Quay "manifest blob unknown" on push in CI

The registry accepted the manifest but it points to a blob (a layer or the config) the registry does not have. This happens when a layer upload was skipped, failed, or the manifest was pushed before all blobs finished. Re-push so every referenced blob is uploaded first.

What this error means

docker push to Quay fails with "manifest blob unknown: blob unknown to registry" referencing a digest, after some layers reported "Layer already exists".

app: manifest blob unknown: blob unknown to registry
sha256:9f8e... unknown

Common causes

A referenced layer or config blob was not uploaded

The client assumed a blob already existed (mount/dedup) but the registry does not have it, so the manifest references a missing blob.

An interrupted or out-of-order push

A dropped connection or a manifest pushed before its blobs leaves the registry without all referenced content.

How to fix it

Re-push the full image

1. Re-run the push so all blobs upload before the manifest.
2. If using buildx, ensure the build output includes every referenced layer.
3. For cross-repo mounts, push the base layers to the same namespace first.

docker push quay.io/org/app:latest

Disable blob mounting if the source repo is unreadable

When cross-repository blob mount fails silently, push layers directly instead of relying on mount from a repo the robot cannot read.

How to prevent it

• Let pushes complete fully before pushing dependent manifests.
• Ensure all referenced layers exist in the target namespace.
• Retry transient push interruptions rather than reusing a partial state.

Related guides