Docker Push "unsupported MediaType" / "manifest invalid" to Registry in CI

By Daniel Zoghalchali·Latchkey

The registry rejected the image manifest because it did not accept the media type buildx pushed. Modern buildx emits OCI-format manifests by default, and some older or strict registries only accept the classic Docker schema2 format.

What this error means

A docker buildx build --push fails on the manifest with manifest invalid: unsupported MediaType or manifest blob unknown tied to an OCI media type. The layers may upload, but the manifest is refused.

failed to push: unexpected status: 400 Bad Request
manifest invalid: manifest invalid: unsupported MediaType:
application/vnd.oci.image.manifest.v1+json

Diagnose it: separate auth from naming from rate limits

Registry errors look alike and have unrelated causes. Work out which of the three you have before changing credentials, because a malformed image reference produces an error that reads like an authentication failure.

# 1. is the reference even valid? (lowercase, no spaces, valid tag)
docker image inspect "$IMAGE" 2>&1 | head -2

# 2. are you authenticated to the right registry?
cat ~/.docker/config.json | grep -o '"[^"]*\.[^"]*"' | head

# 3. are you rate limited? (Docker Hub anonymous pulls)
curl -s "https://auth.docker.io/token?service=registry.docker.io&scope=repository:ratelimit-preview/test:pull" \
  | grep -o '"token"' >/dev/null && echo "token ok"

Common causes

Registry does not accept OCI media types

buildx defaults to OCI image manifests. An older registry (or one configured strictly) only understands application/vnd.docker.distribution.manifest.v2+json, so it rejects the OCI manifest.

OCI-specific features in the manifest

Provenance/SBOM attestations or annotations buildx adds can trip a registry that does not support those OCI extensions.

How to fix it

Push in Docker (schema2) media-type format

Tell buildx to emit Docker-format manifests instead of OCI.

docker buildx build \
  --output type=image,name=myorg/api:1.4.2,oci-mediatypes=false,push=true .

Disable attestations that the registry rejects

Turn off provenance/SBOM if the registry cannot store them.

docker buildx build --provenance=false --sbom=false --push -t myorg/api:1.4.2 .

Authenticate in the job, not in the image

- uses: docker/login-action@v3
  with:
    registry: ghcr.io
    username: ${{ github.actor }}
    password: ${{ secrets.GITHUB_TOKEN }}

# GHCR needs this on the job or the push is rejected as unauthorised
permissions:
  contents: read
  packages: write

How to prevent it

• Confirm the target registry supports OCI manifests before relying on them.
• Set oci-mediatypes=false for legacy registries that need schema2.
• Disable provenance/SBOM for registries that cannot store attestations.

Frequently asked questions

Related guides

References

• Docker documentation
• Docker build cache
• GitHub Actions documentation