Push stable tags as plain images instead of manifest lists#253
Merged
Conversation
The `docker buildx imagetools create` command wraps the single-arch amd64 image in a manifest list, which prevents arm64 clients (e.g. Apple Silicon) from pulling it even with emulation. Switch back to docker pull/tag/push so stable tags behave the same as latest tags. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
skopeo copy preserves the original manifest format (plain single-arch image, no manifest list wrapping) and operates server-side without pulling the image locally. skopeo is pre-installed on ubuntu-latest. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Allows overriding the target tag (default: "stable") for testing promotions without affecting the real stable tags. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
tommartensen
approved these changes
May 19, 2026
Build Images
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
promote-stableworkflow useddocker buildx imagetools createto retag images as stable, which wraps the single-arch amd64 image in a manifest listskopeo copyfor a server-side retag that preserves the original plain image format without pulling locallytargetinput (defaults to "stable") for testing promotions without affecting real stable tagsTest
Ran the workflow on this branch with
target: stable-testand verified on an arm64 host:Same digest as
stackrox-test-latest(sha256:387346914505c40f2018b4c2194358320673c1a2ad0e511e368cae6a1b506f2f), pulls successfully with emulation instead of failing with "no matching manifest".🤖 Generated with Claude Code