Docker Push "unsupported MediaType" / "manifest invalid" to Registry in CI

By Daniel Zoghalchali·Latchkey

The registry rejected the image manifest because it did not accept the media type buildx pushed. Modern buildx emits OCI-format manifests by default, and some older or strict registries only accept the classic Docker schema2 format.

What this error means

A docker buildx build --push fails on the manifest with manifest invalid: unsupported MediaType or manifest blob unknown tied to an OCI media type. The layers may upload, but the manifest is refused.

failed to push: unexpected status: 400 Bad Request
manifest invalid: manifest invalid: unsupported MediaType:
application/vnd.oci.image.manifest.v1+json

Common causes

Registry does not accept OCI media types

buildx defaults to OCI image manifests. An older registry (or one configured strictly) only understands application/vnd.docker.distribution.manifest.v2+json, so it rejects the OCI manifest.

OCI-specific features in the manifest

Provenance/SBOM attestations or annotations buildx adds can trip a registry that does not support those OCI extensions.

How to fix it

Push in Docker (schema2) media-type format

Tell buildx to emit Docker-format manifests instead of OCI.

docker buildx build \
  --output type=image,name=myorg/api:1.4.2,oci-mediatypes=false,push=true .

Disable attestations that the registry rejects

Turn off provenance/SBOM if the registry cannot store them.

docker buildx build --provenance=false --sbom=false --push -t myorg/api:1.4.2 .

How to prevent it

• Confirm the target registry supports OCI manifests before relying on them.
• Set oci-mediatypes=false for legacy registries that need schema2.
• Disable provenance/SBOM for registries that cannot store attestations.

Frequently asked questions

Related guides

References

• Docker documentation
• Docker build cache
• GitHub Actions documentation