defined but no vf vlan info elements were foundattempt to delete an entry (id=%d) that doesn't currently existtransport: received per-RPC creds error with illegal status: %vnet/trace: trace used after finish: Finished at: %s Used at: %selementNoneelementScriptelementStyleelementTextareaelementTitlenumber of times to retry in case of failure when performing pulloption --userns-gid-map can not be used without --userns-uid-mapcmd %q exists but will be ignored because of entrypoint settingsnumber of times to retry in case of failure when performing pushonly two arguments are necessary to push: source and destinationTEE (trusted execution environment) type: SEV,SNP (default: SNP)Unmount the root file system of the specified working containers0000000000000000000000000000000000000000000000000000000000000000 unrecognized content type: expected "", "file", or "dir", got %qgot %v while trying to determine default isolation, guessing OCIinternal error: unexpected panic in writeCompressedDataGoroutinebuilding: invalid value for jobs. It must be a positive integerError loading container config when searching for local runtime.json: invalid number literal, trying to unmarshal %q into Numberfallback error checking whether image is a manifest list: %v: %wruntime.SetFinalizer: first argument was allocated into an arenaattempted to trace stack of a goroutine this thread does not owninvalid digest specification %q: unsupported digest algorithm %qempty digest algorithm, validate before calling Algorithm.Hash()reflect.StructOf: struct size would exceed virtual address spacerequested minimum TLS version is too low. Should be at-least: %xinternal error: bodyReader.Read called on a closed object for %scannot find Containerfile or Dockerfile in context directory: %wgo package net: GODEBUG setting forcing use of the cgo resolver remounting %q in mount namespace with flags %v instead of %v: %wverifying that %q in mount namespace was remounted read-only: %winvalid options %q, can only specify 1 'noexec' or 'exec' optioninvalid options %q, can only specify 1 'nosuid' or 'suid' optioninvalid options %q, can only specify 1 'copy' or 'nocopy' option%v: Trying to pull image in the event that it is a public image.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_package requires newer Go version %v (application built with %v)cannot refer to unexported field %s in struct literal of type %sinvalid operation: pointers of %s must have identical base typesimplementation of offsetsof returned the wrong number of offsetsunable to serialize EC PrivateKey to DER-encoded PKIX format: %sunable to serialize RSA PublicKey to DER-encoded PKIX format: %sinternal error: parsing just-created zstd:chunked TOC digest: %wInternal inconsistency: daemonReference has empty id and nil reffree: freed page (%d) was allocated by the same transaction (%d)toml: cannot decode to a map with non-string key type (%s in %q)expected eight hexadecimal digits after '\U', but got %q insteadliteral count is too big: total available %d, total requested %d5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c2964fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5Upload a stream of data to upload without completing the upload.error creating cache around reference %q: no directory specifiederror getting layer infos for copying image %q through cache: %wcannot encrypt because recipient set shares no common algorithmsfailed to remove allocated ips for container ID %s on network %s2f259bab93aaaaa2542ba43ef33eb990d0999ee1b9924b557b7be53c0b7a1bb9aardvark-dns binary not found, container dns will not be enabledflate: invalid compression level %d: want value in range [-2, 9]driver ColumnConverter error converted %T to unsupported type %Tcannot decrypted encrypted session key with private key of type netplugin failed but error parsing its diagnostic message %q: %vgrpc: Compressor is not installed for requested grpc-encoding %qgrpc: client streaming protocol violation: get , want extension %v has mismatching containing message: got %v, want %vReceived %d labels in call to record metric %q, but expected %d.the stream is rejected because server is draining the connectiondelegating_resolver: resolver for proxy not found for scheme dnsheader key %q contains value with non-printable ASCII charactersHappy Eyeballs timer expired while waiting for connection to %q.set an "org.opencontainers.image.created" annotation in the imageif any of the specified images is a list, choose the one for `os`buildah mkcw localhost/repository:typical localhost/repository:cwrequire HTTPS and verify certificates when accessing the registrystoring %s to file: inconsistent layer size (copied %d, wrote %d)network namespace successfully setup, send start message to childPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/binsysctl %q defined in containers.conf must be formatted name=valueulimit option %q requires name=SOFT:HARD, failed to be parsed: %wremote repository list to utilise as potential cache destination.Remove the cached credentials for all registries in the auth filecan't retrieve digest of image big data value with empty name: %w Use "%s [command] --help" for more information about a command.additional layer for TOCDigest %q reports unexpected TOCDigest %qTOC digest %q for layer %q is present but %q flag is not a stringregistry %q denied by policy: not in allowed registries list (%s)Discarding libimage event which was not read within 2 seconds: %vRemoving containers of image %s from the local containers storage%w: consider listing external containers and force-removing imageuser arena chunk size is not a multiple of the physical page sizeruntime: function marked with #cgo nocallback called back into Goruntime.SetFinalizer: pointer not at beginning of allocated blocksetting up to read manifest and configuration from subject %q: %wUnable to support both decryption and encryption in the same copyinvalid algorithm %q in option.EnsureCompressionVariantsExist: %wreflect: StructOf does not support methods of embedded interfacestls: internal error: attempted to read record with QUIC transporttls: server selected an invalid version after a HelloRetryRequestnet/http: Transport.DialTLS or DialTLSContext returned (nil, nil)error setting access and modify timestamps on %q to %s and %s: %vFailed to parse the authentication scope from the given challenge... started an upload instead of mounting, trying to cancel at %sTrying to reuse blob with cached digest %s in destination repo %sFailed to call additional-layer-store-auth-helper (stderr:%s): %vChown error detected. Ignoring due to ignoreChownErrors flag: %v trivy filesystem -q {ROOTFS} --format cyclonedx --output {OUTPUT}trivy filesystem -q {ROOTFS} --format spdx-json --output {OUTPUT}invalid argument: arguments have type %s, expected floating-pointinvalid method expression %s.