Github Container Registry Packages lists the architecture unknown/unknown when manifest attestations are present

[kirkbrauer]

Select Topic Area

Bug

Body

I recently noticed that packages that have been pushed to the container registry using docker buildx build now have a new architecture listed, unknown/unknown. After some further investigation, I discovered that what is happening is that the Docker Buildx CLI is including image attestations for these images, which seems harmless, but causes GitHub Packages to list the unknown/unknown arch used for these attestations under the "OS / Arch" tab. This is similar to another topic recently posted, but this is more of a UI bug rather than an issue inspecting or pulling the manifests.

The current behavior means that if you push an image for linux/arm64 and linux/amd64, you'll get three architectures listed, linux/arm64, linux/amd64, and unknown/unknown. The unknown/unknown arch has a hash listed, but that is not shown in the version list anywhere unless you dig deep to find it. This appears to inconsistent with what the Docker Hub shows, which, in this case, would be only two architectures linux/arm64 and linux/amd64.

The behavior that I expect is to see only the number of architectures I built, potentially with the additional metadata included under those hashes, but the unknown/unknown arch should not be listed anywhere since it is not a real architecture.

[jge162]

appears to be a UI bug in GitHub Packages

[ghost]

Take a look at docker/build-push-action#755. I was seeing the same issue. Pinning the build kit sorted it

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@15c905b16b06416d2086efa066dd8e3a35cc7f98
        with:
          driver-opts: 'image=moby/buildkit:v0.10.5'

[kirkbrauer]

Yes, you can also disable the attestations in the buildx output using the arguments: --provenance=false --sbom=false, this should work if you don't want to pin the version.

[cederberg]

Another (perhaps easier) way, is to just set an environment variable:

env:
  BUILDX_NO_DEFAULT_ATTESTATIONS: 1

https://docs.docker.com/build/building/env-vars/#buildx_no_default_attestations

[naigueldev]

It works well for me — thank you! 👍

[cgawron]

For images with an attestation, ghcr also does not display metadata – to me, this is actually more annoying than the additional unknown platform.

[h-takeyeah]

• If you prefer to use Docker Image Manifest V2, the comment below is not helpful.
• unknown/unknown still appear after applying this method.

By default, annotations are placed on image manifests.
https://docs.docker.com/build/ci/github-actions/annotations/#configure-annotation-level

Though annotations are placed on image manifests by default, it is not enough to display the description on the ghcr package page.

As long as using OCI manifest, configuring annotations level to index would get issue sorted. This solution can be used with --provenance; you can utilize the multi architecture image. The document above also contains the practical example how to utilize DOCKER_METADATA_ANNOTATIONS_LEVELS to configure the level when you are utilizing docker-metadata-action 👍.

---

GitHub document shows GitHub Actions workflow example:

- name: Build and push Docker image
  uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4 # v4.1.0(June 2023) contains this commit
  with:
    context: .
    file: ./Dockerfile
    platforms: ${{ matrix.platforms }}
    push: true
    outputs: type=image,name=target,annotation-index.org.opencontainers.image.description=My multi-arch image

https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-container-registry#adding-a-description-to-multi-arch-images

---

I attach the results gathered by my own experiments. All outputs were gathered by issuing this command 👉 docker buildx imagetools inspect --raw <imagename on registry>.

OCI manifest with annotations on index (description is displayed properly)

