多架构Docker镜像拉取后推送私有仓库失败问题求助

我在GitLab CI/CD流水线中使用docker buildx构建多架构Docker镜像，推送至GitLab容器仓库的staging目录完成漏洞扫描并符合安全合规标准后，尝试将镜像推送到dev和production仓库时遇到报错。

错误日志 #

####################################
Pushing Docker Manifest (alpine_ci:1243060338)...
docker push registry.gitlab.com/warpit/foundation/warp-ci/dev/alpine_ci:1243060338
The push refers to repository [registry.gitlab.com/warpit/foundation/warp-ci/dev/alpine_ci]
missing content: content digest sha256:20ca4eb37ffdd4345c836ba3e5c0c3df8fd8121cc9b6cc73910b8b52eac65e74: not found
Note: You're trying to push a manifest list/index which references multiple platform specific manifests, but not all of them are available locally or available to the remote repository.
Make sure you have all the referenced content and try again.
Cleaning up project directory and file based variables
00:00
ERROR: Job failed: exit code 1

当前推送脚本流程 #

我的push CI任务执行的bash脚本流程如下：

• 登录GitLab容器仓库
• 拉取前一个build任务推送至staging的多架构镜像
• 为该镜像打上指向dev或production仓库的新标签
• 执行docker push命令推送新标签镜像

验证情况 #

我理解错误提示的含义，但无法定位问题原因——拉取镜像后我通过docker manifest inspect -v命令验证，发现报错中提到的缺失digest（sha256:20ca4eb37ffdd4345c836ba3e5c0c3df8fd8121cc9b6cc73910b8b52eac65e74）确实存在，相关验证输出片段如下：

####################################
Inspecting Docker Manifest (alpine_ci:1243060338)...
docker manifest inspect -v registry.gitlab.com/warpit/foundation/warp-ci/staging/alpine_ci:1243060338

{
        "Ref": "registry.gitlab.com/warpit/foundation/warp-ci/staging/alpine_ci:1243060338@sha256:20ca4eb37ffdd4345c836ba3e5c0c3df8fd8121cc9b6cc73910b8b52eac65e74",
        "Descriptor": {
            "mediaType": "application/vnd.oci.image.manifest.v1+json",
            "digest": "sha256:20ca4eb37ffdd4345c836ba3e5c0c3df8fd8121cc9b6cc73910b8b52eac65e74",
            "size": 840,
            "platform": {
                "architecture": "unknown",
                "os": "unknown"
            }
        },
        "Raw": "ewogICJzY2hlbWFWZXJzaW9uIjogMiwKICAibWVkaWFUeXBlIjogImFwcGxpY2F0aW9uL3ZuZC5vY2kuaW1hZ2UubWFuaWZlc3QudjEranNvbiIsCiAgImNvbmZpZyI6IHsKICAgICJtZWRpYVR5cGUiOiAiYXBwbGljYXRpb24vdm5kLm9jaS5pbWFnZS5jb25maWcudjEranNvbiIsCiAgICAiZGlnZXN0IjogInNoYTI1Njo1OWEyNzEyOGJmMGYxYjIxNmFkZmFjMmFkYjY3YzBhNjgzNzFiODdlZDcwODMyNTlhNDAzOWY2NjE5YmQyNDRiIiwKICAgICJzaXplIjogMjQxCiAgfSwKICAibGF5ZXJzIjogWwogICAgewogICAgICAibWVkaWFUeXBlIjogImFwcGxpY2F0aW9uL3ZuZC5pbi10b3RvK2pzb24iLAogICAgICAiZGlnZXN0IjogInNoYTI1NjoxMzc2Yzg1NjdkNDI2NWIwY2EzY2NkNDEwMmJiODA4NDQxZDdjYmM5ZWM2MGE4OWY0OTZlNmZiMjM1NzRjMzE3IiwKICAgICAgInNpemUiOiA1NzQ2ODc3LAogICAgICAiYW5ub3RhdGlvbnMiOiB7CiAgICAgICAgImluLXRvdG8uaW8vcHJlZGljYXRlLXR5cGUiOiAiaHR0cHM6Ly9zcGR4LmRldi9Eb2N1bWVudCIKICAgICAgfQogICAgfSwKICAgIHsKICAgICAgIm1lZGlhVHlwZSI6ICJhcHBsaWNhdGlvbi92bmQuaW4tdG90bytqc29uIiwKICAgICAgImRpZ2VzdCI6ICJzaGEyNTY6NjVmMDUzYmI2ZmQ3NmU3NjA0YjRiMGJhM2E3Mjc0N2UzNWY5N2UyNGFmYjAzMjkwNmNkNmFlZjgxODUxOGFkMyIsCiAgICAgICJzaXplIjogMTM1MywKICAgICAgImFubm90YXRpb25zIjogewogICAgICAgICJpbi10b3RvLmlvL3ByZWRpY2F0ZS10eXBlIjogImh0dHBzOi8vc2xzYS5kZXYvcHJvdmVuYW5jZS92MC4yIgogICAgICB9CiAgICB9CiAgXQp9",
        "OCIManifest": {
            "schemaVersion": 2,
            "mediaType": "application/vnd.oci.image.manifest.v1+json",
            "config": {
                "mediaType": "application/vnd.oci.image.config.v1+json",
                "digest": "sha256:59a27128bf0f1b216adfac2adb67c0a68371b87ed7083259a4039f6619bd244b",
                "size": 241
            },
            "layers": [
                {
                    "mediaType": "application/vnd.in-toto+json",
                    "digest": "sha256:1376c8567d4265b0ca3ccd4102bb808441d7cbc9ec60a89f496e6fb23574c317",
                    "size": 5746877,
                    "annotations": {
                        "in-toto.io/predicate-type": "https://spdx.dev/Document"
                    }
                },
                {
                    "mediaType": "application/vnd.in-toto+json",
                    "digest": "sha256:65f053bb6fd76e7604b4b0ba3a72747e35f97e24afb032906cd6aef818518ad3",
                    "size": 1353,
                    "annotations": {
                        "in-toto.io/predicate-type": "https://slsa.dev/provenance/v0.2"
                    }
                }
            ]
        }
    }
]

已知临时方案 #

目前我已知两种临时解决方法，但均非理想方案：

1. 在push脚本中重新构建镜像并推送；
2. 让build任务单独构建各架构镜像，push任务拉取所有架构镜像后自行生成manifest再推送。

核心疑问 #

我有以下两个核心疑问：

1. 能否详细解释该错误的具体原因，并给出针对性修复方案？
2. 是否支持直接拉取多架构镜像、打标签后推送至新仓库？如果可以，我的操作哪里存在错误？

另外，我尚未测试的方案是：用for循环结合docker pull --platform拉取所有架构的镜像，再拉取manifest后尝试推送，后续会更新测试结果。

内容的提问来源于stack exchange，提问作者Zach Thill