%s (needs pointer receiver (*%s).%s)type %s has no field or method %s, but does have unexported %s %sInternal error: neither src nor configBlob set in manifestSchema2Internal error: Uploaded empty layer has digest %#v instead of %sapplication/vnd.oci.image.layer.nondistributable.v1.tar+encryptedInvalid docker-archive: reference: index @%d must not be negativereference %s can’t be signed, it has neither a tag nor a digestunexpected literal count, want %d bytes, but only %d is availablex509: policy constraints inhibitPolicyMapping field overflows intx509: inner and outer signature algorithm identifiers don't matchx509: issuer name does not match subject from issuing certificatecrypto/des: use of TripleDES is not allowed in FIPS 140-only modecryptobyte: high-tag number identifier octets not supported: 0x%xcryptobyte: pending child length %d exceeds %d-byte length prefixThe blob upload encountered an error and can no longer proceed.magic %q not acceptable, only %q is an acceptable magic value: %wcurve25519: internal error: X25519 returned %d bytes, expected 32ssh: DH GEX request out of range, min: %d, max: %d, preferred: %dkernel too old to provide multiple lowers feature for overlay: %wUncompressed digest for blob %s previously recorded as %s, now %snistec: internal error: p224Table called with out-of-bounds valuenistec: internal error: p384Table called with out-of-bounds valuenistec: internal error: p521Table called with out-of-bounds value^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$go-jose/go-jose: invalid Ed25519 private key, missing %s value(s)failed to recreate missing backingFsBlockDev %s for projid %d: %wfindFieldInfo: error building index when looking for field %d: %vbinarylogging: message to log is neither proto.message nor []bytevarint,1052,rep,name=field_behavior,enum=google.api.FieldBehaviorset created timestamp to epoch 0 to allow for deterministic buildsdo not pull the image, use the image present in store if availableset the default `command` to run for containers based on the image Creates, modifies, and pushes manifest lists and image indexes.--amend specified but no matching manifest list found with name %qUnmounts the root file system of the specified working containers.internal error: renamed %d items when we expected to only rename 1%s registry at %q denied by policy: not in allowed registries listcomputing layer digests and building metadata for container %q: %w`containerUID:hostUID:length` UID mapping to use in user namespace`containerGID:hostGID:length` GID mapping to use in user namespace`argument=value` to supply additional build context to the buildermemory limit (format: [], where unit = b, k, m or g)no options (%s) can be specified after the image or container nameinvalid --dns-search, --dns-search may not be used with --dns=noneinvalid --dns-option, --dns-option may not be used with --dns=noneunable to convert additional build-context %q path to absolute: %winvalid --platform may not be used with --os, --arch, or --variantgetting registry from registry.conf, please specify a registry: %wWhile recovering from a failure (%s), error deleting layer %#v: %vsuccessfully pushed cache to dest: %+v with ref:%+v and digest: %vTreating manifest lists as individual manifests is not implementedresolving an already-resolved reference %q to the pulled image: %wImage %s resolved to local image %s which will be used for pullinglibimage error: cannot remove external containers without callbackruntime: unexpected error while checking standard file descriptor casGToWaitingForSuspendG with non-isWaitingForSuspendG wait reasonreflect: indirection through nil pointer to embedded struct field sync: WaitGroup.Add called from inside and outside synctest bubbletls: certificate private key (%T) does not implement crypto.Signerclient doesn't support ECDHE, can only use legacy RSA key exchangetls: server sent an unexpected quic_transport_parameters extensionattempted to update last-writer in lockfile without the write locktrivy filesystem -q {CONTEXT} --format cyclonedx --output {OUTPUT}trivy filesystem -q {CONTEXT} --format spdx-json --output {OUTPUT}impossible type switch case: %s %s cannot have dynamic type %s %scannot handle more than %d union terms (implementation limitation)Syntax error - can't find = in %q. Must be of the form: name=valuedocker-archive reference %s isn't of the form [:]expected end of table array name delimiter ']', but got %q insteadinternal error: expected cumul[s.symbolLen] (%d) == tableSize (%d)x509: policy constraints requireExplicitPolicy field overflows intx509: certificate is not valid for any names, but wanted to match x509: requested SignatureAlgorithm does not match private key typeThere was an error processing the upload and it must be restarted.internal error: attempted to parse unknown event (please report): error while creating a temporary file under %q to hold blob %q: %vdbus.Store: type mismatch: map: cannot store a value of %s into %sssh: certificates cannot be used as authority (public key type %q)%w: trying to pop component %q but the last stack entry is %s (%q)[bug] non-empty remaining path when doing a non-partial lookup: %qoverlay: additionallayerstore config %q contains unknown option %qSELECT 1 FROM DigestUncompressedPairs WHERE uncompressedDigest = ?rootless netns program no longer running, trying to start it againerror parsing configuration list: invalid type for cniVersions: %Tgo-jose/go-jose: invalid JWK, x5t#S256 header has invalid encodinggo-jose/go-jose: invalid JWK, x5t#S256 header is of incorrect sizegrpc: credentials.Bundle must return non-nil transport credentialspkcs7: failed unmarshaling key encryption algorithm parameters: %vECDH-ES output size too large, must be less than or equal to 1<<16Descriptor.Options called without importing the descriptor packagemetadata: Pairs got the odd number of input pairs for metadata: %domit build history information from the built image (default false)modify an existing list if one with the desired name already existsif any of the specified images is a list, choose the one for `arch`error generating canonical reference with name %q and digest %s: %vnot allowed to mix host PID namespace with container user namespace engine="buildah-%s" name=%q id=%q image=%q imageid=%q rootless=%d if specifying