CrazyMax

Looks like a duplicate of https://github.com/docker/build-push-action/issues/252, let's continue the discussion there. Also you should consider switching to `gha` cache exporter: https://docs.docker.com/build/ci/github-actions/cache/#github-cache

We don't but you can set entitlements when creating a builder through `buildkitd-flags` input in `setup-buildx-action` or the BuildKit configuration. If you can explain a bit more your use case...

> But I'm not convinced this would fix the reported (and out) issue. Does it not work on your side? Edit: Oh you mean when fetching cache I think right?

Seems an issue with GHCR not being able to parse an OCI index or it tries to parse manifest attestations but fails to display infos from labels. Pure speculation but...

Same as https://github.com/docker/setup-buildx-action/issues/187#issuecomment-1398145669

> But it seems the core issue -- [moby/moby#43126](https://github.com/moby/moby/issues/43126) -- has been fixed already? Yes Docker tooling is fixed > Or is GHCR using something else that reads OCI incorrectly?...

I think the current API for the Kubernetes driver in Buildx is using the `pod.spec`. For this case we would need a driver option to use [`ephemeralcontainers`](https://kubernetes.io/docs/concepts/workloads/pods/ephemeral-containers/#what-is-an-ephemeral-container) maybe? Any idea...

Can you post a basic Dockerfile for repro please?

Similar to https://github.com/docker/setup-buildx-action/issues/112#issuecomment-964281972, when using `uses: docker/setup-buildx-action@v3` it will create container builder. Therefore you need to [set up registry certificates for BuildKit](https://docs.docker.com/build/buildkit/configure/#setting-registry-certificates).

Can you give more details?