fix(local): resolve loaded images by their manifest digest on the containerd image store

[alongubkin]

What

Local container deploys (alien dev and local deployments of container resources) failed on Docker's containerd image store with Docker did not load image sha256:…. The containerd store is the default for new Docker Desktop installs.

Why

After docker load, the loaded image was looked up by its config digest. That is the image ID on the classic image store, but on the containerd store the image ID is the manifest digest listed in the archive's index.json.

How

After loading, read the single manifest digest from the archive's index.json and inspect it first. If that returns 404, fall back to the config digest. Both values are immutable, so a stale image left under the same tag by an earlier load can never be resolved by mistake. A 404 on both IDs, or any other inspect error, fails the deploy with both digests in the message.

Verification

• New ignored integration test crates/alien-local/tests/container_image_stores.rs. For each image store it starts a disposable docker:28-dind daemon (one with --feature containerd-snapshotter, one classic) and asserts which store is active. It then loads two releases built under the same tag and checks that each container runs its own release's content from a distinct image. It passed locally. On the unfixed code it fails on the containerd store with the original Docker did not load image error.

• The existing container_image_releases test (host classic store) still passes.

• cargo test -p alien-local: everything passes except worker_integration, which needs the TypeScript SDK built and was not set up in this worktree.

• End-to-end with the CLI built from this branch: alien dev on a Python source container against a docker:28-dind daemon running the containerd image store (driver-type io.containerd.snapshotter.v1), reached through a unix-socket DOCKER_HOST. The deployment reached Running, the container's image ID was the archive's manifest digest, and the app answered over HTTP. After editing the app, alien dev release replaced the container with a new image ID and the app served the new response.

cargo nextest run -p alien-local --test container_image_stores --run-ignored all

🤖 Generated with Claude Code

[greptile-apps]

Confidence Score: 5/5

[High risk] Changes how container images are identified after loading.

The PR appears safe to merge based on the reviewed changes.

Summary

The PR resolves locally loaded OCI images by trying the archive’s manifest digest, then its config digest, so deployments work with both Docker image stores.

• The latest change permits multi-entry indexes by selecting their first descriptor.
• An ignored integration test exercises repeated-tag loads against both image stores.

_{Reviews (2) · Last reviewed commit: "fix(local): read the first index.json im..."}

[alongubkin]

@greptileai review