upperdir then workdir must be specified or vice versaregistry %q is not marked as blocked in registries configuration %qswap limit equal to memory plus swap: '-1' to enable unlimited swapno registries found in registries.conf, a registry must be providedHelp provides help for any command in the application. Simply type cached image %q has OS %q but current build targets %q, ignoring itError preparing updated manifest: layer count changed from %d to %dimage with ID %q already exists, but uses a different top layer: %wInvalid image name %q, expected colon-separated transport:referenceFailed to determine if an image is a parent: %v, ignoring the errorulimit soft limit must be less than or equal to hard limit: %d > %dcould not find a working conmon binary (configured options: %v: %w)destination does not support any supported manifest list types (%v)Uploading manifest list failed, attempted the following formats: %stls: server sent certificate containing RSA key larger than %d bitsInternal error: newImageSource returned without trying any endpointinternal error: PutBlobPartial is not supported by the %q transportunexpected end of statement while looking for matching single-quoteunexpected end of statement while looking for matching double-quoteattempted to check last-writer in lockfile without locking it firstmaking sure masked directory %q in mount namespace is read only: %wcould not find pasta, the network namespace can't be configured: %wLooking up in credential helper %s based on credHelpers entry in %sgotypealias mutated during type checking, gotypesalias=%s, inuse=%dInvalid path %q: paths including the separator %q are not supportedincompatible types: TOML value has type %s; destination has type %scrypto/cipher: invalid buffer overlap of output and additional datafound Pkcs11Blob with version %d but maximum supported version is 0'overlay' is not supported over %s, a mount_program is required: %woverlay: additionallayerstore config of %q contains %q option twice%q requires API version %s, but the Docker daemon API version is %sgo-jose/go-jose: too many recipients in payload; expecting only oneIgnoring BlobInfoCache record of digest %q with unknown compressionServer retry pushback specified multiple values (%q); not retrying.invalid field: %v: unsupported type for opaque repeated message: %vfield %v with invalid Mutable call on field with non-composite typetransport: cannot send secure credentials on an insecure connectiondelegating_resolver: unable to build the resolver for target %s: %v Removes an image or artifact from a manifest list or image index.extra space needed for converting a container rootfs to a disk image'private', 'none', 'ns:path' of network namespace to join, or 'host'while cleaning up partially-created image %q we failed to create: %vFailed to find flag %q and mark it as being required in a flag groupcan not look up shorthand which is more than one ASCII character: %q[GOOS: %s, GOARCH: %s] syncing file failed, db.datasz: %d, error: %vAllThreadsSyscall6 results differ between threads; runtime corruptedbuilding reference to list, appears to have not been saved first: %wlayer %s should be decrypted, but we can’t modify the manifest: %slayer %s should be encrypted, but we can’t modify the manifest: %sreflect: reflect.Value.UnsafePointer on an invalid notinheap pointertls: internal error: sending non-handshake message to QUIC transportcrypto/hmac: hash generation function does not produce unique valuespadding bytes must all be zeros unless AllowIllegalWrites is enabledhttp2: Transport conn %p received error from processing frame %v: %vhttp2: Transport received unsolicited DATA frame; closing connectionhttp: message cannot contain multiple Content-Length headers; got %qmapping container filesystem owner 0,0 to host filesystem owners: %wFailed to map UID %v to the target mapping, using the overflow ID %vFailed to map GID %v to the target mapping, using the overflow ID %vReading blob body from %s failed (%v), reconnecting after %.3f ms…Too many requests to %s: sleeping for %f seconds before next attemptinternal error: VerifySigstorePayload succeeded but returned no dataz.currentBuffer too large (most likely due to concurrent Write race)cannot assign to %s (neither addressable nor a map index expression)rejecting ambiguous manifest, unexpected fields %#v in supposedly %sOCI1Index.EditInstances: Modified digest %s is an invalid digest: %wno image found in image index for architecture %q, variant %q, OS %qpreparing to decrypt before conversion: %d layers vs. %d layer editsInvalid docker-archive: reference: colon in path %q is not supportedrollback: freed page (%d) was allocated by the same transaction (%d)2695994666715063979466701508701963067355791626002630814351006629888126959946667150639794667015087019625940457807714424391721682722368061crypto/rsa: only crypto/rand.Reader is allowed in FIPS 140-only modeembedded IPv4 address must replace the final 2 fields of the addressThe `Content-Length` header must be zero and the body must be empty.<?n=&last=>; rel="next"The upload is unknown to the registry. The upload must be restarted.expected SCALAR, SEQUENCE-START, MAPPING-START, or ALIAS, but got %verror renaming new decompressed copy of blob %q into place at %q: %vbig: invalid 2nd argument to Int.Jacobi: need odd integer but got %sunable to set memory limit to %d (current usage: %d, peak usage: %d)cannot enter cgroupv2 %q with domain controllers -- it is in %s modedbus.Store: type mismatch: map: cannot convert a value of %s into %sdbus.Store: type mismatch: slice: cannot store a value of %s into %sIgnoring global metacopy option, not supported with booted kernel %sdocker tarfile: input with unknown size, streaming to disk first ...