oci-layout:// named context fails in daemonless build with unknown service containerd.services.content.v1.Content

[Ru13en]

Contributing guidelines and issue reporting guide

• I've read the contributing guidelines and wholeheartedly agree. I've also read the issue reporting guide.

Well-formed report checklist

• I have found a bug that the documentation does not mention anything about my problem
• I have found a bug that there are no open or closed issues that are related to my problem
• I have provided version/information about my environment and done my best to provide a reproducer

Description of bug

Bug description

buildctl-daemonless.sh is unable to consume a locally exported OCI image layout as a named Dockerfile context.

The workflow is:

1. Build image A and export it as an OCI layout.
2. Extract the OCI layout locally.
3. Build image B and use the OCI layout from image A as the source for a FROM instruction via an oci-layout:// named context.

During the second build, BuildKit fails while resolving metadata for the OCI layout image with:

failed to resolve source metadata for docker.io/library/base@sha256:...
unable to get info about digest: Unimplemented: unknown service containerd.services.content.v1.Content

Expected behavior:

BuildKit should be able to resolve the image from the provided OCI layout and continue the build. If this workflow is not supported with buildctl-daemonless.sh, the error should clearly indicate that OCI layout contexts are unsupported rather than failing with an internal containerd content service error.

Reproduction

Start a rootless buildkit container:

docker run --privileged -u 0 --entrypoint sh -it moby/buildkit:rootless

Create the following Dockerfiles:

Dockerfile

ARG BASE_IMG=alpine:latest
FROM $BASE_IMG AS base

Dockerfile.1

ARG BASE_IMG=alpine:latest
FROM $BASE_IMG AS base

RUN echo "Hello, World!" > /hello.txt`

Build and export the first image as OCI:

buildctl-daemonless.sh build \
  --progress=plain \
  --frontend dockerfile.v0 \
  --opt filename=Dockerfile \
  --local context=.  \
  --local dockerfile=. \
  --output type=oci,store=false,dest=oci-image.tar \
  --metadata-file=metadata.json

Extract the OCI layout:

mkdir -p ./exported
tar -xvf oci-image.tar -C ./exported

Get the image digest:

DIGEST=$(sed -n 's#.*"containerimage.digest"[[:space:]]*:[[:space:]]*"\([^"]*\)".*#\1#p' "metadata.json" | head -n1)

Run a second build using the OCI layout as a named context:

buildctl-daemonless.sh build \
  --progress=plain \
  --frontend dockerfile.v0 \
  --opt filename=Dockerfile.1 \
  --local context=. \
  --local dockerfile=. \
  --opt oci-layout:oci-base=./exported \
  --opt context:base=oci-layout://oci-base@$DIGEST \
  --output type=oci,store=false,dest=oci-image.tar \
  --metadata-file=metadata.json

Build fails with:

#1 [internal] load build definition from Dockerfile.1
#1 DONE 0.0s

#1 [internal] load build definition from Dockerfile.1
#1 transferring dockerfile: 128B done
#1 DONE 0.0s

#2 [context base] load metadata for docker.io/library/base@sha256:5f1d9ae1cc729d5696e183d7ab8fa992908c75d1b3f2c81fd169ed21aa4ec2c6
#2 ERROR: unable to get info about digest: Unimplemented: unknown service containerd.services.content.v1.Content
------
 > [context base] load metadata for docker.io/library/base@sha256:5f1d9ae1cc729d5696e183d7ab8fa992908c75d1b3f2c81fd169ed21aa4ec2c6:
------
Dockerfile.1:2
--------------------
   1 |     ARG BASE_IMG=alpine:latest
   2 | >>> FROM $BASE_IMG AS base
   3 |     
   4 |     RUN echo "Hello, World!" > /hello.txt
--------------------
error: failed to solve: failed to resolve source metadata for docker.io/library/base@sha256:5f1d9ae1cc729d5696e183d7ab8fa992908c75d1b3f2c81fd169ed21aa4ec2c6: unable to get info about digest: Unimplemented: unknown service containerd.services.content.v1.Content

Digest echo:

echo $DIGEST
sha256:5f1d9ae1cc729d5696e183d7ab8fa992908c75d1b3f2c81fd169ed21aa4ec2c6

Version information

buildctl --version && buildkitd version
buildctl github.com/moby/buildkit v0.32.2 991535e0973488b6a429096d21fa13f81f2d89d8
INFO[2026-08-05T08:59:35Z] auto snapshotter: using fuse-overlayfs       
WARN[2026-08-05T08:59:35Z] CDI setup error /var/run/cdi: failed to monitor for changes: no such file or directory 
WARN[2026-08-05T08:59:35Z] CDI setup error /etc/buildkit/cdi: failed to monitor for changes: no such file or directory 
WARN[2026-08-05T08:59:35Z] CDI setup error /etc/cdi: failed to monitor for changes: no such file or directory 
WARN[2026-08-05T08:59:35Z] using host network as the default            
WARN[2026-08-05T08:59:35Z] failed check for fsverity support             error="enable fsverity failed: inappropriate ioctl for device" path=/var/lib/buildkit/runc-fuse-overlayfs/content
INFO[2026-08-05T08:59:35Z] found worker "ahvi4flgsfo713wq2h7gqqnpe", labels=map[org.mobyproject.buildkit.worker.executor:oci org.mobyproject.buildkit.worker.hostname:79951749d079 org.mobyproject.buildkit.worker.network:host org.mobyproject.buildkit.worker.oci.process-mode:sandbox org.mobyproject.buildkit.worker.selinux.enabled:false org.mobyproject.buildkit.worker.snapshotter:fuse-overlayfs], platforms=[linux/amd64 linux/amd64/v2 linux/amd64/v3 linux/arm64 linux/riscv64 linux/ppc64le linux/s390x linux/386 linux/arm/v7 linux/arm/v6] 
WARN[2026-08-05T08:59:35Z] skipping containerd worker, as "/run/containerd/containerd.sock" does not exist 
INFO[2026-08-05T08:59:35Z] found 1 workers, default="ahvi4flgsfo713wq2h7gqqnpe" 
WARN[2026-08-05T08:59:35Z] currently, only the default worker can be used. 
INFO[2026-08-05T08:59:35Z] running server on /run/buildkit/buildkitd.sock