Can't load base image from local docker images without registry

[agirault]

Related threads

• follow-up from how to buid image using base image on local repo #301 (single-arch)
• similar to How to use base image from build cache of docker-container driver #1386 (multi-arch)

Issue

We call the following command as it is the recommended step to test a container image before pushing it to a registry:

$ docker buildx build --platform $SINGLEARCH -t my_base_image --load .

A single platform build result will be exported to docker images, as documented:

$ docker images --format '{{.Repository}}' | grep my_base_image
my_base_image

Consider then this simple file named final.dockerfile:

# syntax=docker/dockerfile:1
ARG BASE_IMAGE
FROM $BASE_IMAGE as base

We attempt to build this image using my_base_image as a base image with the command below:

docker buildx build --platform $SINGLEARCH -f final.dockerfile --build-arg BASE_IMAGE=my_base_image . 

Unlike docker build, this will attempt to reach a registry (docker.io/library if there isn't one in the tag name) without using the cached image in docker images:

> [$SINGLEARCH internal] load metadata for docker.io/library/my_base_image:latest:
------
final.dockerfile:3
--------------------
   1 |     # syntax=docker/dockerfile:1
   2 |     ARG BASE_IMAGE
   3 | >>> FROM $BASE_IMAGE as base
   4 |     
--------------------
ERROR: failed to solve: pull access denied, repository does not exist or may require authorization: server message: insufficient_scope: authorization failed

The issue is similar if there is a registry url in the image name:

ERROR: failed to solve: your_registry.io: not found

Using docker build instead of buildx is not possible when building for another platform than the host platform.

Questions

1. How do we use a docker image on the client (docker images) as a base image for a new single-arch buildx build?
2. If that's not possible from --load/--output=type=docker, can it be done with another client-side output type (local, tar, oci) without requiring a registry?
   • @jjlin suggested using a local registry here but it can open up other issues and might not be an acceptable solution for some

[crazy-max]

This is expected as your container builder does not have access to the docker store. This will be solved with the containerd snapshotter on docker, see docker/roadmap#371. This is also similar to #166. In the meantime you can push this image to a registry.

Also if you just want to build a single platform you can just use the default docker builder:

$ docker buildx use default
$ docker buildx build --platform linux/amd64 -t my_base_image .
$ docker buildx build --platform linux/amd64 -f final.dockerfile --build-arg BASE_IMAGE=my_base_image . 

[jiangtao69039]

I'm running into the same issue. Is there any solution now? @agirault

[jedevc]

This issue is a duplicate of moby/buildkit#2343, so I'm going to close this issue in preference of that one - that one also has more discussion there.