%v. * Are you trying to connect to a TLS-enabled daemon without TLS?Compressor for blob with digest %s previously recorded as %s, now %sSignature: need to call Sign, SignUserId or SignKey before Serializego-jose/go-jose: invalid SHA-1 thumbprint (must be %d bytes, not %d)go-jose/go-jose: invalid SHA-1 thumbprint, does not match cert chaininvalid retry throttling config: tokenRatio (%v) may not be negativecustom type: type: %v, does not implement the proto.custom interfaceinvalid descriptor: using edition features in a proto with syntax %sextension %v does not implement protoreflect.ExtensionTypeDescriptorexpected a JSON struct with one entry; received entry %v at index %ddelegating_resolver: failed to determine proxy URL for target %s: %vDumps a bolt database. The output format should not be depended upon.when using the --all switch, you may not pass any images names or IDscreating a temporary data directory to hold a rootfs image for %q: %wcreating image reference for container %q to extract its contents: %wthe same name must not be specified for both '--tag' and '--manifest'number of times to retry in case of failure when performing push/pullcan't retrieve digest of container big data value with empty name: %wunable to resolve argument for `from=`: from points to an empty valueThe source bucket (%s) and the target bucket (%s) are the same bucketinternal error: After attempting to copy %s, resolvedReference is nilSkipping pull candidate %s as the image is not newer (pull policy %s)runtime.Pinner: found leaking pinned pointer; forgot to call Unpin()?invalid image_copy_tmp_dir value %q (relative paths are not accepted)reflect: embedded interface with unexported method(s) not implementedtls: peer doesn't support the certificate custom signature algorithmstls: handshake message of length %d bytes exceeds maximum of %d byteshttp2: Transport closing idle conn %p (forSingleUse=%v, maxStream=%v)%s matches more methods than %s, but has a more specific path pattern%s matches fewer methods than %s, but has a more general path patternmapping host filesystem owners %#v to container filesystem owners: %wReading blob body from %s failed (%v), reconnecting after %d bytes…Unexpected path elements in Docker reference %s for signature storageignored xattrs in archive: underlying filesystem doesn't support themimagestore %s must either be not set or be a different than graphrootReturned when a client attempts to contact a service too many timesCan not convert image index to MIME type %q, which is not a list typeinternal error: missing part misses both local and remote data streamdocker-archive: does not support any scopes except the default "" oneinternal error: %d > %d, maxheader: %d, sl: %d, tl: %d, normcount: %vcrypto/ecdh: only crypto/rand.Reader is allowed in FIPS 140-only modetoo many hex fields to fit an embedded IPv4 at the end of the addressagent: signature does not support non-default signature algorithm: %TCached value indicated that idmapped mounts for overlay are supportedIgnoring global metacopy option, the mount program doesn't support itInternal inconsistency: Path %s resolved to %s still cleaned up to %sgo-jose/go-jose: invalid JWK, x5c thumbprint does not match x5t valueedwards25519: internal error: setShortBytes called with a long stringenable layer caching for this operation (creates an independent layer) Modifies the configuration values which will be saved to the image.look at the item of the specified `type` (container or image) and nameunknown format %q. Choose on of the supported formats: 'oci' or 'v2s2'no supported manifest types (attempted to use %q, only know %q and %q)parent image %q had no history but had %d layers, assuming OmitHistoryinternal error: did not expect a resolved bind mount to use the O flag'rm' and 'force-rm' can only be set with either 'layers' or 'no-cache'invalid --dns, --dns=none may not be used with any other --dns optionstimestamp and source-date-epoch would be ambiguous if allowed togetherencryption change (for layer %q) is not supported in schema1 manifestsencryption change (for layer %q) is not supported in schema2 manifestsStorage configuration is unset - using hardcoded default graph root %qbytes.Buffer: UnreadByte: previous operation was not a successful readsync/atomic: compare and swap of inconsistently typed value into Valuegot %s for stream %d; expected CONTINUATION following %s for stream %dunable to read list of attributes for %q: size would have been too bigunexpected multiple certificates present in signature certificate dataInternal inconsistency: both "caRootsPath" and "caRootsData" specifiedInternal inconsistency: Fulcio CA specified without a Rekor public keyFROM requires either one argument, or three: FROM [AS ]local resolver detected, but could not read real resolv.conf at %q: %wwhen using JSON array syntax, arrays must be comprised of strings onlyThe access controller denied access for the operation on a resource.Schema2List.EditInstances: Modified digest %s is an invalid digest: %wno image found in manifest list for architecture %q, variant %q, OS %qInvalid image configuration, needs more than the %d distributed layersapplication/vnd.oci.image.layer.nondistributable.v1.tar+gzip+encryptedapplication/vnd.oci.image.layer.nondistributable.v1.tar+zstd+encryptedInvalid destination docker-daemon:%s: a destination must be a name:tagInvalid docker-daemon: reference %s: only digest algorithm %s acceptedexpected a comma or an inline table terminator '}', but got %s insteadcrypto/ecdsa: only crypto/rand.Reader is allowed in FIPS 140-only modecrypto/ed25519: use of Ed25519ctx is not allowed in FIPS 140-only modex509: PKCS#8 wrapping contained private key with unknown algorithm: %vx509: certificate relies on legacy Common Name field, use SANs insteadRFC5988 compliant rel='next' with URL to next result set, if available{ "name": , "tags": [ , ... ] }The blob identified by `digest` is available at the provided location.starting to read from image %q using blob cache in %q (compression=%v)Need at least one public key to verify the sigstore payload, but got 0ToNearestEvenToNearestAwayToZeroAwayFromZeroToNegativeInfToPositiveInfdbus.Store: type mismatch: slice: cannot convert a value of %s into %scannot set NetworkDNSServers if DNS is not enabled for the network: %wCached value indicated that data-only layers for overlay are supportedPrivate key password array length must be same as that of private keysprivate key password array length must be same as that of private keysgo-jose/go-jose: invalid SHA-256 thumbprint (must be %d bytes, not %d)second return value of SQLite aggregator Done() function must be errorblockingPicker: the picked transport is not ready, loop back to repickinvalid retry throttling config: maxTokens (%v) out of range (0, 1000]at least a list image and an image or artifact to add must be specifiedDestination argument not specified, assuming the same as the source: %swhen using the --prune switch, you may not pass any images names or IDsbind mount a host location into the container while running the commandinternal error: did not expect a resolved tmpfs mount to use the O flaginternal error: did not expect a resolved cache mount to use the O flagskips stages in multi-stage builds which do not affect the final targetif any flags in the group [%v] are set they must all be set; missing %v--link is not supported when building without --layers, ignoring --linkjson: invalid use of ,string struct tag, trying to unmarshal %q into %vinternal error: expected %d instead of %d errors for %d pull candidatessha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4registry %q denied by policy: it is in the blocked registries list (%s)range function recovered a loop body panic and did not resume panickingexec: command with a non-nil Cancel was not created with CommandContextDigest of source image's manifest would not match destination referencesha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8atoo many concurrent operations on a single file or socket (max 1048575)tls: peer doesn't support any of the certificate's signature algorithms[A-Za-z][A-Za-z0-9]*(?:[-_+.][A-Za-z][A-Za-z0-9]*)*[:][[:xdigit:]]{32,}Internal inconsistency: A public key, Fulcio, or PKI must be specified.ensuring parent of mountpoint %q (%q) is present in mount namespace: %wbind mounting %q onto itself in preparation for making it read-only: %wshort-name alias %q not found in %q: please check registries.conf filesSwitching default driver from overlay2 to the equivalent overlay driverAuthFilePath and DockerCompatAuthFilePath can not be set simultaneouslyinvalid operation: cannot use type assertion on type parameter value %simplicit assignment to unexported field %s in struct literal of type %sinvalid use of type alias %s in recursive type (see go.dev/issue/50729)Can not convert manifest list to MIME type %q, which is not a list typeInconsistent schema 1 manifest: %d history entries, %d fsLayers entriesInternal error: uploaded %d blobs, but schema1 manifest has %d fsLayersError converting image: layer edits for %d layers vs %d existing layerssha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855Error creating parent directories for %s, using a memory-only cache: %vcrypto/ecdsa: use of custom curves is not allowed in FIPS 140-only modex509: issuer has name constraints but leaf doesn't have a SAN extensiondynamic table size update MUST occur at the beginning of a header block{ "name": , "tags": [ , ... ], }Retrieve a sorted, json list of repositories available in the registry.failed to allocate lock in %q after %d attempts; last failure on %q: %winvalid GOFIPS140: must be off, latest, inprocess, certified, or vX.Y.Ztransport: set send compressor called after headers sent or stream donegrpc: error unmarshalling service config %s due to methodConfig[%d]: %vunknown color model: 4-component JPEG doesn't have Adobe APP14 metadata%v.%s cannot be a pointer to a interface or a slice of interface values%T.%s cannot be a pointer to a interface or a slice of interface valuesINVALIDBOOLINT64FLOAT64STRINGBOOLSLICEINT64SLICEFLOAT64SLICESTRINGSLICEuse `[username[:password]]` for accessing registries when pulling imagesadd `port` to expose when running containers based on image (default [])at least a list image and one or more instance digests must be specified Removes one or more working containers, unmounting them if necessary.%s registry at %q denied by policy: it is in the blocked registries listrefrain from announcing build instructions and image read/write progresswhile cleaning up partially-created container %q we failed to create: %vFailed to find flag %q and mark it as being in a one-required flag groupimage config has only %d DiffID values, but a layer with index %d existserror creating image: image with ID %q exists, but uses different layersreading subuid mappings for user %q and subgid mappings for group %q: %wIgnoring error: cannot return labels for manifest list or image index %sruntime.Goexit called in a thread that was not created by the Go runtimeInternal error writing blob %s, blob with digest %s saved with digest %sSource is a manifest list; copying (only) instance %s for current systeminternal error: forceManifestMIMEType was rejected for an unknown reasonEnsureCompressionVariantsExist is not implemented for CopySpecificImagesInternal error: copying uncompressed config blob %s changed digest to %sreflect: embedded type with methods not implemented for non-pointer typeclient doesn't support any cipher suites compatible with the certificatetls: server's certificate contains an unsupported type of public key: %Tcopier: get: error computing path of %q relative to top directory %q: %wcopier: put: error creating regular file %q: incorrect length (%d != %d)copier: conditionalRemove: error computing path of %q relative to %q: %vDetected insufficient_scope error, will retry request with updated scopeDocker references with both a tag and digest are currently not supportedinvalid repository name (%s), cannot specify 64-byte hexadecimal stringsunsupported network backend %q, check network_backend in containers.confFailed to read /proc/sys/crypto/fips_enabled to determine FIPS state: %v%s: %s, error found in #%v byte of ...|%s|..., bigger context ...|%s|...invalid copy: arguments %s and %s have different element types %s and %sfunc must be func(yield func(...) bool): yield func does not return boolzstd:chunked manifest too big to process in memory (%d bytes compressed)not a containers image directory, don't want to overwrite important datacrypto/rsa: use of multi-prime keys is not allowed in FIPS 140-only modecrypto/fips140: FIPS 140-3 mode enabled, but integrity check didn't passThe blob, identified by `name` and `digest`, is unknown to the registry.found Pkcs11Recipient with version %d but maximum supported version is 0error cleaning up temporary file %q for decompressed copy of blob %q: %vWhile recovering from a failure creating a layer, error deleting %#v: %vCannot connect to the Docker daemon at %s. Is the docker daemon running?Error opening (previously-successfully-opened) blob info cache at %q: %vgo-jose/go-jose: invalid call to newFixedSizeBuffer (len(data) > length)grpc: Server.RegisterService found duplicate service registration for %qbuildah rename containerName NewName buildah rename containerID NewNameadd `annotation` e.g. annotation=value, for the target image (default [])when using the --all switch, you may not pass any containers names or IDsthe specified UID and/or GID mapping %s conflicts with other mappings: %wthe specified UID and/or GID mappings %s conflict with other mappings: %wunsupported value %q for "RUN --network", must be either "host" or "none"getCreatedBy: while replacing arg variables with values for format %q: %wSkipping commit for layer %q, manifest not yet available for DiffID checkConsuming rest of the original blob to satisfy getOriginalLayerCopyWritertls: received unexpected handshake message of type %T