Repository navigation
crane: push command erroring with "file manifest.json not found in tar" #2109
Description
Describe the bug
I am using buildkit to build my image and then using crane to authenticate to a registry and push the image.
Here are some docs about the buildctl build command, specifically, the output option.
The command I am running to build the image is:
buildctl build \
--frontend dockerfile.v0 \
--local context=. \
--local dockerfile=. \
--output type=oci,dest=my-image.tar
This creates a my-image.tar OCI tarball file in the current working directory.
I am then authenticating to a private AWS ECR using aws ecr get-login-password --region ${region} | crane auth login --username AWS --password-stdin ${ecrRegistryUrl}") and attempting to run crane push my-image.tar ${ecrRegistryUrl}/my-repo/my-image:latest, but I get an error: Error: loading my-image.tar as tarball: file manifest.json not found in tar
To Reproduce
- Install
buildkit/buildctlfor whatever OS you run. - Install
crane - Build an image using
buildctl build ...and make sure to save it as an OCI tarball using the flags--output type=oci,dest=my-image-tarball.tar - Attempt to push the image using
crane push
Expected behavior
I would expect the crane push to work is all.
Anything else
❯ crane version
0.20.5
Activity
Mo0rBy commentedon Jun 10, 2025
I did find this previous issue which seems related, but I don't really know how.
I also tried
--output type=taron mybuildctl buildcommand to see if that was any different, butcrane pushstill gives the same error with the .tar file produced from that too.Mo0rBy commentedon Jun 10, 2025
Tried some previous versions. I usually have stuff installed using HomeBrew, but previous package versions were not available for crane.
Instead I did
brew uninstall craneand installed previous versions usinggo install github.com/google/go-containerregistry/cmd/crane@<version>.I tried v0.19.2, v0.19.0 and v0.18.0 and they all gave me the same error.
I have also found this issue for the Trivy vulnerability scanning tool.
The conclusion for this was "Trivy doesn't support OCI tarballs yet", and there is some info stating that only Docker artifacts contain a
manifest.json, that file is not part of OCI compliance.Mo0rBy commentedon Jun 10, 2025
Ah yes, thats it!
Crane does not support OCI compliant tarballs I believe.
I ran
buildctl build ... --output type=docker,dest=my-imagewhich produces a file calledmy-imagein the working directory, and this can be successfully pushed bycrane push.I will leave this open for now so it gets seen as being able to work with OCI compliant tarballs seems fairly important IMHO, but I don't mind if it gets closed.
github-actions commentedon Sep 6, 2026
This issue is stale because it has been open for 90 days with no
activity. It will automatically close after 30 more days of
inactivity. Keep fresh with the 'lifecycle/frozen' label.