[Windows] nerdctl pull error: "no match for platform in manifest: not found"

[TinaMor]

Description

nerdctl misidentifies the host architecture, leading to incompatibility with the Windows container image.

Steps to reproduce the issue

1. Build the app from a Windows device without setting the GOOS and GOARCH env variables.
2. nerdctl pull --debug mcr.microsoft.com/windows/nanoserver:ltsc2022

Describe the results you received and expected

Expected solution

User should not have to specify the GOARCH. It should pick the correct architecture automatically, by default, on build.

Actual output:
level=fatal msg="no match for platform in manifest: not found"

Complete logs:

time="2024-08-30T02:08:06+03:00" level=debug msg="verifying process skipped"
time="2024-08-30T02:08:06+03:00" level=debug msg="Ignoring hosts dir \"C:\\\\ProgramData\\\\containerd\\\\certs.d\"" error="CreateFile C:\\ProgramData\\containerd\\certs.d: The system cannot find the file specified."
time="2024-08-30T02:08:06+03:00" level=debug msg="Ignoring hosts dir \"C:\\\\ProgramData\\\\docker\\\\certs.d\"" error="CreateFile C:\\ProgramData\\docker\\certs.d: The system cannot find the file specified."
time="2024-08-30T02:08:06+03:00" level=debug msg="The image will be unpacked for platform {\"386\" \"windows\" \"10.0.22631\" [] \"\"}, snapshotter \"windows\"."
time="2024-08-30T02:08:06+03:00" level=debug msg=fetching image="mcr.microsoft.com/windows/nanoserver:ltsc2022"
time="2024-08-30T02:08:06+03:00" level=debug msg=resolving host=mcr.microsoft.com
time="2024-08-30T02:08:06+03:00" level=debug msg="do request" host=mcr.microsoft.com request.header.accept="application/vnd.docker.distribution.manifest.v2+json, application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.oci.image.manifest.v1+json, application/vnd.oci.image.index.v1+json, */*" request.header.user-agent=containerd/2.0.0-rc.4+unknown request.method=HEAD url="https://mcr.microsoft.com/v2/windows/nanoserver/manifests/ltsc2022"
time="2024-08-30T02:08:07+03:00" level=debug msg="fetch response received" host=mcr.microsoft.com response.header.access-control-expose-headers=Docker-Content-Digest response.header.access-control-expose-headers.1=WWW-Authenticate response.header.access-control-expose-headers.2=Link response.header.access-control-expose-headers.3=X-Ms-Correlation-Request-Id response.header.content-length=350 response.header.content-type=application/vnd.docker.distribution.manifest.list.v2+json response.header.date="Thu, 29 Aug 2024 23:08:07 GMT" response.header.docker-content-digest="sha256:244113e50a678a25a63930780f9ccafd22e1a37aa9e3d93295e4cebf0f170a11" response.header.docker-distribution-api-version=registry/2.0 response.header.etag="\"sha256:244113e50a678a25a63930780f9ccafd22e1a37aa9e3d93295e4cebf0f170a11\"" response.header.strict-transport-security="max-age=31536000; includeSubDomains" response.header.strict-transport-security.1="max-age=31536000; includeSubDomains" response.header.x-cache=CONFIG_NOCACHE response.header.x-content-type-options=nosniff response.header.x-mcr-env=prod response.header.x-mcr-privacy="https://privacy.microsoft.com/en-us/privacystatement" response.header.x-ms-client-request-id= response.header.x-ms-correlation-request-id=172079c0-726c-4d55-aa3c-ff5030716531 response.header.x-ms-request-id=26a9c7eb-4ef0-4f30-b596-8d5df21dbe8f response.header.x-msedge-ref="Ref A: D22FC438C15F4471B73694BE2740E6F2 Ref B: MRS211050315049 Ref C: 2024-08-29T23:08:08Z" response.status="200 OK" url="https://mcr.microsoft.com/v2/windows/nanoserver/manifests/ltsc2022"
