Docker "--provenance"/"--sbom" Attestations Break --load or an Older Registry

By Daniel Zoghalchali·Latchkey

buildx attaches provenance and SBOM attestations by default for registry pushes. Those attestations make the output a manifest list with extra attestation manifests, which a plain --load cannot import and some older registries cannot store.

What this error means

A build with default attestations fails on --load (the result is an unexpected manifest list) or on push to an older registry that rejects the attestation manifests. Disabling provenance/SBOM makes the same build succeed.

docker buildx output

ERROR: docker exporter does not currently support exporting manifest lists
# (default provenance turned a single-platform --load build into a manifest list)
# or on push:  manifest invalid: unsupported manifest media type

Diagnose it: build context, cache, or platform?

A Dockerfile that builds locally and fails in CI usually differs in one of three ways: the build context contains different files, the layer cache is cold or poisoned, or the runner architecture does not match what the base image provides.

Terminal

# what is actually being sent as build context (dockerignore applies)
docker build --no-cache --progress=plain -t probe . 2>&1 | head -40

# what platform are you on, and what does the base image support?
docker version --format '{{.Server.Arch}}'
docker buildx imagetools inspect <base-image> | grep -i platform

# prove it is not a cache artefact
docker build --no-cache .

Common causes

Default provenance makes the output a manifest list

When buildx adds a provenance attestation, even a single-platform build becomes a manifest list (image + attestation). --load into the classic store then fails the same way a multi-arch build would.

The registry cannot store attestation manifests

Older or limited registries may reject the attestation manifest media types, failing the push with an "unsupported"/"manifest invalid" error.

How to fix it

Disable attestations when loading or targeting an old registry

Turn off provenance/SBOM so the output is a plain single-platform image.

Terminal

docker buildx build --provenance=false --sbom=false --load -t myorg/api:1.4.2 .

Control attestations in build-push-action

The action exposes a provenance input; set it to false for incompatible targets.

.github/workflows/build.yml

- uses: docker/build-push-action@v6
  with:
    push: true
    provenance: false
    sbom: false

Keep the build context small and deterministic

A missing .dockerignore sends node_modules, .git, and build output to the daemon, which is slow and can change layer hashes between environments.
A COPY of a path that exists locally but is gitignored will fail in CI, because the runner only has what the checkout produced.
Multi-arch builds need buildx and QEMU set up explicitly; a plain docker build on an ARM runner silently produces an ARM image.

How to prevent it

Keep provenance/SBOM on for registries that support them.
Disable attestations for --load and legacy-registry pushes.
Confirm your registry supports attestation manifests before relying on them.

Frequently asked questions

What causes Docker "--provenance"/"--sbom" attestations break --load or an older registry?

There are 2 common causes: default provenance makes the output a manifest list and the registry cannot store attestation manifests. When buildx adds a provenance attestation, even a single-platform build becomes a manifest list (image + attestation).

How do I fix Docker "--provenance"/"--sbom" attestations break --load or an older registry?

There are 2 fixes depending on which cause you have: disable attestations when loading or targeting an old registry and control attestations in build-push-action. Work through them in order, since the first is the most common.

What does Docker "--provenance"/"--sbom" attestations break --load or an older registry actually mean?

A build with default attestations fails on --load (the result is an unexpected manifest list) or on push to an older registry that rejects the attestation manifests.

How do I stop Docker "--provenance"/"--sbom" attestations break --load or an older registry happening again?

Keep provenance/SBOM on for registries that support them. The prevention section lists 3 changes that keep it from recurring.