fix: stop pulling wrong platform for images

smira · smira · commit d7779a5ba193 · 2026-03-18T20:59:17.000+04:00
Attempt to fix intermittent issue with images being pulled with the wrong platform for multi-platform images. The Claude did the analysis, and I think the root cause is that the `DefaultSpec()` we used causes the match to include `variant` which is e.g. `v8` for arm64, while if the image doesn't declare the exact variant, it might skip filtering and pick up the first layer which is amd64. It is still not clear why exactly it is intermittent this way. But this change aligns it more closely with the way containerd pulls, so should be good to go. Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com> (cherry picked from commit ee53a18)
diff --git a/internal/pkg/containers/image/image.go b/internal/pkg/containers/image/image.go
@@ -123,7 +123,7 @@ func Pull(ctx context.Context, registryBuilder RegistriesBuilder, client *contai
 			containerd.WithPullUnpack,
 			containerd.WithResolver(resolver),
 			containerd.WithChildLabelMap(images.ChildGCLabelsFilterLayers),
-			containerd.WithPlatformMatcher(platforms.OnlyStrict(platforms.DefaultSpec())),
+			containerd.WithPlatformMatcher(platforms.Default()),
 		); err != nil {
 			err = fmt.Errorf("failed to pull image %q: %w", ref, err)
 			if errors.Is(err, errdefs.ErrNotFound) {