time="2024-08-30T02:08:07+03:00" level=debug msg=resolved desc.digest="sha256:244113e50a678a25a63930780f9ccafd22e1a37aa9e3d93295e4cebf0f170a11" host=mcr.microsoft.com
time="2024-08-30T02:08:07+03:00" level=debug msg=fetch digest="sha256:244113e50a678a25a63930780f9ccafd22e1a37aa9e3d93295e4cebf0f170a11" mediatype=application/vnd.docker.distribution.manifest.list.v2+json size=350
mcr.microsoft.com/windows/nanoserver:ltsc2022: resolving      |--------------------------------------|
elapsed: 1.0 s                                 total:   0.0 B (0.0 B/s)
time="2024-08-30T02:08:07+03:00" level=debug msg="do request" digest="sha256:244113e50a678a25a63930780f9ccafd22e1a37aa9e3d93295e4cebf0f170a11" mediatype=application/vnd.docker.distribution.manifest.list.v2+json request.header.accept="application/vnd.docker.distribution.manifest.list.v2+json, */*" request.header.accept-encoding="zstd;q=1.0, gzip;q=0.8, deflate;q=0.5" request.header.user-agent=containerd/2.0.0-rcmcr.microsoft.com/windows/nanoserver:ltsc2022:                                 resolved       |++++++++++++++++++++++++++++++++++++++|
index-sha256:244113e50a678a25a63930780f9ccafd22e1a37aa9e3d93295e4cebf0f170a11: downloading    |--------------------------------------|    0.0 B/350.0 B
elapsed: 1.5 s                                                                 total:   0.0 B (0.0 B/s)                                   
time="2024-08-30T02:08:08+03:00" level=debug msg="fetch response received" digest="sha256:244113e50a678a25a63930780f9ccafd22e1a37aa9e3d93295e4cebf0f170a11" mediatype=application/vnd.docker.distribution.manifest.list.v2+json response.header.access-control-expose-headers=Docker-Content-Digest response.header.access-control-expose-headers.1=WWW-Authenticate response.header.access-control-expose-headers.2=Link response.header.access-control-expose-headers.3=X-Ms-Correlation-Request-Id response.header.content-length=350 response.header.content-type=application/vnd.docker.distribution.manifest.list.v2+json response.header.date="Thu, 29 Aug 2024 23:08:08 GMT" response.header.docker-content-digest="sha256:244113e50a678a25a63930780f9ccafd22e1a37aa9e3d93295e4cebf0f170a11" response.header.docker-distribution-api-version=registry/2.0 response.header.etag="\"sha256:244113e50a678a25a63930780f9ccafd22e1a37aa9e3d93295e4cebf0f170a11\"" response.header.strict-transport-security="max-age=31536000; includeSubDomains" response.header.strict-transport-security.1="max-age=31536000; includeSubDomains" response.header.x-cache=CONFIG_NOCACHE response.header.x-content-type-options=nosniff response.header.x-mcr-env=prod response.header.x-mcr-privacy="https://privacy.microsoft.com/en-us/privacystatement" response.header.x-ms-client-request-id= response.header.x-ms-correlation-request-id=7c1579a5-b21e-483d-a469-6e367dd5a570 response.header.x-ms-request-id=a4ae2b53-fbf5-4617-80c8-16174e2c717f response.header.x-msedge-ref="Ref A: 05109D2997F5497AA03AD7A654C07830 Ref B: MRS211050313029 Ref C: 2024-08-29T23:08:08Z" response.status="200 OK" size=350 url="https://mcr.microsoft.com/v2/windows/nanoserver/manifests/sha256:244113e50a678a25a63930780f9ccafd22e1a37aa9e3d93295e4cebf0f170a11"
time="2024-08-30T02:08:08+03:00" level=fatal msg="no match for platform in manifest: not found"

Temporary solution (HACK)

Specify the architecture when building the app:

$env:GOOS = "windows"
$env:GOARCH = "amd64"
go build -o .\_output\ .\cmd\nerdctl\

What version of nerdctl are you using?

