Docker buildx交叉编译时无法找到本地libs镜像问题排查

我需要交叉编译两个Docker镜像：libs和devicemanager，其中devicemanager依赖libs镜像。使用以下命令可成功构建libs镜像：

$ docker buildx build --platform linux/arm/v7 --rm --file ./Dockerfile --tag libs:latest --load ..

但执行以下命令构建devicemanager时出现权限错误：

$ docker buildx build --platform linux/arm/v7 --rm --file ./Dockerfile --tag devicemanager:latest --load ..

错误输出 #

[+] Building 0.5s (4/4) FINISHED                                                                                                                                                                            
 => [internal] load build definition from Dockerfile                                                                                                                                                   0.2s
 => => transferring dockerfile: 2.18kB                                                                                                                                                                 0.0s
 => [internal] load .dockerignore                                                                                                                                                                      0.1s
 => => transferring context: 164B                                                                                                                                                                      0.0s
 => CANCELED [internal] load metadata for docker.io/library/alpine:3.16.0                                                                                                                              0.2s
 => ERROR [internal] load metadata for docker.io/library/libs:latest                                                                                                                                   0.2s
------
 > [internal] load metadata for docker.io/library/libs:latest:
------
Dockerfile:2
--------------------
   1 |     # STAGE 1 - Pre-built libs
   2 | >>> FROM libs:latest as libs-dev
   3 |     
   4 |     # STAGE 2 - BUILD
--------------------
ERROR: failed to solve: libs:latest: pull access denied, repository does not exist or may require authorization: server message: insufficient_scope: authorization failed

devicemanager的Dockerfile内容 #

# STAGE 1 - Pre-built libs
FROM libs:latest as libs-dev

# ...

补充信息 #

使用标准docker build命令构建原生架构镜像时一切正常，执行docker images可确认libs:latest已成功构建。以下是libs:latest的构建日志：