ghcr.io/h-takeyeah/hello-world:sha-782d6fc

{
  "schemaVersion": 2,
  "mediaType": "application/vnd.oci.image.index.v1+json",
  "manifests": [
    {
      "mediaType": "application/vnd.oci.image.manifest.v1+json",
      "digest": "sha256:d14d8d612f1c6aebb581096ec9f3d95448c50c1e9244fe288f1243bdfb9c48b0",
      "size": 1110,
      "platform": {
        "architecture": "amd64",
        "os": "linux"
      }
    },
    {
      "mediaType": "application/vnd.oci.image.manifest.v1+json",
      "digest": "sha256:4b90e851af588b2bae96e9859bc64ab256e9dd3fea6362882445632eb912f4a3",
      "size": 566,
      "annotations": {
        "vnd.docker.reference.digest": "sha256:d14d8d612f1c6aebb581096ec9f3d95448c50c1e9244fe288f1243bdfb9c48b0",
        "vnd.docker.reference.type": "attestation-manifest"
      },
      "platform": {
        "architecture": "unknown",
        "os": "unknown"
      }
    }
  ],
  "annotations": {
    "org.opencontainers.image.created": "2025-04-03T16:35:32.681Z",
    "org.opencontainers.image.description": "GitHub Actions Sandbox",
    "org.opencontainers.image.licenses": "MIT",
    "org.opencontainers.image.revision": "782d6fc234a8f06da5f6a6ac48504b0eca6e0f14",
    "org.opencontainers.image.source": "https://github.com/h-takeyeah/actions-sandbox-miniature-garbanzo",
    "org.opencontainers.image.title": "actions-sandbox-miniature-garbanzo",
    "org.opencontainers.image.url": "https://github.com/h-takeyeah/actions-sandbox-miniature-garbanzo",
    "org.opencontainers.image.version": "edge"
  }
}

OCI manifest with manifest level annotations (description is not displayed)

ghcr.io/h-takeyeah/hello-world:sha-c215491

{
  "schemaVersion": 2,
  "mediaType": "application/vnd.oci.image.index.v1+json",
  "manifests": [
    {
      "mediaType": "application/vnd.oci.image.manifest.v1+json",
      "digest": "sha256:3604105d5d1af99caae3deb451b610fa6713ca305f8bf1221d1a212c5080c589",
      "size": 481,
      "platform": {
        "architecture": "amd64",
        "os": "linux"
      }
    },
    {
      "mediaType": "application/vnd.oci.image.manifest.v1+json",
      "digest": "sha256:dc9ea4c1a2e986a410a5a4b19b1b02e7d69db45bc2ac60f5c931cf0ddd207cd4",
      "size": 566,
      "annotations": {
        "vnd.docker.reference.digest": "sha256:3604105d5d1af99caae3deb451b610fa6713ca305f8bf1221d1a212c5080c589",
        "vnd.docker.reference.type": "attestation-manifest"
      },
      "platform": {
        "architecture": "unknown",
        "os": "unknown"
      }
    }
  ]
}

docker v2 manifest (description is displayed properly)

ghcr.io/h-takeyeah/hello-world:sha-787c481

{
   "schemaVersion": 2,
   "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
   "config": {
      "mediaType": "application/vnd.docker.container.image.v1+json",
      "size": 1746,
      "digest": "sha256:1390c4ece7c58ea70a4102c7e188164b340942e88e00c517586ca6ce7656ecce"
   },
   "layers": [
      {
         "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
         "size": 1344566,
         "digest": "sha256:916ccd6b997507277399853eb48aaaa2264278a2b7dfe4757c6f47ea93876e25"
      }
   ]
}

[alundiak]

If it's UI bug then I still have it in Jan-2024. And BUILDX_NO_DEFAULT_ATTESTATIONS: 1 didn't help to avoid unknown/unknown.
My config:

    strategy:
      matrix:
        os: [ubuntu-latest]
        arch: [x64, arm64, linux/arm64/v8]

which give mes linux/amd64 + unknown/unknown

PS. Source Setting proveance: false under uses: docker/build-push-action helped me to get rid of unknown/unknown BUT all other platforms also disappeared (looks like were build by GitHub Actions based on YAML config, but NOT shown on GitHub Package page).

BTW, I used docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 version which 5.x version as Suggested GitHub Actions template.

[jimisola]

Any updates (solutions or workarounds) on this matter?

I'm generating linux/amd64 and linux/arm64 using matrix but only one shows up in ghcr packages and there is the additional "unknown/unknown" as well.

