Unable to update with watchtower

[stanthewizzard]

Hello

Apparently there is an issue with buildx

You should pin the buildx version to v0.9.1 to fix your images (Example: cilium/cilium#23206)

Thanks

[elrido]

What is broken in the images and which image and tag specifically do you have an issue with?

[stanthewizzard]

This may be due to the recent buildx change due to the Github Ubuntu Runner being upgraded:

docker/build-push-action#755

This results in images being pushed whose manifests cannot be parsed due to these issues:

moby/moby#43126

docker/buildx#1509

I didn't get time to verify via the API for a failing image (https://github.com/AnalogJ/scrutiny, specifically the collector) but the docker manifest inspect command does fail for it and docker buildx imagetools inspect shows that it's an oci image.

[stanthewizzard]

Apparently it's also possilbe to do that:

No need to pin to previous release v0.9.1, repo can just disable provenance as shown in docker/buildx#1513 (comment)

Also OCI images are around for a few years now so I think Watchtower should support them instead.

[stanthewizzard]

From
docker/buildx#1513 (comment)

This is a build option so in build-push-action:

• name: Build and push
  uses: docker/build-push-action@v3
  with:
  push: true
  provenance: false
  tags: user/app:latest
  Or if you invoke buildx directly then docker buildx build --provenance false ....

[elrido]

Thank you for providing more details. If I understand correctly, the images themselves would work, even though they are now stored in a different format, but the manifest created by docker buildx now contains information that docker (on the clients) can't parse (docker manifest inspect command), which in turn prevents watchtower from finding the updated image. Reading the linked issues, it certainly sounds like disabling the "provinence" in our buildx command would be a feasible workaround till the various tools have sorted themselves out.

docker-nginx-fpm-alpine/buildx.sh

Lines 24 to 30 in 7a8d0cd

	docker buildx build \
	--platform linux/amd64,linux/386,linux/arm/v6,linux/arm/v7,linux/arm64,linux/ppc64le \
	--pull \
	--no-cache \
	--push \
	$@ \
	.

[elrido]

Let me know if this works out after the nightly build at midnight (UTC) pushes the next image.

[stanthewizzard]

I'll check
thanks

[stanthewizzard]

And it works no more warning. Thanks 👍🏻