# Docker Push "unsupported MediaType" / "manifest invalid" to Registry in CI

> Fix Docker push "manifest invalid: unsupported MediaType" / OCI-vs-Docker manifest errors in CI - a registry that rejects the OCI image format buildx produced.

Source: https://latchkey.dev/learn/docker/docker-unsupported-media-type-manifest-push  
Updated: 2026-06-25

The registry rejected the image manifest because it did not accept the media type buildx pushed. Modern buildx emits OCI-format manifests by default, and some older or strict registries only accept the classic Docker schema2 format.

## Diagnose it: separate auth from naming from rate limits

Registry errors look alike and have unrelated causes. Work out which of the three you have before changing credentials, because a malformed image reference produces an error that reads like an authentication failure.

```Terminal
# 1. is the reference even valid? (lowercase, no spaces, valid tag)
docker image inspect "$IMAGE" 2>&1 | head -2

# 2. are you authenticated to the right registry?
cat ~/.docker/config.json | grep -o '"[^"]*\.[^"]*"' | head

# 3. are you rate limited? (Docker Hub anonymous pulls)
curl -s "https://auth.docker.io/token?service=registry.docker.io&scope=repository:ratelimit-preview/test:pull" \
  | grep -o '"token"' >/dev/null && echo "token ok"
```

> Docker Hub rate-limits anonymous pulls by IP, and CI runners share IPs. A pull that works on your laptop and fails in CI with no config change is usually this, not credentials.

## Authenticate in the job, not in the image

```.github/workflows/ci.yml
- uses: docker/login-action@v3
  with:
    registry: ghcr.io
    username: ${{ github.actor }}
    password: ${{ secrets.GITHUB_TOKEN }}

# GHCR needs this on the job or the push is rejected as unauthorised
permissions:
  contents: read
  packages: write
```

## FAQ

### What causes Docker push "unsupported MediaType" / "manifest invalid" to registry in CI?

There are 2 common causes: registry does not accept oci media types and oci-specific features in the manifest. buildx defaults to OCI image manifests.

### How do I fix Docker push "unsupported MediaType" / "manifest invalid" to registry in CI?

There are 2 fixes depending on which cause you have: push in docker (schema2) media-type format and disable attestations that the registry rejects. Work through them in order, since the first is the most common.

### What does Docker push "unsupported MediaType" / "manifest invalid" to registry in CI actually mean?

A docker buildx build --push fails on the manifest with manifest invalid: unsupported MediaType or manifest blob unknown tied to an OCI media type.

### How do I stop Docker push "unsupported MediaType" / "manifest invalid" to registry in CI happening again?

Confirm the target registry supports OCI manifests before relying on them. The prevention section lists 3 changes that keep it from recurring.

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt