policy config_error ai_generated true

Error: cache from ref docker.io/library/python:3.11-slim: cache policy violation: layer 2a3b4c5d6e7f is not allowed by cache policy 'cache-to: type=local'

ID: policy/docker-layer-cache-policy-violation

Also available as: JSON · Markdown · 中文

78%Fix Rate

83%Confidence

1Evidence

2024-03-05First Seen

Version Compatibility

Version	Status	Introduced	Deprecated	Notes
Docker 24.0.x	active	—	—	—
Docker 25.0.x	active	—	—	—
Docker 26.0.x	active	—	—	—

Root Cause

Docker BuildKit's cache policy configuration (cache-to/cache-from) has a mismatch between the specified cache export type and the layer's origin, often when trying to export cache from a registry image to a local directory.

generic

中文

Docker BuildKit 的缓存策略配置（cache-to/cache-from）在指定的缓存导出类型和层的来源之间存在不匹配，通常发生在尝试将缓存从注册表镜像导出到本地目录时。

Official Documentation

https://docs.docker.com/build/cache/

Workarounds

85% success Use a compatible cache export type. If using 'cache-to: type=local', ensure the cache source is also from a local build, not a registry image. Alternatively, use 'type=registry' for registry-based caching. Example: docker build --cache-from type=registry,ref=myregistry.com/myimage:cache \ --cache-to type=registry,ref=myregistry.com/myimage:cache,mode=max .
```
Use a compatible cache export type. If using 'cache-to: type=local', ensure the cache source is also from a local build, not a registry image. Alternatively, use 'type=registry' for registry-based caching.
Example:
  docker build --cache-from type=registry,ref=myregistry.com/myimage:cache \
               --cache-to type=registry,ref=myregistry.com/myimage:cache,mode=max .
```
75% success Disable cache policy enforcement by using '--cache-from' without '--cache-to' or use 'mode=min' for cache-to to export only the final layer. Example: docker build --cache-from type=local,src=path/to/cache \ --cache-to type=local,dest=path/to/cache,mode=min .
```
Disable cache policy enforcement by using '--cache-from' without '--cache-to' or use 'mode=min' for cache-to to export only the final layer.
Example:
  docker build --cache-from type=local,src=path/to/cache \
               --cache-to type=local,dest=path/to/cache,mode=min .
```
70% success Rebuild the base image locally and use it as a local cache source to avoid policy violations with registry-sourced layers. Example: # Build base image locally docker build -t mybase:latest -f Dockerfile.base . # Use it as cache source docker build --cache-from type=local,src=path/to/cache --cache-to type=local,dest=path/to/cache .
```
Rebuild the base image locally and use it as a local cache source to avoid policy violations with registry-sourced layers.
Example:
  # Build base image locally
  docker build -t mybase:latest -f Dockerfile.base .
  # Use it as cache source
  docker build --cache-from type=local,src=path/to/cache --cache-to type=local,dest=path/to/cache .
```

中文步骤

使用兼容的缓存导出类型。如果使用 'cache-to: type=local'，确保缓存源也来自本地构建，而不是注册表镜像。或者，对于基于注册表的缓存，使用 'type=registry'。
示例：
  docker build --cache-from type=registry,ref=myregistry.com/myimage:cache \
               --cache-to type=registry,ref=myregistry.com/myimage:cache,mode=max .

通过仅使用 '--cache-from' 而不使用 '--cache-to' 来禁用缓存策略强制执行，或者为 cache-to 使用 'mode=min' 以仅导出最终层。
示例：
  docker build --cache-from type=local,src=path/to/cache \
               --cache-to type=local,dest=path/to/cache,mode=min .

在本地重建基础镜像并将其用作本地缓存源，以避免与注册表来源的层发生策略违规。
示例：
  # 本地构建基础镜像
  docker build -t mybase:latest -f Dockerfile.base .
  # 将其用作缓存源
  docker build --cache-from type=local,src=path/to/cache --cache-to type=local,dest=path/to/cache .

Dead Ends

Common approaches that don't work:

Clearing all Docker cache and rebuilding 40% fail
Clearing all Docker cache and rebuilding from scratch loses all caching benefits and may not resolve the policy mismatch if the same configuration is used.
Changing the base image 65% fail
Changing the base image to a different version might bypass the specific layer but the underlying policy issue remains for other layers.
Running docker system prune -a 75% fail
Running 'docker system prune -a' removes all images and containers but does not fix the cache policy configuration in the Dockerfile or build command.