when waiting for %Ttls: internal error: handshake returned an error but is marked successfultls: found a certificate rather than a key in the PEM for the private keycaIntermediatesPath and caIntermediatesData cannot be used simultaneouslygo package net: GODEBUG=netdns contains an invalid dns mode, ignoring it could not find slirp4netns, the network namespace can't be configured: %wspecifying a root certificates file with the insecure flag is not allowedMount a blob identified by the `mount` parameter from another repository.Cached value indicated that idmapped mounts for overlay are not supportedBase compressor for blob with digest %s previously recorded as %s, now %scould not properly decrypt byte stream; exp hmac: '%x', actual hmac: '%s'go-jose/go-jose: key algorithm '%s' not supported in multi-recipient modego-jose/go-jose: invalid or SHA-256 thumbprint, does not match cert chaingo-jose/go-jose: invalid JWK, found 'oct' (symmetric) key with cert chainMissing '_auth_user' while user authentication was requested with '_auth'Missing '_auth_pass' while user authentication was requested with '_auth'%w %q: kernel version has dot(s) followed by non-digit in version sectionReceived a RST_STREAM frame with code %q, but found no mapped gRPC statusIgnoring resolver error because balancer is using a previous good update.set timestamps in layer to no later than the value for --source-date-epochAdd or update information about an entry in a manifest list or image indexdid not expect image or artifact name "%s" when modifying the entire index%s size is %d bytes, uncompressed digest %s, possibly-compressed digest %s`argfile.conf` containing lines of argument=value to supply to the builderinvalid build output option %q, "type=local" can not be used with "dest=-"Existing credentials are invalid, please enter valid username and passwordinternal error: layerStore.load has shouldSave but !r.lockfile.IsReadWriteProcessLabel and Mountlabel must either not be specified or both specified if [[ -z "${BASH_VERSION:-}" || "${BASH_VERSINFO[0]:-}" -gt 3 ]]; thenbytes.Buffer: UnreadRune: previous operation was not a successful ReadRunespecifying %q filter more than once with different values is not supportedFailed to determine if an image is a manifest list: %v, ignoring the errorruntime: cannot set cpu profile rate until previous profile has finished. Internal error writing blob %s, digest verification failed but was ignoredtls: certificate RSA key size too small for supported signature algorithmsmalformed response from server: malformed non-numeric status pseudo headernet/http: server replied with more than declared Content-Length; truncated%w (after reconnecting, server did not process a Range: header, status %d)chowning host path %q is not allowed. You can manually `chown -R %d:%d %s`Internal error in V2RegistriesConf.PostProcess: entry in regMap is missingregistry '%s' is defined multiple times with conflicting 'blocked' settingunknown field %s in struct literal of type %s, but does have unexported %sadding a schema2 list instance with no platform specified is not supportedzstd:chunked manifest too big to process in memory (%d bytes uncompressed)crypto/rsa: use of keys with odd size is not allowed in FIPS 140-only modegcm: internal error: using generic implementation despite hardware supportcrypto/rand: failed to read random data (see https://go.dev/issue/66821): CNI config list %s could not be converted to a libpod config, skipping: %vbackingFs=%s, projectQuotaSupported=%v, useNativeDiff=%v, usingMetacopy=%vCached value indicated that data-only layers for overlay are not supportedInvalid scope %s: Uses non-canonical path format, perhaps try with path %sUncompressed digest for blob with TOC %q previously recorded as %q, now %qSELECT uncompressedDigest FROM DigestUncompressedPairs WHERE anyDigest = ?INSERT OR REPLACE INTO DigestCompressors(digest, compressor) VALUES (?, ?)SELECT anyDigest FROM DigestUncompressedPairs WHERE uncompressedDigest = ? with an optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName')go-jose/go-jose: invalid JWK, x5c thumbprint does not match x5t#S256 valueInvalid _auto_vacuum: %v, expecting value of '0 NONE 1 FULL 2 INCREMENTAL'SubConn %p reported connectivity state READY. Registering health listener.AddAttrs unsafely called on copy of Record made without using Record.Cloneassume image blobs in the specified directory will be available for pushingset new timestamps in image info to `seconds` after the epoch, defaults to `name` of entries from /etc/subuid to use to set user namespace UID mapping`name` of entries from /etc/subgid to use to set user namespace GID mappingset timestamps in layers to no later than the value for --source-date-epochcannot create an image with canonical UID/GID mappings in a read-only store%[2]s is a special command that is used by the shell completion logic %[1]sError loading default container config when searching for local runtime: %vInternal error: commitLayer called with previous layer %d not committed yet[GOOS: %s, GOARCH: %s] mlock failed, fileSize: %d, db.datasz: %d, error: %vtoo many limit value arguments - %s, can only have up to two, `soft[:hard]`cannot use ForceCompressionFormat with undefined default compression formattls: internal error: attempted to read record with pending application dataUnsolicited response received on idle HTTP channel starting with %q; err=%v%w (after reconnecting at offset %d, got unexpected Content-Range %d-%d/%d)Reading blob body from %s failed (%v), reconnecting (first reconnection)… No signature storage configuration found for %s, using built-in default %sInternal inconsistency: publicKey not set before verifying sigstore payloadregistry '%s' is defined multiple times with conflicting 'insecure' settingfunc must be func(yield func(...) bool): yield func has too many parameters[WARNING]: Empty continuation lines will become errors in a future release.Invalid docker-archive: reference: cannot use both a tag and a source indexdetected overlapped free page ID: %d between ids: %v and existing f.ids: %vInternal inconsistency: Docker reference %s with neither a tag nor a digesttype='signal',interface='org.freedesktop.systemd1.Manager',member='UnitNew'overlay: additionallayerstore path %q is not absolute. Can not be relativeInternal error: Trying to reuse ManifestItem values with layers %#v vs. %#vpermission denied while trying to connect to the Docker daemon socket at %vrequest returned %s; check if the server supports the requested API versionerror parsing configuration list: invalid type for