performing build with provenance in step 4 fails to build with error.

[bjornhovd]

In step 4 when attempting to perform build v2 with with the provenance flag it fails with message that attestation is not supported for docker driver.
see message below:
docker build -t node-app:v2 --sbom=true --provenance=mode=max .
[+] Building 0.0s (0/0) docker:default
ERROR: failed to build: Attestation is not supported for the docker driver.
Switch to a different driver, or turn on the containerd image store, and try again.
Learn more at https://docs.docker.com/go/attestations/

[mikesir87]

Interesting. Can you do a docker system info from inside the Labspace environment and share your output?

[bjornhovd]

Client:
Version: 28.5.1
Context: default
Debug Mode: false
Plugins:
buildx: Docker Buildx (Docker Inc.)
Version: v0.28.0
Path: /home/coder/.docker/cli-plugins/docker-buildx
compose: Docker Compose (Docker Inc.)
Version: v2.39.4
Path: /home/coder/.docker/cli-plugins/docker-compose
mcp: Docker MCP Plugin (Docker Inc.)
Version: v0.21.0
Path: /home/coder/.docker/cli-plugins/docker-mcp
model: Docker Model Runner (Docker Inc.)
Version: v0.1.42
Path: /home/coder/.docker/cli-plugins/docker-model
scout: Docker Scout (Docker Inc.)
Version: v1.18.4
Path: /home/coder/.docker/cli-plugins/docker-scout

Server:
Containers: 27
Running: 11
Paused: 0
Stopped: 16
Images: 54
Server Version: 28.5.1
Storage Driver: overlay2
Backing Filesystem: extfs
Supports d_type: true
Using metacopy: false
Native Overlay Diff: true
userxattr: false
Logging Driver: json-file
Cgroup Driver: cgroupfs
Cgroup Version: 2
Plugins:
Volume: local
Network: bridge host ipvlan macvlan null overlay
Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
CDI spec directories:
/etc/cdi
/var/run/cdi
Discovered Devices:
cdi: docker.com/gpu=webgpu
Swarm: active
NodeID: rttyi3ht5knd0pe9devjtx2mp
Is Manager: true
ClusterID: u5erslb3hgba3he9slx82btol
Managers: 1
Nodes: 1
Default Address Pool: 10.0.0.0/8
SubnetSize: 24
Data Path Port: 4789
Orchestration:
Task History Retention Limit: 5
Raft:
Snapshot Interval: 10000
Number of Old Snapshots to Retain: 0
Heartbeat Tick: 1
Election Tick: 10
Dispatcher:
Heartbeat Period: 5 seconds
CA Configuration:
Expiry Duration: 3 months
Force Rotate: 0
Autolock Managers: false
Root Rotation In Progress: false
Node Address: 192.168.65.3
Manager Addresses:
192.168.65.3:2377
Runtimes: io.containerd.runc.v2 runc
Default Runtime: runc
Init Binary: docker-init
containerd version: 05044ec0a9a75232cad458027ca83437aae3f4da
runc version: v1.2.5-0-g59923ef
init version: de40ad0
Security Options:
seccomp
Profile: builtin
cgroupns
Kernel Version: 6.10.14-linuxkit
Operating System: Docker Desktop
OSType: linux
Architecture: aarch64
CPUs: 14
Total Memory: 7.653GiB
Name: docker-desktop
ID: aacae815-8ae1-44e1-8e9d-b3127b491dbc
Docker Root Dir: /var/lib/docker
Debug Mode: false
HTTP Proxy: http.docker.internal:3128
HTTPS Proxy: http.docker.internal:3128
No Proxy: hubproxy.docker.internal
Username: bjornhovd054
Labels:
com.docker.desktop.address=unix:///Users/bjorn/Library/Containers/com.docker.docker/Data/docker-cli.sock
Experimental: false
Insecure Registries:
hubproxy.docker.internal:5555
::1/128
127.0.0.0/8
Live Restore Enabled: false

[mikesir87]

@bjornhovd - Curious... do you have the containerd image store enabled in Docker Desktop? It's in Settings -> Use containerd for pulling and storing images

[bjornhovd]

@mikesir87 No it is not checked

[mikesir87]

@bjornhovd Ok. That's the issue then, as the legacy image store doesn't have the ability to store attestations, SBOMs, and other image metadata. Enabling it will fix it, but will also have side effects - you'll lose access to the images you have now, so will need to redownload them. But, they're still stored in the legacy store in case you switch back, so you should clean them up before swapping over.

We'll need to encourage folks to either swap this setting (which looks like is the default setting for new installs since Aug 2024) or use another BuildKit builder for the lab. I'll do some digging on the stats to see how many others might be affected by this and determine which direction we should encourage folks to go.