### Description
Two example images that cause this are `quay.io/jetstack/cert-mā¦anager-startupapicheck:v1.17.1` and `docker.redpanda.com/redpandadata/redpanda-operator:v2.3.6-24.3.3`. They may be pulled in either order, and the one pulled last will then have an incomplete OCI image when exported via docker save. These images seem to share layers but not blobs.
### Reproduce
Two example images that cause this are `quay.io/jetstack/cert-manager-startupapicheck:v1.17.1` and `docker.redpanda.com/redpandadata/redpanda-operator:v2.3.6-24.3.3`. They may be pulled in either order, and the one pulled last will then have an incomplete OCI image when exported via `docker save`.
Example with `cert-manager-startupapicheck` first and `redpanda-operator` second:
```sh
$ docker image prune --all --force
$ docker image pull quay.io/jetstack/cert-manager-startupapicheck:v1.17.1
v1.17.1: Pulling from jetstack/cert-manager-startupapicheck
6c03ec296e03: Download complete
1f3ae7a08e20: Download complete
2e4cf50eeb92: Download complete
d44d440ac96b: Download complete
0f8b424aa0b9: Download complete
d557676654e5: Download complete
d82bc7a76a83: Download complete
d858cbc252ad: Download complete
1069fc2daed1: Download complete
b40161cd83fc: Download complete
3f4e2c586348: Download complete
0186d7d79754: Download complete
91898a144e47: Download complete
80a8c047508a: Download complete
Digest: sha256:ac8ef0a934ae456d10d2ff5ee492b0a816bf55752f61354bde1739054c2c2c68
Status: Downloaded newer image for quay.io/jetstack/cert-manager-startupapicheck:v1.17.1
quay.io/jetstack/cert-manager-startupapicheck:v1.17.1
$ docker image pull docker.redpanda.com/redpandadata/redpanda-operator:v2.3.6-24.3.3
v2.3.6-24.3.3: Pulling from redpandadata/redpanda-operator
43f4c67c6a60: Download complete
0c42382fa3cd: Download complete
Digest: sha256:7fef2dfbf9c215037758a3e9f39c48a8099ee1b15efcd7bbefd989cbf1163334
Status: Downloaded newer image for docker.redpanda.com/redpandadata/redpanda-operator:v2.3.6-24.3.3
docker.redpanda.com/redpandadata/redpanda-operator:v2.3.6-24.3.3
$ docker image save quay.io/jetstack/cert-manager-startupapicheck:v1.17.1 | tar tv
drwxr-xr-x 0 0 0 0 Dec 31 1969 blobs/
drwxr-xr-x 0 0 0 0 Dec 31 1969 blobs/sha256/
-r--r--r-- 0 0 0 12356518 Dec 31 1969 blobs/sha256/0186d7d79754e932e1cca6c452a9a034ee0c579e23ce9d7dbf453315df3c1b4b
-r--r--r-- 0 0 0 75 Dec 31 1969 blobs/sha256/0f8b424aa0b96c1c388a5fd4d90735604459256336853082afb61733438872b5
-r--r--r-- 0 0 0 97 Dec 31 1969 blobs/sha256/1069fc2daed1aceff7232f4b8ab21200dd3d8b04f61be9da86977a34a105dfdc
-r--r--r-- 0 0 0 84660 Dec 31 1969 blobs/sha256/1f3ae7a08e20172f01e6113ac282e0c40ff51541f15aeaf4ce131013c1367be5
-r--r--r-- 0 0 0 12579 Dec 31 1969 blobs/sha256/2e4cf50eeb92ac3a7afe75e15d96a26dee99449f86b46c75b5d95f4418a5bca0
-r--r--r-- 0 0 0 326 Dec 31 1969 blobs/sha256/3f4e2c5863480125882d92060440a5250766bce764fee10acdbac18c872e4dc7
