Push image from cache without context

[t0rr3sp3dr0]

On a CI/CD pipeline is common to have an image built in a job and just on another job the image is pushed to the registry, between jobs you can have artifacts pushed and pulled. This can be accomplished by using docker save and docker load when working with single-arch images, but it's not possible to export multi-arch images to an artifact that can be reloaded later.

If you share the cache contents between jobs, you can use docker buildx build --push --cache-from to push the image to the registry without having to rebuild the images. But this only works if you also share the exact same context that was used to build the image originally, and that is not always possible.

Given that, there should be a way to push the layers on cache without having to rely on the context to do it.

[tonistiigi]

Not sure I understand. If your cache is not valid anymore because context/source has changed then it is correct that it will not be loaded. If you want to just use the previously built image without validating if it is correct for current source, then just push/pull the image, not the cache.

[t0rr3sp3dr0]

I'm not able to move the image between jobs as none of the outputs of buildx, except docker, are able to be reloaded later and pushed by the CLI.

Here is an example of what I want to accomplish:

Computer 1

• build image
• output some artifact

Computer 2

• load artifact from Computer 1
• push the image to the registry

My first thought was that the artifact that both computers have access could be the cache, but indeed it doesn't make sense as it was invalided by the lack of the original context.

After some research, I found that buildx is able to export the image as an OCI tarball by running:
docker buildx build --platform linux/arm64,linux/amd64 --output type=oci,dest=oci.tar .

But the problem is that there is way to push this tarball to the registry using buildx, there is no docker buildx push command.

[klutchell]

I'm having the exact same issue with caching in a format that can be loaded and pushed in a different context. Did you have any luck finding a workaround?

[t0rr3sp3dr0]

@klutchell, I was able to accomplish the scenario I described using skopeo copy (https://github.com/containers/skopeo#copying-images) to push OCI images to the registry.

Unfortunately, there is still no way to push these images using just the Docker CLI and you have to install Skopeo on your CI/CD environment.

[klutchell]

Thanks for getting back to me, I also found skopeo as a possibility so we may have to go that route as well.