[Bug]: Stage name not resolved correctly in multi-stage build

[jensenturner]

I have done the following

• I have searched the existing issues
• If possible, I've reproduced the issue using the 'main' branch of this project

Steps to reproduce

Run any multi-stage build that uses a previous stage as a new stage. I am using the following Dockerfile for a minimal reproduction:

FROM alpine AS layer1
RUN sh -c "echo 'layer1' > /layer1.txt"

FROM layer1
CMD ["cat", "/layer1.txt"]

Current behavior

It appears the stage name layer1 is being interpreted as the name of an image in the Docker registry. In this comment in issue 149 it is explicitly stated that multi-stage builds are supported. From what I can tell, local name resolution behavior was recently discussed in #223 and apple/container-builder-shim#34.

Expected behavior

Building this image should succeed, as it does with Docker Desktop 4.43.1.

Running it with the default command should print 'layer1'.

Environment

- OS: 26.0 Beta (25A5306g)
- Xcode: 26.0 Beta 3 (17A5276g)
- Container: container CLI version 0.2.0-16-ge09e932 (build: release, commit: e09e932)

Relevant log output

$ cat Dockerfile
FROM alpine AS layer1
RUN sh -c "echo 'layer1' > /layer1.txt"

FROM layer1
CMD ["cat", "/layer1.txt"]

$ container build -t stage-mre .
[+] Building 0.0s (0/1)
 => [resolver] fetching image...docker.io/library/alpine                                                                                                                                                   0.0s
Error: internalError: "HTTP request to https://registry-1.docker.io/v2/library/layer1/manifests/latest failed with response: 401 Unauthorized. Reason: Unknown. No credentials found for host registry-1.docker.io"

$ docker build -t stage-mre .
[+] Building 0.9s (6/6) FINISHED                                                                                                                                                           docker:desktop-linux
 => [internal] load build definition from Dockerfile                                                                                                                                                       0.0s
 => => transferring dockerfile: 143B                                                                                                                                                                       0.0s
 => [internal] load metadata for docker.io/library/alpine:latest                                                                                                                                           0.8s
 => [internal] load .dockerignore                                                                                                                                                                          0.0s
 => => transferring context: 2B                                                                                                                                                                            0.0s
 => [layer1 1/2] FROM docker.io/library/alpine:latest@sha256:8a1f59ffb675680d47db6337b49d22281a139e9d709335b492be023728e11715                                                                              0.0s
 => => resolve docker.io/library/alpine:latest@sha256:8a1f59ffb675680d47db6337b49d22281a139e9d709335b492be023728e11715                                                                                     0.0s
 => CACHED [layer1 2/2] RUN sh -c "echo 'layer1' > /layer1.txt"                                                                                                                                            0.0s
 => exporting to image                                                                                                                                                                                     0.0s
 => => exporting layers                                                                                                                                                                                    0.0s
 => => exporting manifest sha256:cbecba98e6e2aaba361ec8d4ce4f0f21003ca37f8f36810ec35f5bbe5bcfa84a                                                                                                          0.0s
 => => exporting config sha256:17baf91fe3b8d4eb2900ec32d8cf8dfb5751a6c61a41bd7db1576deab4f89910                                                                                                            0.0s
 => => exporting attestation manifest sha256:f0343fa3bd60127040ff10606422c6ee18040c4fe4bfe61272385c9e9c3b6175                                                                                              0.0s
 => => exporting manifest list sha256:e3ac3e19e2d4d0b560691d6d18e91b69d131800c7376884ada287be7f5bc56c6                                                                                                     0.0s
 => => naming to docker.io/library/stage-mre:latest                                                                                                                                                        0.0s
 => => unpacking to docker.io/library/stage-mre:latest

Code of Conduct

• I agree to follow this project's Code of Conduct

[katiewasnothere]

Hi @jensenturner thanks for the report. I think this issue is happening because we do some preprocessing of the stages in our builder-shim here to resolve any images that are needed for the build. Looks like we always assume that a stage has an image name provided that needs to be resolved.

I'm planning to look to see when this feature was added in buildkit and then how best to fix it in the builder-shim. I'd love any input or suggestions if anyone has any!

[Vargas1205]

5579100485793192