-r--r--r-- 0 0 0 3228 Dec 31 1969 blobs/sha256/4af297aaab36cecc79b14446ed7055cbd8113f18fda77de6979969baf3b2177b
-r--r--r-- 0 0 0 268 Dec 31 1969 blobs/sha256/6c03ec296e0327d969c69d99d9520b79416b98e9fd2ae79795bc0bdf4d50433f
-r--r--r-- 0 0 0 129107 Dec 31 1969 blobs/sha256/80a8c047508ae5cd6a591060fc43422cb8e3aea1bd908d913e8f0146e2297fea
-r--r--r-- 0 0 0 633 Dec 31 1969 blobs/sha256/91898a144e47214afc3481c2cc694b85002d92b8b48125223c1974d5029f4f43
-r--r--r-- 0 0 0 1728 Dec 31 1969 blobs/sha256/ac8ef0a934ae456d10d2ff5ee492b0a816bf55752f61354bde1739054c2c2c68
-r--r--r-- 0 0 0 382 Dec 31 1969 blobs/sha256/b40161cd83fc5d470d6abe50e87aa288481b6b89137012881d74187cfbf9f502
-r--r--r-- 0 0 0 453863 Dec 31 1969 blobs/sha256/d44d440ac96b51f08f1fcd10f8cc4f7bfd58971b754e0b6cfea9b83e0f73c8f5
-r--r--r-- 0 0 0 193 Dec 31 1969 blobs/sha256/d557676654e572af3e3173c90e7874644207fda32cd87e9d3d66b5d7b98a7b21
-r--r--r-- 0 0 0 130 Dec 31 1969 blobs/sha256/d82bc7a76a838c9a4a6025192429c2fed58f73742ef1fb9c8bb7b995fc3b7213
-r--r--r-- 0 0 0 173 Dec 31 1969 blobs/sha256/d858cbc252ade14879807ff8dbc3043a26bbdb92087da98cda831ee040b172b3
-r--r--r-- 0 0 0 2800 Dec 31 1969 blobs/sha256/e9962039e49b801482873544ade5f0a5022a8c66b96efca708a63262087ef504
-rw-r--r-- 0 0 0 485 Dec 31 1969 index.json
-rw-r--r-- 0 0 0 1292 Dec 31 1969 manifest.json
-r--r--r-- 0 0 0 30 Dec 31 1969 oci-layout
$ docker image save docker.redpanda.com/redpandadata/redpanda-operator:v2.3.6-24.3.3 | tar tv
drwxr-xr-x 0 0 0 0 Dec 31 1969 blobs/
drwxr-xr-x 0 0 0 0 Dec 31 1969 blobs/sha256/
-r--r--r-- 0 0 0 1609 Dec 31 1969 blobs/sha256/7fef2dfbf9c215037758a3e9f39c48a8099ee1b15efcd7bbefd989cbf1163334
-r--r--r-- 0 0 0 2751 Dec 31 1969 blobs/sha256/9babff5f3138cd2f5b86749bd60a07e94f66347bc6bcb269027639e8511580c3
-rw-r--r-- 0 0 0 489 Dec 31 1969 index.json
-rw-r--r-- 0 0 0 1223 Dec 31 1969 manifest.json
-r--r--r-- 0 0 0 30 Dec 31 1969 oci-layout
```
Example the other way around:
```sh
$ docker image prune --all --force
$ docker image pull docker.redpanda.com/redpandadata/redpanda-operator:v2.3.6-24.3.3
v2.3.6-24.3.3: Pulling from redpandadata/redpanda-operator
43f4c67c6a60: Download complete
a62778643d56: Download complete
4aa0ea1413d3: Already exists
cbeee09c6b35: Download complete
9aee425378d2: Download complete
5664b15f108b: Download complete
bfb59b82a9b6: Download complete
da7816fa955e: Download complete
efa9d1d5d3a2: Download complete
7c12895b777b: Download complete
0bab15eea81d: Download complete
0c42382fa3cd: Download complete
3214acf345c0: Download complete
Digest: sha256:7fef2dfbf9c215037758a3e9f39c48a8099ee1b15efcd7bbefd989cbf1163334
Status: Downloaded newer image for docker.redpanda.com/redpandadata/redpanda-operator:v2.3.6-24.3.3
docker.redpanda.com/redpandadata/redpanda-operator:v2.3.6-24.3.3
$ docker image pull quay.io/jetstack/cert-manager-startupapicheck:v1.17.1
v1.17.1: Pulling from jetstack/cert-manager-startupapicheck
6c03ec296e03: Download complete
0186d7d79754: Download complete
91898a144e47: Download complete