[krystof-k]

I ended up with this. Beside it still lists unknown/unknown it seems fine:

name: Build & push Docker image
on:
  workflow_dispatch:
  workflow_call:
    outputs:
      image:
        value: ${{ jobs.publish-manifest-list.outputs.image }}
env:
  DOCKER_REGISTRY: ghcr.io
jobs:
  build:
    name: Build Docker image
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    strategy:
      matrix:
        platform:
          - linux/amd64
          - linux/arm64
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3
        with:
          platforms: ${{ matrix.platform }}
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.DOCKER_REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Prepare Docker image name
        id: docker-image-name
        env:
          REPOSITORY: ${{ github.repository }}
        run: echo "value=${DOCKER_REGISTRY}/${REPOSITORY,,}" >> $GITHUB_OUTPUT
      - name: Build and push Docker image
        uses: docker/build-push-action@v5
        id: build-and-push-docker-image
        with:
          context: .
          platforms: ${{ matrix.platform }}
          outputs: type=registry,name=${{ steps.docker-image-name.outputs.value }},push-by-digest=true
          cache-from: type=gha,scope=buildkit-${{ matrix.platform }}
          cache-to: type=gha,mode=max,scope=buildkit-${{ matrix.platform }}
      - name: Export digest
        run: |
          mkdir -p /tmp/digests
          digest="${{ steps.build-and-push-docker-image.outputs.digest }}"
          touch "/tmp/digests/${digest#sha256:}"
      - name: Upload digest
        uses: actions/upload-artifact@v3
        with:
          name: digests
          path: /tmp/digests/*
          if-no-files-found: error
          retention-days: 1
  publish-manifest-list:
    name: Publish Docker manifest list
    runs-on: ubuntu-latest
    permissions:
      packages: write
    needs:
      - build
    outputs:
      image: ${{ steps.retrieve-image.outputs.value }}
    steps:
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.DOCKER_REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Prepare Docker metadata
        uses: docker/metadata-action@v5
        id: docker-metadata
        with:
          images: ${{ env.DOCKER_REGISTRY }}/${{ github.repository }}
          tags: |
            type=ref,event=branch
            type=ref,event=pr
            type=sha
          flavor: |
            latest=true
      - name: Download digests
        uses: actions/download-artifact@v3
        with:
          name: digests
          path: /tmp/digests
      - name: Prepare Docker image name
        id: docker-image-name
        env:
          REPOSITORY: ${{ github.repository }}
        run: echo "value=${DOCKER_REGISTRY}/${REPOSITORY,,}" >> $GITHUB_OUTPUT
      - name: Create and push manifest list
        run: |
          docker buildx imagetools create \
            $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
            $(printf '${{ steps.docker-image-name.outputs.value }}@sha256:%s ' $(ls /tmp/digests)) \
      - name: Retrieve image
        id: retrieve-image
        run: echo "value=$(echo "$DOCKER_METADATA_OUTPUT_JSON" | jq -r '.tags[1]')" >> $GITHUB_OUTPUT
      - name: Inspect image
        run: |
          docker buildx imagetools inspect ${{ steps.retrieve-image.outputs.value }}

[hu3bi]

This truly is kinda annoying. Has there been any progress made?

[younsl]

Hi all. This comment helps me. I've also encountered the unknown/unknown architecture appearing in ghcr.io when pushing multi-arch container images.

I found that setting provenance: false and sbom: false within the docker/build-push-action@v6.18.0 effectively resolves this UI issue for me. See the build-push-action README for input details.

