buildx "Attestation is not supported for the docker driver" in CI

By Kaveh Alemi·Latchkey

Provenance and SBOM attestations are produced by BuildKit and stored alongside the image. The default docker driver cannot attach them, so buildx errors when --provenance or --sbom is requested under that driver.

What this error means

A build with --provenance or --sbom fails with "ERROR: Attestation is not supported for the docker driver. Switch to a different driver, or turn on the containerd image store, and try again."

ERROR: Attestation is not supported for the docker driver.
Switch to a different driver, or turn on the containerd image store, and try again.

Common causes

Requesting attestations under the docker driver

The bundled docker driver cannot write provenance/SBOM attestations; only the docker-container driver (or containerd store) can.

No docker-container builder configured

The setup-buildx step was missing, so the build ran on the default driver that lacks attestation support.

How to fix it

Build with the docker-container driver

1. Add setup-buildx with driver: docker-container.
2. Keep --provenance/--sbom flags as they are.
3. Re-run; attestations now attach to the pushed image.

- uses: docker/setup-buildx-action@v3
  with:
    driver: docker-container

Or enable the containerd image store

On a self-managed daemon, the containerd snapshotter lets the docker driver write attestations.

{
  "features": { "containerd-snapshotter": true }
}

How to prevent it

• Use a docker-container builder whenever you request attestations.
• Keep provenance/SBOM flags paired with the right driver.
• Push attestations to a registry that retains them.

Frequently asked questions

Related guides

References

• Docker documentation
• Docker build cache
• GitHub Actions documentation