Digest: sha256:ac8ef0a934ae456d10d2ff5ee492b0a816bf55752f61354bde1739054c2c2c68
Status: Downloaded newer image for quay.io/jetstack/cert-manager-startupapicheck:v1.17.1
quay.io/jetstack/cert-manager-startupapicheck:v1.17.1
$ docker image save quay.io/jetstack/cert-manager-startupapicheck:v1.17.1 | tar tv
drwxr-xr-x 0 0 0 0 Dec 31 1969 blobs/
drwxr-xr-x 0 0 0 0 Dec 31 1969 blobs/sha256/
-r--r--r-- 0 0 0 3228 Dec 31 1969 blobs/sha256/4af297aaab36cecc79b14446ed7055cbd8113f18fda77de6979969baf3b2177b
-r--r--r-- 0 0 0 1728 Dec 31 1969 blobs/sha256/ac8ef0a934ae456d10d2ff5ee492b0a816bf55752f61354bde1739054c2c2c68
-rw-r--r-- 0 0 0 485 Dec 31 1969 index.json
-rw-r--r-- 0 0 0 1292 Dec 31 1969 manifest.json
-r--r--r-- 0 0 0 30 Dec 31 1969 oci-layout
$ docker image save docker.redpanda.com/redpandadata/redpanda-operator:v2.3.6-24.3.3 | tar tv
drwxr-xr-x 0 0 0 0 Dec 31 1969 blobs/
drwxr-xr-x 0 0 0 0 Dec 31 1969 blobs/sha256/
-r--r--r-- 0 0 0 93 Dec 31 1969 blobs/sha256/0bab15eea81d0fe6ab56ebf5fba14e02c4c1775a7f7436fbddd3505add4e18fa
-r--r--r-- 0 0 0 1069028 Dec 31 1969 blobs/sha256/0c42382fa3cd4cf8f9a357c951cfc2c90c9f5064752e5983ccf02410f0746fb0
-r--r--r-- 0 0 0 123 Dec 31 1969 blobs/sha256/3214acf345c0cc6bbdb56b698a41ccdefc624a09d6beb0d38b5de0b2303ecaf4
-r--r--r-- 0 0 0 56270141 Dec 31 1969 blobs/sha256/43f4c67c6a60ed3afea28247f6ba6d58c41263f91745f8287615e7c3234e39a0
-r--r--r-- 0 0 0 385 Dec 31 1969 blobs/sha256/4aa0ea1413d37a58615488592a0b827ea4b2e48fa5a77cf707d0e35f025e613f
-r--r--r-- 0 0 0 168 Dec 31 1969 blobs/sha256/5664b15f108bf9436ce3312090a767300800edbbfd4511aa1a6d64357024d5dd
-r--r--r-- 0 0 0 188 Dec 31 1969 blobs/sha256/7c12895b777bcaa8ccae0605b4de635b68fc32d60fa08f421dc3818bf55ee212
-r--r--r-- 0 0 0 1609 Dec 31 1969 blobs/sha256/7fef2dfbf9c215037758a3e9f39c48a8099ee1b15efcd7bbefd989cbf1163334
-r--r--r-- 0 0 0 130495 Dec 31 1969 blobs/sha256/9aee425378d2c16cd44177dc54a274b312897f5860a8e78fdfda555a0d79dd71
-r--r--r-- 0 0 0 2751 Dec 31 1969 blobs/sha256/9babff5f3138cd2f5b86749bd60a07e94f66347bc6bcb269027639e8511580c3
-r--r--r-- 0 0 0 67 Dec 31 1969 blobs/sha256/a62778643d563b511190663ef9a77c30d46d282facfdce4f3a7aecc03423c1f3
-r--r--r-- 0 0 0 2673 Dec 31 1969 blobs/sha256/bb2fa146708f133d43fa98dd8f027e8e38fbd8007d907a19fa1f72590f8f27cc
-r--r--r-- 0 0 0 13356 Dec 31 1969 blobs/sha256/bfb59b82a9b65e47d485e53b3e815bca3b3e21a095bd0cb88ced9ac0b48062bf
-r--r--r-- 0 0 0 104238 Dec 31 1969 blobs/sha256/cbeee09c6b35bb253c7bb1f44f87f98554ab621e1bf5f70bd2e53363333a1cca
-r--r--r-- 0 0 0 321 Dec 31 1969 blobs/sha256/da7816fa955ea24533c388143c78804c28682eef99b4ee3723b548c70148bba6
-r--r--r-- 0 0 0 541994 Dec 31 1969 blobs/sha256/efa9d1d5d3a286c60a7261496166fdf31cec2284dafe7eef7cda89eba2f675d6
-rw-r--r-- 0 0 0 489 Dec 31 1969 index.json
-rw-r--r-- 0 0 0 1223 Dec 31 1969 manifest.json
-r--r--r-- 0 0 0 30 Dec 31 1969 oci-layout
```
### Expected behavior
`docker save` should return an OCI image with all referenced blobs.