cniVersions index %d: %Tpkcs7: cannot decrypt data: only RSA PKCS#1 v1.5 and RSA OAEP are supportedpkcs7: cannot encrypt content: only DES-CBC, AES-CBC, and AES-GCM supportedheader list size to send violates the maximum size (%d bytes) set by serverHeader list size to send violates the maximum size (%d bytes) set by clientEXPERIMENTAL. Number of times the selected subchannel becomes disconnected.prefer `ARCH` instead of the architecture of the machine for choosing imagesafter copying the image, write the digest of the resulting image to the fileWhile recovering from a failure to save layers, error deleting layer %#v: %vunable to redefine %q shorthand in %q flagset: it's already used for %q flagtls: failed to send closeNotify alert (but connection was closed anyway): %wtls: server certificate contains incorrect key type for selected ciphersuiteFetching sigstore attachment manifest failed, assuming it does not exist: %vunable to remount %q with requested flags %v instead of %v, just got %v backchecking if masked directory %q was mounted read-only in mount namespace: %wupdate %d of %d passed to OCI1Index.UpdateInstances had an invalid size (%d)TOC requires a tar-split, but the %s annotation does not describe a positionInternal error: NewReaderForReference called for a reader-bound reference %sinvalid image reference %s, expected format: 'hostname/namespace/stream:tag'Error creating a SQLite blob info cache at %s, using a memory-only cache: %vcrypto/rsa: use of even public exponent is not allowed in FIPS 140-only modecannot encrypt because no candidate hash functions are compiled in. (Wanted reached %d iterations in overlay graph driver’s recreateSymlink, giving upInternal error: Trying to reuse ManifestItem values with configs %#v vs. %#vinternal error: nothing to sign with, should have been detected in NewSignergo-jose/go-jose: invalid JWK, public keys in key and x5c fields do not matchInvalid _synchronous: %v, expecting value of '0 OFF 1 NORMAL 2 FULL 3 EXTRA'transport: trying to send header list size larger than the limit set by peertransport: http2Server.HandleStreams received bogus greeting from client: %qtransport: http2Server.HandleStreams saw invalid preface type %T from clientafter copying the image, write the digest of the resulting digest to the fileregistry not specified, default to the first registry %q from registries.confWhile recovering from a failure to set big data, error deleting layer %#v: %vcached image %q has architecture %q but current build targets %q, ignoring itError preparing updated manifest: unknown media type of original layer %q: %q[GOOS: %s, GOARCH: %s] munlock failed, fileSize: %d, db.datasz: %d, error: %vCan not convert image to %s, preparing DiffIDs for this case is not supportedMapIter.Next called on an iterator that does not have an associated map Valuecrypto/tls: ExportKeyingMaterial is unavailable when renegotiation is enabledInternal inconsistency: More than one of public key, Fulcio, or PKI specifiedlen(z.currentBuffer) > z.blockSize (most likely due to concurrent Write race)invalid function signature for %s: second return value should be error; is %sinvalid argument: mismatched types %s (previous argument) and %s (type of %s)invalid image reference: %s, expected format: 'hostname/namespace/stream:tag'Couldn't get cpu model name, it may be the corner case where variant is 6: %verror opening image to get layer infos for copying image %q through cache: %wunknown Public key PEM file type: %v. Are you passing the correct public key?cannot enter cgroupv2 %q with domain controllers -- it is in an invalid stateLayer %s has already been removed; ignore it and continue to delete the cacheSpecific compressor for blob with digest %s previously recorded as %s, now %sSELECT uncompressedDigest FROM DigestTOCUncompressedPairs WHERE tocDigest = ?crypto/cipher: GCM tag and nonce sizes can't be non-standard at the same timeinterface name is too long: interface names must be %d characters or less: %wfailed to move the rootless netns pasta process to the systemd user.slice: %vgrpc: credentials.Bundle may not be used with individual TransportCredentialsClientConn's authority from transport creds %q and dial option %q don't matchbuildah source pull quay.io/sourceimage/example:latest /tmp/sourceimage:latestbuildah source push /tmp/sourceimage:latest quay.io/sourceimage/example:latest--ignorefile option requires that you specify a context dir using --contextdiradd contents of a file to the image at a specified path (`source:destination`)Failed to find flag %q and mark it as being in a mutually exclusive flag groupinvalid image filter %q: must be in the format "filter=value or filter!=value"range function continued iteration after function for loop body returned falseencryption required together with format %s, which does not support encryptionUnexpectedly received a manifest list instead of a manifest for a single imagewhen choosing layers to encrypt, layer index %d out of range (%d layers exist)reflect: embedded type with methods not implemented if type is not first fieldpattern %q (registered at %s) conflicts with pattern %q (registered at %s): %sserver provided %d signatures, assuming that's unreasonable and a server errorDocker reference %s is not for an unknown digest case; tag or digest is neededinvalid prefix '%v' for empty location, should be in the format: *.example.comupdate %d of %d passed to Schema2List.UpdateInstances had an invalid size (%d)update %d of %d passed to OCI1Index.UpdateInstances had no media type (was %q)graph driver %s does not support partial pull but convert_images requires thatno image instance matching the specified digest was found in the list or indexCould not parse '%s' as a hexadecimal number, but the lexer claims it's OK: %s115792089210356248762697446949407573530086143415290314195533631308867097853951115792089210356248762697446949407573529996955224135760342422259061068512044369crypto/rsa: use of PKCS#1 v1.5 encryption is not allowed in FIPS 140-only modex509: signature check attempts limit reached while verifying certificate chainThis error may be returned when a manifest blob is unknown to the registry.Internal error: signature verification failed but no errors have been recordedoverlay: test mount did not indicate whether or not metacopy is being used: %vkernel returned %v when we tried to delete an item in the merged directory: %werror parsing configuration list: invalid cniVersions entry %s at index %d: %wtransport: http2Server.HandleStreams failed to read initial settings frame: %vunknown format %q. Choose on of the supported formats: 'oci', 'v2s1', or 'v2s2'after copying the artifact, write the digest of the resulting image to the file{{with .DisplayName}}{{printf "%s " .