Docker 17.06 is pretty old. In the meantime the manifest format in registries changed. According to the documentation, older Docker versions should get a converted, compatible manifest, but I don’t actually now how that works and how old Docker versions can be supported that way.
Thank you for your reply, is this manifest change something that happened very recently? How can I learn which docker version one must have to support pull from docker hub? At first I thought maybe it’s somehow related to the APIv1 deprecation but the blog post (Registry v1 API Deprecation | Docker) says 17.03 is good enough.
It seems the issued caused by buildx version. I use GitHub Actions (docker/setup-buildx-action) to build images include the one that cannot be pulled. GitHub Actions has recently upgraded their build OS from Ubuntu 20.04 LTS to 22.04 LTS and with it they upgraded buildx from 0.9.1 to 0.10.0 and since then pull has stopped working. Most likely caused by SLSA provenance attestation Release v0.10.0 · docker/buildx · GitHub