### docker version
```bash
Client:
Version: 27.5.1
API version: 1.47
Go version: go1.22.11
Git commit: 9f9e405
Built: Wed Jan 22 13:37:19 2025
OS/Arch: darwin/arm64
Context: desktop-linux
Server: Docker Desktop 4.38.0 (181591)
Engine:
Version: 27.5.1
API version: 1.47 (minimum version 1.24)
Go version: go1.22.11
Git commit: 4c9b3b0
Built: Wed Jan 22 13:41:25 2025
OS/Arch: linux/arm64
Experimental: false
containerd:
Version: 1.7.25
GitCommit: bcc810d6b9066471b0b6fa75f557a15a1cbf31bb
runc:
Version: 1.1.12
GitCommit: v1.1.12-0-g51d5e946
docker-init:
Version: 0.19.0
GitCommit: de40ad0
```
### docker info
```bash
Client:
Version: 27.5.1
Context: desktop-linux
Debug Mode: false
Plugins:
ai: Ask Gordon - Docker Agent (Docker Inc.)
Version: v0.7.3
Path: /Users/michaelmaltese/.docker/cli-plugins/docker-ai
buildx: Docker Buildx (Docker Inc.)
Version: v0.20.1-desktop.2
Path: /Users/michaelmaltese/.docker/cli-plugins/docker-buildx
compose: Docker Compose (Docker Inc.)
Version: v2.32.4-desktop.1
Path: /Users/michaelmaltese/.docker/cli-plugins/docker-compose
debug: Get a shell into any image or container (Docker Inc.)
Version: 0.0.38
Path: /Users/michaelmaltese/.docker/cli-plugins/docker-debug
desktop: Docker Desktop commands (Beta) (Docker Inc.)
Version: v0.1.4
Path: /Users/michaelmaltese/.docker/cli-plugins/docker-desktop
dev: Docker Dev Environments (Docker Inc.)
Version: v0.1.2
Path: /Users/michaelmaltese/.docker/cli-plugins/docker-dev
extension: Manages Docker extensions (Docker Inc.)
Version: v0.2.27
Path: /Users/michaelmaltese/.docker/cli-plugins/docker-extension
feedback: Provide feedback, right in your terminal! (Docker Inc.)
Version: v1.0.5
Path: /Users/michaelmaltese/.docker/cli-plugins/docker-feedback
init: Creates Docker-related starter files for your project (Docker Inc.)
Version: v1.4.0
Path: /Users/michaelmaltese/.docker/cli-plugins/docker-init
sbom: View the packaged-based Software Bill Of Materials (SBOM) for an image (Anchore Inc.)
Version: 0.6.0
Path: /Users/michaelmaltese/.docker/cli-plugins/docker-sbom
scout: Docker Scout (Docker Inc.)