Are you using a variant of nerdctl? (e.g., Rancher Desktop)

None

Host information

(Check regression: #3158 )

[TinaMor]

The error seems to come from here:

nerdctl/cmd/nerdctl/image_pull.go

Lines 82 to 90 in 1a55c72

	platform, err := cmd.Flags().GetStringSlice("platform")
	if err != nil {
	return types.ImagePullOptions{}, err
	}
	ociSpecPlatform, err := platformutil.NewOCISpecPlatformSlice(allPlatforms, platform)
	if err != nil {
	return types.ImagePullOptions{}, err
	}

[AkihiroSuda]

windows/386

Looks like nerdctl is built as a 32-bit binary on your environment?
This seems unusual configuration on modern Windows machines?

[apostasie]

windows/386

Looks like nerdctl is built as a 32-bit binary on your environment? This seems unusual configuration on modern Windows machines?

That is really weird.

Build the app from a Windows device without setting the GOOS and GOARCH env variables.

@TinaMor can you clarify how you built it?
Did you just call make binaries?
What was in the environment?

[TinaMor]

Using go build, without setting $env:GOARCH = "amd64". With "make binaries`, it's ok

[apostasie]

Using go build, without setting $env:GOARCH = "amd64". With "make binaries`, it's ok

Could you paste here:

• the exact go build command you used
• the output of go env

Thanks.

[TinaMor]

Go version: go version go1.22.6 windows/amd64

go build:
go build -o .\_output\ .\cmd\nerdctl\

go env:

set GO111MODULE=
set GOARCH=amd64
set GOBIN=
set GOCACHE=C:\Users\xxxx\AppData\Local\go-build
set GOENV=C:\Users\xxxx\AppData\Roaming\go\env
set GOEXE=.exe
set GOEXPERIMENT=
set GOFLAGS=
set GOHOSTARCH=amd64
set GOHOSTOS=windows
set GOINSECURE=
set GOMODCACHE=C:\Users\xxxx\go\pkg\mod
set GONOPROXY=
set GONOSUMDB=
set GOOS=windows
set GOPATH=C:\Users\xxxx\go
set GOPRIVATE=
set GOPROXY=https://proxy.golang.org,direct
set GOROOT=C:\Program Files\Go
set GOSUMDB=sum.golang.org
set GOTMPDIR=
set GOTOOLCHAIN=auto
set GOTOOLDIR=C:\Program Files\Go\pkg\tool\windows_amd64
set GOVCS=
set GOVERSION=go1.22.6
set GCCGO=gccgo
set GOAMD64=v1
set AR=ar
set CC=gcc
set CXX=g++
set CGO_ENABLED=0
set GOMOD=C:\xxx\go.mod
set GOWORK=
set CGO_CFLAGS=-O2 -g
set CGO_CPPFLAGS=
set CGO_CXXFLAGS=-O2 -g
set CGO_FFLAGS=-O2 -g
set CGO_LDFLAGS=-O2 -g
set PKG_CONFIG=pkg-config
set GOGCCFLAGS=-m64 -fno-caret-diagnostics -Qunused-arguments -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=C:\Users\xxxx\AppData\Local\Temp\go-build664347763=/tmp/go-build -gno-record-gcc-switches

Also this fails: go test ./cmd/nerdctl/container/... -run=TestRunWithTtyAndDetached. Even after setting both $env:GOARCH="amd64" and $env:GOOS="windows"

time="2024-09-05T10:42:01+03:00" level=fatal msg="no match for platform in manifest: not found"

[apostasie]

This is wild.

Can you
command -v nerdctl

And also do comparison with file, between the resulting binary of make binaries (which you said was fine?) and the result of your go build command?