      - name: Build and push Docker image
        uses: docker/build-push-action@v6.18.0
        with:
          # ... other parameters ...
          provenance: false # Disable provenance to avoid unknown/unknown
          sbom: false       # Disable sbom to avoid unknown/unknown

It seems that by disabling the generation of these default build attestations, the non-platform-specific entries that ghcr.io's UI interprets as unknown/unknown are no longer included in the manifest list.

ghcr.io manifest without unknown/unknown:

This results in a cleaner display showing only the architectures I explicitly built for (e.g., linux/amd64, linux/arm64). While attestations are valuable, this can be a practical workaround if the unknown/unknown display is problematic.

actions workflow snippet to exclude the unknown/unknown manifest:

jobs:
  # ... omitted for brevity ...
  build-container:
    steps:
      # ... omitted for brevity ...
      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/${{ env.IMAGE_NAME }}
          tags: |
            type=raw,value=${{ env.VERSION }}
          # OCI Image Spec:
          # https://github.com/opencontainers/image-spec/blob/main/annotations.md
          labels: |
            maintainer=${{ github.actor }}
            org.opencontainers.image.description=${{ env.IMAGE_DESCRIPTION }}
        env:
          DOCKER_METADATA_ANNOTATIONS_LEVELS: manifest,index

      - name: Build and push Docker image
        uses: docker/build-push-action@v6.18.0
        with:
          context: box/kubernetes/eip-rotation-handler
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          annotations: ${{ steps.meta.outputs.annotations }}
          build-args: |
            VERSION=${{ env.VERSION }}
            COMMIT=${{ github.sha }}
          provenance: false # Disable provenance to avoid unknown/unknown
          sbom: false       # Disable sbom to avoid unknown/unknown
          outputs: type=image,name=target

[alundiak]

@younsl Thanks, first of all :) Although this issue wasn't a life problem for me, anyway I finally got it working.

1. For docker/metadata-action@v5I did use DOCKER_METADATA_ANNOTATIONS_LEVELS: manifest,index, which as described is kinda important now.
2. For docker/build-push-action@v6.18.0 what was missing for me annotations: ${{ steps.meta.outputs.annotations }}
3. I remained using provenance: false as before, but sbom: false was NEW for me
4. rest of YAML setup is based on GitHub Actions / Pages template suggested (as of 24-Jun-2025)

and here I am :) :

Note that:

• docker pull ghcr.io/alundiak/devops-experiments:main@sha256:e2d**04c for linux/arm64 - WORKS OK (MacOS, M1)
• docker pull ghcr.io/alundiak/devops-experiments:main@sha256:e4a***ef4 for linux/amd64 - also FETCHES image OK, but shows Docker Desktop warning about platform mismatch and poor performance. Expected.
• docker pull ghcr.io/alundiak/devops-experiments:sha256-c58***6ef.sig FAILS

"unsupported media type application/vnd.dev.cosign.simplesigning.v1+json"

[alundiak]

Caveats I faced with

1. OUTDATED. When I used env.REGISTRY = ghcr.io + images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
   and WHEN I applied outputs: type=image,name=target for docker/build-push-action@v6.18.0
   my YAML build FAILED on the error related to FALLBACK to Docker Registry.
   I don't know why.
   But I removed outputs and all went OK to ghcr.io

2. Setup suggested org.opencontainers.image.description doesn't cause proper use my env.IMAGE_DESCRIPTION for both manifest and index (and I don't want to change Dockerfile).
   In build logs I see that it's using Git repo description instead BUT I keep seeing this on Package page:

And even when I use same value for both it still doesn't work.

this is when:

or

for now, somehow fixed this way:

env:
  # Uses docker.io for Docker Hub if empty
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}
  IMAGE_DESCRIPTION: My Docker image on GitHub Container Registry
  VERSION: ${{ github.ref_name || 'latest' }}
  
      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
           ...
          annotations: |
            org.opencontainers.image.description=${{ env.IMAGE_DESCRIPTION }}
        env:
          DOCKER_METADATA_ANNOTATIONS_LEVELS: manifest,index

      - name: Build and push Docker image
        id: build-and-push
        uses: docker/build-push-action@v6.18.0
        with:
           ...
          annotations: |
            ${{ steps.meta.outputs.annotations }}
            org.opencontainers.image.description=Per-arch image description for each variant
          ...
          outputs: type=image,name=target,annotations.index:org.opencontainers.image.description=My multi-arch image

Gives me what I at least 80% expected: