[SOLVED] Docker build with WORKDIR makes Docker unable to find the image locally with Containerd beta enabled

Docker build with WORKDIR makes Docker unable to find the image locally with Containerd beta enabled

Minimal Dockerfile in ./Dockerfile:

# syntax=docker/dockerfile:1
FROM rockylinux:9

WORKDIR /opt/deploy

Build works fine:

export DOCKER_BUILDKIT=1
docker build --platform linux/amd64 -t minimal:test -f Dockerfile .

Run does not:

export DOCKER_BUILDKIT=1
docker run --rm --platform linux/amd64 -it minimal:test

Error:

Unable to find image 'minimal:test' locally
docker: Error response from daemon: failed to resolve reference "docker.io/library/minimal:test": pull access denied, repository does not exist or may require authorization: server message: insufficient_scope: authorization failed.
See 'docker run --help'.

Meanwhile, I can clearly see minimal:test in the output from docker image ls, and I can successfully run docker image rm minimal:test.

Weirder still, if I comment out the WORKDIR line, it works fine!

What am I dong wrong here?

I'm using Docker Desktop for Mac on MacOS 12.4:

$ docker --version
Docker version 20.10.22, build 267d2e5

Edit: I had the containerd beta option enabled in Docker Desktop, which turned out to be the problem. Adding this to make it easier to search for this issue in the future.

Solution

Empirically, this turned out to be a bug in the experimental "Containerd" option in Docker Desktop, possibly related to lazy-loading of images. Disabling that option and restarting the Docker daemon fixed the problem.