containerd image store, `docker build --platform linux/amd64` produces an OCI index rather than a plain manifest, so both per-arch tags are lists and the combine step cannot work at all on such a host.
The failure mode is the expensive one: it happens AFTER both multi-hundred-MB pushes succeed, and it leaves the per-arch tags published while the plain tag — the one both runner Deployments reference — does not exist. `imagetools inspect ...:12.11.1-ci6` returned "not found" while the -amd64/-arm64 tags were present.
`docker buildx imagetools create` accepts indexes as sources and combines registry-side, so it works with either image store. Confirmed live: running it by hand against the already-pushed per-arch tags produced 12.11.1-ci6 successfully.
Verification also improves: it now reads back with `imagetools inspect` and asserts linux/amd64 AND linux/arm64 specifically, instead of counting two distinct architecture strings — which would have been satisfied by any two arches.
Assumptions and decisions:
- Kept the per-arch build-and-push loop; only the combine and verify steps change. The loop works and is not implicated.
- No /etc/hosts pin is needed for the combine: a manifest push is small JSON, and the Cloudflare body cap only affects blob uploads, which have already happened by then.
Risk: low, and self-verifying — if the combine fails the script now dies with the inspect output rather than reporting success.
Agent-Session: c49e7dd9-2fb0-4501-8f80-264f8ef3a9b7
docker manifest create refuses a source that is itself a manifest list:
ERROR: ...:<tag>-amd64 is a manifest list
With Docker containerd image store, docker build --platform linux/amd64
produces an OCI index rather than a plain manifest, so BOTH per-arch tags are
lists and the combine fails — after the slow multi-hundred-MB pushes have
already succeeded. The failure mode is nasty: the per-arch tags are published
and the PLAIN tag, the one both Deployments reference, is absent. Hit on
12.11.1-ci6, 2026-08-31.
buildx imagetools create accepts indexes as sources and combines registry-side,
so it works with either image store. Verification switches to imagetools
inspect and now asserts both linux/amd64 and linux/arm64 specifically, rather
than counting two distinct architecture strings.
agent
marked the pull request as ready for review 2026-08-31 12:45:08 +00:00
markus
merged commit 48d5ccebdc into master2026-08-31 12:46:48 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
push-image.sh built and pushed the per-arch tags, then failed to combine them:
docker manifest createrefuses a source that is itself a manifest list. With Dockers containerd image store,docker build --platform linux/amd64produces an OCI index rather than a plain manifest, so both per-arch tags are lists and the combine step cannot work at all on such a host.The failure mode is the expensive one: it happens AFTER both multi-hundred-MB pushes succeed, and it leaves the per-arch tags published while the plain tag — the one both runner Deployments reference — does not exist.
imagetools inspect ...:12.11.1-ci6returned "not found" while the -amd64/-arm64 tags were present.docker buildx imagetools createaccepts indexes as sources and combines registry-side, so it works with either image store. Confirmed live: running it by hand against the already-pushed per-arch tags produced 12.11.1-ci6 successfully.Verification also improves: it now reads back with
imagetools inspectand asserts linux/amd64 AND linux/arm64 specifically, instead of counting two distinct architecture strings — which would have been satisfied by any two arches.Assumptions and decisions:
Risk: low, and self-verifying — if the combine fails the script now dies with the inspect output rather than reporting success.
Agent-Session: c49e7dd9-2fb0-4501-8f80-264f8ef3a9b7