[+] Building 32.8s (56/56) FINISHED                                                                                                                                                                         
 => [internal] load .dockerignore                                                                                                                                                                      0.2s
 => => transferring context: 164B                                                                                                                                                                      0.0s
 => [internal] load build definition from Dockerfile                                                                                                                                                   0.2s
 => => transferring dockerfile: 3.58kB                                                                                                                                                                 0.0s
 => [internal] load metadata for docker.io/library/alpine:3.16.0                                                                                                                                       0.4s
 => [stage-1  1/36] FROM docker.io/library/alpine:3.16.0@sha256:686d8c9dfa6f3ccfc8230bc3178d23f84eeaf7e457f36f271ab1acc53015037c                                                                       0.2s
 => => resolve docker.io/library/alpine:3.16.0@sha256:686d8c9dfa6f3ccfc8230bc3178d23f84eeaf7e457f36f271ab1acc53015037c                                                                                 0.1s
 => [internal] load build context                                                                                                                                                                      0.2s
 => => transferring context: 25.04kB                                                                                                                                                                   0.0s
 => CACHED [stage-1  2/36] RUN apk update && apk add bash                                                                                                                                              0.0s
 => CACHED [stage-1  3/36] RUN apk add libgcc                                                                                                                                                          0.0s
 => CACHED [stage-1  4/36] RUN apk add --no-cache libstdc++                                                                                                                                            0.0s
 => CACHED [stage-1  5/36] RUN apk add valgrind                                                                                                                                                        0.0s
 => CACHED [stage-1  6/36] RUN apk add --no-cache python3                                                                                                                                              0.0s
 => CACHED [stage-1  7/36] RUN apk add --no-cache py3-pip                                                                                                                                              0.0s
 => CACHED [stage-1  8/36] RUN apk add valgrind                                                                                                                                                        0.0s
 => CACHED [libs-dev  2/15] RUN apk add --no-cache coreutils gcc g++ cargo linux-headers make musl-dev git     rust clang-libs pkgconf                                                                 0.0s
 => CACHED [libs-dev  3/15] COPY /lib_cfu/ /lib_cfu/                                                                                                                                                   0.0s
 => CACHED [libs-dev  4/15] RUN cd /lib_cfu &&     make                                                                                                                                                0.0s
 => CACHED [libs-dev  5/15] COPY /lib_mxml/ /lib_mxml/                                                                                                                                                 0.0s
 => CACHED [libs-dev  6/15] RUN cd /lib_mxml &&     ./configure                                                                                                                                        0.0s
 => CACHED [libs-dev  7/15] RUN cd /lib_mxml &&     make                                                                                                                                               0.0s
 => CACHED [libs-dev  8/15] COPY /lib_googletest/ /lib_googletest/                                                                                                                                     0.0s
 => CACHED [libs-dev  9/15] COPY /lib_permissions/ /lib_permissions/                                                                                                                                   0.0s
 => CACHED [libs-dev 10/15] COPY /lib_revars/ /lib_revars/                                                                                                                                             0.0s
 => CACHED [libs-dev 11/15] RUN cd /lib_revars &&     make                                                                                                                                             0.0s
 => CACHED [libs-dev 12/15] COPY /lib_devserver/ /lib_devserver/                                                                                                                                       0.0s
 => CACHED [libs-dev 13/15] RUN cd /lib_devserver &&     make                                                                                                                                          0.0s
 => CACHED [libs-dev 14/15] COPY /lib_rtpc/ /lib_rtpc/                                                                                                                                                 0.0s
 => CACHED [libs-dev 15/15] RUN cd /lib_rtpc &&     make                                                                                                                                               0.0s
 => CACHED [stage-1  9/36] COPY --from=libs-dev /lib_cfu/*.a /lib_cfu/                                                                                                                                 0.0s
 => CACHED [stage-1 10/36] COPY --from=libs-dev /lib_mxml/*.a /lib_mxml/                                                                                                                               0.0s
 => CACHED [stage-1 11/36] COPY --from=libs-dev /lib_revars/hiredis/*.a /lib_revars/hiredis/                                                                                                           0.0s
 => CACHED [stage-1 12/36] COPY --from=libs-dev /lib_revars/src/*.a /lib_revars/src/                                                                                                                   0.0s
 => CACHED [stage-1 13/36] COPY --from=libs-dev /lib_revars/perf/revars_perf /lib_revars/                                                                                                              0.0s
 => CACHED [stage-1 14/36] COPY --from=libs-dev /lib_revars/test/revars_test /lib_revars/                                                                                                              0.0s
 => CACHED [stage-1 15/36] COPY --from=libs-dev /lib_revars/gtest/gtest_revars_tests /lib_revars/                                                                                                      0.0s
 => CACHED [stage-1 16/36] COPY --from=libs-dev /lib_cfu/*.so /usr/local/lib/                                                                                                                          0.0s
 => CACHED [stage-1 17/36] COPY --from=libs-dev /lib_mxml/*.so /usr/local/lib/                                                                                                                         0.0s
 => CACHED [stage-1 18/36] COPY --from=libs-dev /lib_revars/hiredis/*.so /usr/local/lib/                                                                                                               0.0s
 => CACHED [stage-1 19/36] COPY --from=libs-dev /lib_revars/src/*.so /usr/local/lib/                                                                                                                   0.0s
 => CACHED [stage-1 20/36] COPY --from=libs-dev /lib_devserver/src/*.a /lib_devserver/src/                                                                                                             0.0s
 => CACHED [stage-1 21/36] COPY --from=libs-dev /lib_devserver/gtest/gtest_devserver_basic /lib_devserver/                                                                                             0.0s
 => CACHED [stage-1 22/36] COPY --from=libs-dev /lib_devserver/demo/devserver_pdm /lib_devserver/                                                                                                      0.0s
 => CACHED [stage-1 23/36] COPY --from=libs-dev /lib_devserver/demo/devserver_cdm /lib_devserver/                                                                                                      0.0s
 => CACHED [stage-1 24/36] COPY --from=libs-dev /lib_rtpc/*.a /lib_rtpc/                                                                                                                               0.0s
 => CACHED [stage-1 25/36] COPY --from=libs-dev /lib_rtpc/*.so /lib_rtpc/                                                                                                                              0.0s
 => CACHED [stage-1 26/36] COPY --from=libs-dev /lib_rtpc/*.so.* /lib_rtpc/                                                                                                                            0.0s
 => CACHED [stage-1 27/36] COPY --from=libs-dev /lib_rtpc/cfg/*.xml /lib_rtpc/                                                                                                                         0.0s
 => CACHED [stage-1 28/36] COPY --from=libs-dev /lib_cfu/*.h /usr/local/include/libcfu/                                                                                                                0.0s
 => CACHED [stage-1 29/36] COPY --from=libs-dev /lib_devserver/inc/*.h /usr/local/include/devserver/                                                                                                   0.0s
 => CACHED [stage-1 30/36] COPY --from=libs-dev /lib_googletest/googlemock/include/gmock/*.h /usr/local/include/googletest/gmock/                                                                      0.0s
 => CACHED [stage-1 31/36] COPY --from=libs-dev /lib_googletest/googletest/include/gtest/*.h /usr/local/include/googletest/gtest/                                                                      0.0s
 => CACHED [stage-1 32/36] COPY --from=libs-dev /lib_mxml/mxml.h /usr/local/include/mxml/                                                                                                              0.0s
 => CACHED [stage-1 33/36] COPY --from=libs-dev /lib_permissions/inc/*.h /usr/local/include/permissions/                                                                                               0.0s
 => CACHED [stage-1 34/36] COPY --from=libs-dev /lib_revars/inc/*.h /usr/local/include/revars/                                                                                                         0.0s
 => CACHED [stage-1 35/36] COPY --from=libs-dev /lib_rtpc/inc/*.h /usr/local/include/rtpc/                                                                                                             0.0s
 => CACHED [stage-1 36/36] WORKDIR /lib_revars                                                                                                                                                         0.0s
 => exporting to oci image format                                                                                                                                                                     31.7s
 => => exporting layers                                                                                                                                                                               12.4s
 => => exporting manifest sha256:e53ff18b9b24f584ea9b8abe40e795a90c9e024d0ef96b742967019242979d2a                                                                                                      0.1s
 => => exporting config sha256:f193534c0a56fb75c73d2f4cb78dd6349587ba574c5390e1ab7214d21ed19994                                                                                                        0.1s
 => => sending tarball                                                                                                                                                                                19.0s
 => importing to docker

