fix: When pushing images to registry cache, use image-manifest=true

Without this change, when building images with --cache-to-registry,
BuildKit uses a proprietary cache artifact format, which breaks
when using third-party registries such as Harbor or ECR.

By adding the image-manifest=true option, BuildKit uses an
OCI-compliant cache artifact format that should be compatible with all
registries. This option requires BuildKit 0.12 or later (check with
"docker buildx ls").

See goharbor/harbor#18941 and
moby/buildkit#2251 for background
information.

Co-authored-by: Andrés González <[email protected]>

Fixes #1118.

changelog.d/20241119_111602_fghaas_image_manifest.md

@@ -0,0 +1,8 @@
+- [Improvement] When building images with
+  `tutor images build --cache-to-registry`, use an OCI-compliant cache
+  artifact format that should be universally compatible with all
+  registries. This enables the use of that option when working with
+  third-party registries such as [Harbor](https://goharbor.io/) or
+  [ECR](https://aws.amazon.com/ecr/). Requires
+  [BuildKit 0.12](https://github.com/moby/buildkit/releases/tag/v0.12.0)
+  or later. (by @angonz and @fghaas)

tutor/commands/images.py

@@ -227,7 +227,7 @@ def build(
                 image_build_args.append(f"--cache-from=type=registry,ref={tag}-cache")
             if cache_to_registry:
                 image_build_args.append(
-                    f"--cache-to=type=registry,mode=max,ref={tag}-cache"
+                    f"--cache-to=type=registry,mode=max,ref={tag}-cache,image-manifest=true"
                 )
 
             # Build contexts