`nitro-cli build-enclave` fails with E48 (linuxkit image not found) on Docker v27+

[olevasseur]

Description

nitro-cli build-enclave --docker-uri <image> fails when the Docker daemon is v27 (API 1.54). The Docker image is successfully built and exists in the daemon, but linuxkit cannot resolve it from its local cache and attempts to pull from Docker Hub instead.

This works correctly on Docker v24 (API 1.41) — same nitro-cli version, same eif-builder container, same workflow.

Environment

• nitro-cli version: 1.3.1 (Amazon Linux 2023, aws-nitro-enclaves-cli-1.3.1-0.amzn2023.x86_64)
• Docker (working): v24.0.x, API 1.41 (GitHub-hosted ubuntu-latest runner)
• Docker (failing): v27.x, API 1.54 (self-hosted runner, overlay2 storage driver, containerd-snapshotter disabled)
• Host OS: Ubuntu 22.04
• Runner setup: nitro-cli runs inside an Amazon Linux container with the host Docker socket mounted (-v /var/run/docker.sock:/var/run/docker.sock)

Steps to reproduce

1. On a host with Docker v27+, build a Docker image:

   docker build -t enclave:latest -f path/to/Dockerfile .

2. Verify the image exists:

   docker images enclave
   # Shows enclave:latest

3. Run nitro-cli inside an Amazon Linux container with the socket mounted:

   docker run \
     -v /var/run/docker.sock:/var/run/docker.sock \
     -v /output:/output \
     amazonlinux-with-nitro-cli \
     nitro-cli build-enclave --docker-uri enclave:latest --output-file /output/enclave.eif

4. nitro-cli outputs:

   Start building the Enclave Image...
   Using the locally available Docker image...
   Linuxkit reported an error while creating the customer ramfs:
   "Add init containers:
   Process init image: docker.io/library/enclave:latest
   Image docker.io/library/enclave:latest not found in local cache, pulling
   Failed to build init tarball from docker.io/library/enclave:latest:
   Could not pull image docker.io/library/enclave:latest:
   error getting manifest for trusted image docker.io/library/enclave:latest:
   GET https://index.docker.io/v2/library/enclave/manifests/latest: UNAUTHORIZED"
   

Analysis

• nitro-cli's bollard client connects to Docker v27 successfully (the docker build via --docker-dir works, and "Using the locally available Docker image" confirms the image is found via the API).
• The failure is in linuxkit, which resolves images through Docker's internal storage rather than the socket API. Docker v27 changed the internal storage layout, and linuxkit cannot find images there.
• Disabling the containerd snapshotter ("containerd-snapshotter": false in daemon.json) does not fix the issue — linuxkit fails regardless of storage backend on Docker v27.
• The same workflow succeeds on Docker v24 with identical nitro-cli version and container setup.

Expected behavior

nitro-cli build-enclave should work with Docker v27+ since it is the current stable Docker release. Linuxkit should resolve locally available images through the Docker socket API rather than accessing internal storage directly.

Workaround

Pin Docker to v24.0.x on the host:

sudo apt-get install -y --allow-downgrades \
  docker-ce=5:24.0.9-1~ubuntu.22.04~jammy \
  docker-ce-cli=5:24.0.9-1~ubuntu.22.04~jammy
sudo apt-mark hold docker-ce docker-ce-cli