Version: v1.16.1
Path: /Users/michaelmaltese/.docker/cli-plugins/docker-scout
Server:
Containers: 0
Running: 0
Paused: 0
Stopped: 0
Images: 2
Server Version: 27.5.1
Storage Driver: stargz
driver-type: io.containerd.snapshotter.v1
Logging Driver: json-file
Cgroup Driver: cgroupfs
Cgroup Version: 2
Plugins:
Volume: local
Network: bridge host ipvlan macvlan null overlay
Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
CDI spec directories:
/etc/cdi
/var/run/cdi
Swarm: inactive
Runtimes: io.containerd.runc.v2 runc
Default Runtime: runc
Init Binary: docker-init
containerd version: bcc810d6b9066471b0b6fa75f557a15a1cbf31bb
runc version: v1.1.12-0-g51d5e946
init version: de40ad0
Security Options:
seccomp
Profile: unconfined
cgroupns
Kernel Version: 6.12.5-linuxkit
Operating System: Docker Desktop
OSType: linux
Architecture: aarch64
CPUs: 10
Total Memory: 19.5GiB
Name: docker-desktop
ID: 9795a321-3b1a-4828-b87b-968e24f06533
Docker Root Dir: /var/lib/docker
Debug Mode: false
HTTP Proxy: http.docker.internal:3128
HTTPS Proxy: http.docker.internal:3128
No Proxy: hubproxy.docker.internal
Labels:
com.docker.desktop.address=unix:///Users/michaelmaltese/Library/Containers/com.docker.docker/Data/docker-cli.sock
Experimental: false
Insecure Registries:
hubproxy.docker.internal:5555
127.0.0.0/8
Live Restore Enabled: false
```
### Additional Info
Results of `docker image inspect` showing that the example images share layers:
```sh
$ docker image inspect quay.io/jetstack/cert-manager-startupapicheck:v1.17.1
[
{
"Id": "sha256:ac8ef0a934ae456d10d2ff5ee492b0a816bf55752f61354bde1739054c2c2c68",
"RepoTags": [
"quay.io/jetstack/cert-manager-startupapicheck:v1.17.1"
],
"RepoDigests": [
"quay.io/jetstack/cert-manager-startupapicheck@sha256:ac8ef0a934ae456d10d2ff5ee492b0a816bf55752f61354bde1739054c2c2c68"
],
"Parent": "",
"Comment": "buildkit.dockerfile.v0",
"Created": "2025-02-13T10:08:44.962412477Z",
"DockerVersion": "27.5.1",
"Author": "",
"Config": {
"Hostname": "",
"Domainname": "",
"User": "1000",
"AttachStdin": false,
"AttachStdout": false,
"AttachStderr": false,
"Tty": false,
"OpenStdin": false,
"StdinOnce": false,
"Env": [
"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
"SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt"
],
"Cmd": null,
"Image": "",
"Volumes": null,
"WorkingDir": "/",
"Entrypoint": [
"/startupapicheck"
],
"OnBuild": null,
"Labels": {
"org.opencontainers.image.source": "https://github.com/cert-manager/cert-manager"
}
},
"Architecture": "arm64",
"Variant": "v8",
"Os": "linux",
"Size": 13046760,
"GraphDriver": {
"Data": null,
"Name": "stargz"
},
"RootFS": {
"Type": "layers",
"Layers": [
"sha256:0a86283d35175f8d95b76ec85d7a7fb63f44a07ffdfa8d4d7310b0bbd49ce710",
"sha256:8fa10c0194df9b7c054c90dbe482585f768a54428fc90a5b78a0066a123b1bba",
"sha256:a80545a98dcd0866ae5eeadc9a28dec703b1e54a01ce8ff245e83f48261fe575",
"sha256:4d049f83d9cf21d1f5cc0e11deaf36df02790d0e60c1a3829538fb4b61685368",
