on macOS using containerd, nerdctl build can not use local base images

[mbalmer]

Actual Behavior

When creating a base image using e.g. FROM ubuntu in a Dockerfile, then this locally create image can not be used as a base image for other images.

Steps to Reproduce

Create a local image using nerdctl build. The in a second Dockerfile, use the local image a base image using FROM.

e.g.

Dockerfile 1: FROM ubuntu

nerdctl build -t ab/cd .

Dockerfile 2: FROM ab/cd

nerdctl build -t xyz .

Result

=> ERROR [internal] load metadata for docker.io/smp/mqlua:dev 1.5s

[internal] load metadata for docker.io/smp/mqlua:dev:

Dockerfile:6

4 | ARG tag= 5 |
6 | >>> FROM ${registry}mqlua:${tag} AS mqlua 7 |
8 | LABEL maintainer=" info@xxxx"

error: failed to solve: smp/mqlua:dev: pull access denied, repository does not exist or may require authorization: server message: insufficient_scope: authorization failed FATA[0001] unrecognized image format
make: *** [api] Error 1

Expected Behavior

nerdctl build should be able to use local images as base images.

Additional Information

No response

Rancher Desktop Version

1.4.1

Rancher Desktop K8s Version

1.23.8

Which container runtime are you using?

containerd (nerdctl)

What operating system are you using?

macOS

Operating System / Build Version

macOS Monterey Version 12.4

What CPU architecture are you using?

x64

Linux only: what package format did you use to install Rancher Desktop?

No response

Windows User Only

No response

[jandubois]

This is likely due to buildkitd looking for the image in the buildkitd namespace and not in default. This should be configured via buildkitd.toml.

[adamkpickering]

I can reproduce this on Linux (Pop OS 20.04). I wasn't able to get the error to go away by switching back and forth between dockerd and containerd, or by doing a factory reset. However, it does work fine when using dockerd.

I tried what Jan suggested: I set worker.containerd.namespace = "default" in /etc/buildkit/buildkitd.toml in the RD VM. This seems to have gotten me further, but not all the way:

adam@velma [~/dev/test/nerdctl/two]$ nerdctl build --tag test-two .
[+] Building 1.5s (5/6)
 => [internal] load .dockerignore                                                                                                                                                                               0.0s
 => => transferring context: 2B                                                                                                                                                                                 0.0s
 => [internal] load build definition from Dockerfile                                                                                                                                                            0.0s
 => => transferring dockerfile: 89B                                                                                                                                                                             0.0s
 => [internal] load metadata for docker.io/library/test-one:latest                                                                                                                                              0.9s
 => ERROR [1/2] FROM docker.io/library/test-one:latest@sha256:1d8c4a889069c837f77de356bd97eedfac0d1d2110e87b9eb8ff32b7abe7b418                                                                                  0.5s
 => => resolve docker.io/library/test-one:latest@sha256:1d8c4a889069c837f77de356bd97eedfac0d1d2110e87b9eb8ff32b7abe7b418                                                                                        0.5s
 => [internal] load build context                                                                                                                                                                               0.0s
 => => transferring context: 59B                                                                                                                                                                                0.0s
------
 > [1/2] FROM docker.io/library/test-one:latest@sha256:1d8c4a889069c837f77de356bd97eedfac0d1d2110e87b9eb8ff32b7abe7b418:
------
Dockerfile:1
--------------------
   1 | >>> FROM test-one:latest
   2 |
   3 |     COPY test.txt /root/test2.txt
--------------------
error: failed to solve: lease "uo0o73armecxi78vwjmy2wzi9": not found

[mbalmer]

I am at the exact same point now:

error: failed to solve: lease "q4vm8dpf22nmrk712icwwaqrb": not found

my /etc/buildkit/buildkit.toml file looks as follows:

debug = true

[worker.oci]
  enabled = false

[worker.containerd]
  enabled = true
  namespace = "default"

[mbalmer]

Just for the record: The problem also exists the new 1.5.0 version of rancherdesktop.

[Daniel-Nashed]

Is there any news about this issue? I am running into the same. The only solution so far is to load the image I need to build my new image into buildkit namespace.

Did anyone manage to tell nerdctl to look into another namespace for local images when building FROM a local image?

Does the setting in /etc/buildkit/buildkit.toml work for anyone here? And what did you exactly set and what needed to be restarted?

I am using Rancher desktop 1.7.0

The nerdctl client is still version 1.0. The project page has newer nerdctl versions already. Is there any way to update the nerdctl version and could this help?

Just downloading a newer nerdctl version manually doesn't sound like a good idea.

Any additional help to work-around or correctly configure it, would be really appreciated.