原因分析 #

Docker Buildx的默认构建器运行在隔离的容器环境中，不会直接访问本地Docker daemon中的镜像仓库。当执行FROM libs:latest时，Buildx会尝试从公共Docker Hub拉取该镜像，而非使用本地已构建的版本，因此触发权限错误。而原生docker build命令直接调用本地daemon的镜像，所以能正常依赖libs:latest。

解决方法 #

方法一：使用--build-context指定本地镜像 #

构建devicemanager时，通过参数明确指定本地libs:latest作为构建上下文：

$ docker buildx build --platform linux/arm/v7 --rm --file ./Dockerfile --tag devicemanager:latest --load --build-context libs=docker-image://libs:latest ..

同时修改devicemanager的Dockerfile，引用该上下文：

# STAGE 1 - Pre-built libs
FROM libs as libs-dev

# ...

方法二：推送至本地私有仓库 #

将libs:latest推送到本地私有镜像仓库，然后在Dockerfile中使用完整仓库地址（如localhost:5000/libs:latest），Buildx即可正确拉取本地镜像。

方法三：创建本地Buildx构建器 #

创建一个直接使用本地Docker daemon的Buildx构建器：

$ docker buildx create --use --name local-builder --driver docker-container

此方式需确保构建器配置正确，相比--build-context步骤更繁琐。

内容的提问来源于stack exchange，提问作者vmishel