Docker Buildx Does Not Seem To Respect Output Type Flag

[justinba1010]

It seems that the output type flag is ignored during exports. Not sure if I am using this incorrectly. It seems to be documented here:
https://docs.docker.com/build/exporters/oci-docker/

Goal: To build a tarball that has the docker layout instead of OCI, in v24 and below this was default OCI Compliance PR

Steps to recreate:

1. Compile a dockerfile build (used the hello world example)

➜  hello-world git:(master) ✗ docker buildx build --output type=docker -t hello .

2. Save a tarball of image

➜  hello-world git:(master) ✗ docker save hello:latest -o out.tar

It would be expected that this tarball would have a docker image layout but it seems to be exported as an OCI image.

➜  hello-world git:(master) ✗ tar -tvf out.tar | grep oci
-rw-r--r-- 0/0              31 1969-12-31 19:00 oci-layout

There seems to be documentation for other methods to skip the save step, but I have been unable to get those to work as well.

➜  hello-world git:(master) ✗ docker buildx build --output "type=docker,tar=true,dest=out.tar" -t hello .
[+] Building 0.0s (0/0)                                                                    docker:default
ERROR: Docker exporter is not supported for the docker driver.
Switch to a different driver, or turn on the containerd image store, and try again.
Learn more at https://docs.docker.com/go/build-exporters/
➜  hello-world git:(master) ✗ docker buildx build --output "type=docker,tar=true" -t hello . 

➜  hello-world git:(master) ✗ docker version
Client: Docker Engine - Community
 Version:           26.1.2
 API version:       1.45
 Go version:        go1.21.10
 Git commit:        211e74b
 Built:             Wed May  8 13:59:59 2024
 OS/Arch:           linux/amd64
 Context:           default

Server: Docker Engine - Community
 Engine:
  Version:          26.1.2
  API version:      1.45 (minimum version 1.24)
  Go version:       go1.21.10
  Git commit:       ef1912d
  Built:            Wed May  8 13:59:59 2024
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.6.31
  GitCommit:        e377cd56a71523140ca6ae87e30244719194a521
 runc:
  Version:          1.1.12
  GitCommit:        v1.1.12-0-g51d5e94
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0```

[wellkilo]

type=docker controls the BuildKit exporter, but docker save serializes the image as represented by Docker Engine's current image store. With the containerd image store enabled, docker save may emit an OCI image layout even though the image was loaded through the Docker exporter. The second command therefore does not prove that --output was ignored.

To get a Docker-archive tar directly, use a non-default builder that supports the Docker exporter and set dest on that same build:

docker buildx create --name archive-builder --driver docker-container --use
docker buildx inspect --bootstrap
docker buildx build \
  --output type=docker,dest=out.tar \
  -t hello:latest .

Inspect out.tar directly; do not run docker save in between.

The error from the default docker driver is expected for that Engine configuration: it cannot export a Docker tar to dest unless the required exporter/image-store support is available. Switching to docker-container avoids that limitation.

Finally, “Docker archive” and “OCI media types inside an image” are separate concerns. If a downstream consumer requires the legacy docker-save archive structure, check for top-level manifest.json/repositories entries, not merely whether any oci-layout path appears after re-exporting through Docker Engine.