NerdCTL will not use local image when building

Question

I am trying to build a common base image, that many of my other images will use. But Nerdctl/Containerd doesn't seem to check for the image locally first.

Reproduced with the simple example

# Dockerfile.base
FROM python:3

# Dockerfile.child
From mybase:local

OUTPUT:

PS C:\<REDACTED>\local_build_issue> nerdctl build -t mybase:local -f Dockerfile.base .        
[+] Building 10.1s (5/5) FINISHED
 => [internal] load build definition from Dockerfile.base                0.1s
 => => transferring dockerfile: 55B                                      0.0s 
 => [internal] load .dockerignore                                        0.0s 
 => => transferring context: 2B    0.0s 
 => [internal] load metadata for docker.io/library/python:3              0.9s 
 => CACHED [1/1] FROM docker.io/library/python:3@sha256:555f5affd32250ca74758b297f262fa8f421eb0102877596b48c0b8b464606ea     0.0s
 => => resolve docker.io/library/python:3@sha256:555f5affd32250ca74758b297f262fa8f421eb0102877596b48c0b8b464606ea     0.0s 
 => exporting to oci image format                                        9.0s 
 => => exporting layers            0.0s 
 => => exporting manifest sha256:6bfdb5e41f7a1f0faf28f922e48cdd33e95b75cff958709cb7945291d34dffda        0.0s 
 => => exporting config sha256:d449529a9f8347e81301101d04645624c6a52d71b0c6b85abfd8da6c65b19e31          0.0s 
 => => sending tarball             9.0s 
unpacking docker.io/library/mybase:local (sha256:6bfdb5e41f7a1f0faf28f922e48cdd33e95b75cff958709cb7945291d34dffda)...done

PS C:\<REDACTED>\local_build_issue> nerdctl images
REPOSITORY    TAG      IMAGE ID        CREATED               PLATFORM       SIZE         BLOB SIZE
mybase        local    6bfdb5e41f7a    About a minute ago    linux/amd64    945.8 MiB    334.7 MiB
PS C:\<REDACTED>\local_build_issue> nerdctl build -t mychild:local -f Dockerfile.child .
[+] Building 0.5s (3/3) FINISHED
 => [internal] load build definition from Dockerfile.child                                               0.1s
 => => transferring dockerfile: 62B                                                                      0.0s 
 => [internal] load .dockerignore                                                                        0.0s 
 => => transferring context: 2B                                                                          0.0s 
 => ERROR [internal] load metadata for docker.io/library/mybase:local                                    0.4s 
------
 > [internal] load metadata for docker.io/library/mybase:local:
------
Dockerfile.child:1
--------------------
   1 | >>> FROM mybase:local
   2 |
--------------------
error: failed to solve: mybase:local: pull access denied, repository does not exist or may require authorization: authorization status: 401: authorization failed
FATA[0000] unrecognized image format

I can't figure out how to get it to NOT look for the image on docker.io. All the recommendations for the docker cli do not seem apply or work.

Answer 1

I was able to get around this by using the "buildkit" namespace to build the first image using Rancher Desktop with nerdctl.

For example, using your example files build the first image like so:

nerdctl --namespace buildkit -t mybase:local -f Dockerfile.base .

And then the build for the second image should work.

nerdctl build -t mychild:local -f Dockerfile.child .

I think that local items get built from the buildkit namespace, so you can check nerdctl --namespace buildkit image ls to see what can images can be used locally.

Answer 2

it actually can't pull image locally first . the nerdctl build image use the buildkitd tools.it has two types of backends. you can find the answer from https://github.com/containerd/nerdctl/blob/master/docs/build.md