"sha256:af5aa97ebe6ce1604747ec1e21af7136ded391bcabe4acef882e718a87c86bcc",
"sha256:6f1cdceb6a3146f0ccb986521156bef8a422cdbb0863396f7f751f575ba308f4",
"sha256:bbb6cacb8c82e4da4e8143e03351e939eab5e21ce0ef333c42e637af86c5217b",
"sha256:2a92d6ac9e4fcc274d5168b217ca4458a9fec6f094ead68d99c77073f08caac1",
"sha256:1a73b54f556b477f0a8b939d13c504a3b4f4db71f7a09c63afbc10acb3de5849",
"sha256:f4aee9e53c42a22ed82451218c3ea03d1eea8d6ca8fbe8eb4e950304ba8a8bb3",
"sha256:b336e209998fa5cf0eec3dabf93a21194198a35f4f75612d8da03693f8c30217",
"sha256:e2f4c59e64a05ffa8db5e51170fa5dc7b5e335deb9362dd21cc4617a0ea1d0f3",
"sha256:52e74095a54b268383af96cd0980bcc0ff374095f0e2cf44c59c75c099f9bc3d",
"sha256:49b164c911aed51be4507f3391e129f77311731bf83423aa6c3074907be2c439"
]
},
"Metadata": {
"LastTagTime": "2025-02-16T18:51:58.679705339Z"
}
}
]
$ docker.redpanda.com/redpandadata/redpanda-operator:v2.3.6-24.3.3
[
{
"Id": "sha256:7fef2dfbf9c215037758a3e9f39c48a8099ee1b15efcd7bbefd989cbf1163334",
"RepoTags": [
"docker.redpanda.com/redpandadata/redpanda-operator:v2.3.6-24.3.3"
],
"RepoDigests": [
"docker.redpanda.com/redpandadata/redpanda-operator@sha256:7fef2dfbf9c215037758a3e9f39c48a8099ee1b15efcd7bbefd989cbf1163334"
],
"Parent": "",
"Comment": "buildkit.dockerfile.v0",
"Created": "2025-01-21T16:19:38.659807584Z",
"DockerVersion": "27.5.1",
"Author": "",
"Config": {
"Hostname": "",
"Domainname": "",
"User": "65532:65532",
"AttachStdin": false,
"AttachStdout": false,
"AttachStderr": false,
"Tty": false,
"OpenStdin": false,
"StdinOnce": false,
"Env": [
"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
"SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt"
],
"Cmd": null,
"Image": "",
"Volumes": null,
"WorkingDir": "/",
"Entrypoint": [
"/redpanda-operator",
"run"
],
"OnBuild": null,
"Labels": null
},
"Architecture": "arm64",
"Os": "linux",
"Size": 58137630,
"GraphDriver": {
"Data": null,
"Name": "stargz"
},
"RootFS": {
"Type": "layers",
"Layers": [
"sha256:0a86283d35175f8d95b76ec85d7a7fb63f44a07ffdfa8d4d7310b0bbd49ce710",
"sha256:8fa10c0194df9b7c054c90dbe482585f768a54428fc90a5b78a0066a123b1bba",
"sha256:a80545a98dcd0866ae5eeadc9a28dec703b1e54a01ce8ff245e83f48261fe575",
"sha256:4d049f83d9cf21d1f5cc0e11deaf36df02790d0e60c1a3829538fb4b61685368",
"sha256:af5aa97ebe6ce1604747ec1e21af7136ded391bcabe4acef882e718a87c86bcc",
"sha256:6f1cdceb6a3146f0ccb986521156bef8a422cdbb0863396f7f751f575ba308f4",
"sha256:bbb6cacb8c82e4da4e8143e03351e939eab5e21ce0ef333c42e637af86c5217b",
"sha256:2a92d6ac9e4fcc274d5168b217ca4458a9fec6f094ead68d99c77073f08caac1",
"sha256:1a73b54f556b477f0a8b939d13c504a3b4f4db71f7a09c63afbc10acb3de5849",
"sha256:f4aee9e53c42a22ed82451218c3ea03d1eea8d6ca8fbe8eb4e950304ba8a8bb3",
"sha256:b336e209998fa5cf0eec3dabf93a21194198a35f4f75612d8da03693f8c30217",
"sha256:14ef04b98447671c6b8c6ec2c0b637efad56242c4ad071ce611c30217b81fc5b",
"sha256:d7033653162aa636921993cb113854deac269958ffb7d6a182eef90064522665"
]
},
"Metadata": {
"LastTagTime": "2025-02-16T18:51:48.426929876Z"
}
}
]
```