docker push Failing Since Docker 29.7? Two Causes

Failure one: blob unknown to registry

From BuildKit 0.32, which Docker 29.7 bundles, the provenance record pushed next to your image (the attestation) is stored as an OCI artifact that points at the image. BuildKit uploads that record before the image itself. The OCI distribution spec says registries must accept that order. Some do not, GitLab's among them, and they answer:

error from registry: blob unknown to registry - sha256:…

The giveaway is the digest: it is your image manifest's digest, the one the build log prints as exporting manifest, not a layer's. The fix keeps your provenance and changes only its format:

export BUILDX_NO_DEFAULT_OCI_ARTIFACT=1   # Buildx 0.36.1 or later
docker build -t registry.example.com/app:1.0 .
docker push registry.example.com/app:1.0

Rebuild after setting it; an image already built keeps the format it was built with.

Failure two: timeout awaiting response headers

containerd 2.3, which Docker uses for its default image store since 29.7, gives a registry 30 seconds to start answering each request. Registries that copy or scan a large layer before confirming it, such as Nexus or Harbor on slow storage, take longer for multi-gigabyte layers. The upload reaches 100%, waits about 30 seconds, and fails on the same layer every retry.

The limit is not configurable yet. To push from the classic store, set this in /etc/docker/daemon.json and restart Docker :

{ "features": { "containerd-snapshotter": false } }

For a dind service, start it with --feature=containerd-snapshotter=false.

Where to go next

Both have full pages: blob unknown to registry and timeout awaiting response headers.