}}{{end}}{{printf "version %s" .Version}} building multiple images, but iidfile %q can only be used to store one image IDcannot convert slice with length %y to array or pointer to array with length %xcannot manually encode TypeXHeader, TypeGNULongName, or TypeGNULongLink headerstls: client certificate private key of type %T does not implement crypto.Signerbad label option %q, valid options 'disable, user, role, level, type, filetype'%s not supported as argument to built-in %s for go1.18 (see go.dev/issue/50937)OCI1Index.EditInstances: Attempting to update %s which is an invalid digest: %wmore than one authentication method found for %v; found %v, only one is allowedRetrieve the progress of the current upload, as reported by the `Range` header.error while creating a temporary file under %q to hold decompressed blob %q: %voverlay: metacopy option not supported on this kernel, checked using options %qoverlay: override_kernel_check option was specified, but is no longer necessary--storage-opt is supported only for overlay over xfs with 'pquota' mount optionCannot connect to the Docker daemon. Is the docker daemon running on this host?Ignoring BlobInfoCache record of digest %q with unrecognized compression %q: %vmetadata: FromOutgoingContext got an odd number of input pairs for metadata: %dbuildah manifest annotate --annotation left=right mylist:v1.11 image:v1.11-amd64add environment variable to be set temporarily when running command (default [])internal error: history lists %d non-empty layers, but we have %d layers on disklocating image with ID %q (consider removing the image to resolve the issue): %wOrdinary storage image ID %s; a layer was looked up by TOC, so using image ID %scould not find %q because there are no helper binary directories configured. %scompression using %s required together with format %s, which does not support itcompression using %s required, but none of the known manifest formats support it%q is an invalid component of %q: platform specifier component must match %q: %wtls: either ServerName or InsecureSkipVerify must be specified in the tls.Confighttp: RoundTripper implementation (%T) returned a nil *Response with a nil errorbug: unexpected way for two patterns %s and %s to conflict: methods %s, paths %sNot reconnecting to %s: insufficient progress %d / time since last retry %.3f msInternal error: there must be exactly 2 colons in the cacheKey ('%s') but got %dInternal inconsistency: Reference %s unexpectedly has neither a digest nor a tagInternal inconsistency: PKI use set up without subject email or subject hostnameInternal inconsistency: Rekor SET did not match any key but we have no failures.checking if directory %q was remounted with requested flags %v instead of %v: %wError parsing the "auth" field of a credential entry %q in %q, missing semicolonupdate %d of %d passed to Schema2List.UpdateInstances had no media type (was %q)Internal error: collected %d DiffID values, but schema1 manifest has %d fsLayersdocker-daemon: references with both a tag and digest are currently not supporteddetected overlapped free page ID: %d between ids: %v and existing f.freemaps: %vfiles cannot contain NULL bytes; probably using UTF-16; TOML files must be UTF-8x509: invalid signature: parent certificate cannot sign this kind of certificatecrypto/ecdh: internal error: nistec ScalarBaseMult failed for a fixed-size inputtype='signal', interface='org.freedesktop.systemd1.Manager', member='JobRemoved'opaque flag erroneously copied up, consider update to kernel 4.8 or later to fixcrypto/rand: blocked for 60 seconds waiting to read random data from the kernel rootless netns ref counter out of sync, counter is at %d, resetting it back to 0set the `interval` between runs of the `healthcheck` command for the target imagetemporarily set working directory for command (default to container's workingdir)container store is inconsistent and the current caller does not hold a write lockif any flags in the group [%v] are set none of the others can be; %v were all setrejecting potential base image for which the OS value is always-rejected value %qSkipping stage with Name %q and index %d since its not needed by the target stageinternal inconsistency: layer (%d, %q) is not identified by TOC and has no diffID[GOOS: %s, GOARCH: %s] truncating file failed, size: %d, db.datasz: %d, error: %vunable to delete image %q by ID with more than one tag (%s): please force removal (bad use of unsafe.Pointer or having race conditions? try -d=checkptr or -race) invalid environment variable for engine %s, valid configuration is KEY=value pairreading images from docker: reference %q without a tag or digest is not supportedDocker reference %q is for an unknown digest case, has neither a digest nor a tagPrecreate hook %d made configuration changes, but we could not compute a diff: %vCredentials cannot be recorded in Docker-compatible format with namespaced key %qcannot use type %s outside a type constraint: interface is (or embeds) comparablecannot use type %s outside a type constraint: interface contains type constraintsSchema2List.EditInstances: Attempting to update %s which is an invalid digest: %wInternal error: Image.Signatures() is not supported for images modified in memoryInvalid oci: layout reference: cannot use both an image %s and a source index @%dcrypto/rsa: use of public exponent <= 2¹⁶ is not allowed in FIPS 140-only modecrypto/rsa: use of primes of different sizes is not allowed in FIPS 140-only modecrypto/aes: internal error: using generic implementation despite hardware supportLength of the chunk being uploaded, corresponding the length of the request body.An error was encountered processing the delete. The client may ignore this error.public key or cert to be matched against publicKey in Rekor SET has trailing datafilters could not be merged due to a mismatch in attributes or invalid filter: %wTrying to create a layer %#v while directory %q already exists; removing it firstUnsupported keyprovider invocation. Supported invocation methods are grpc and cmdInvalid _journal: %v, expecting value of 'DELETE TRUNCATE PERSIST MEMORY WAL OFF'add default `volume` path to be created for containers based on image (default [])environment variable %q is already defined, skip the settings from containers.confwhile parsing additional build context: %q, accepts value in the form of key=valueenvironment variable %s is already defined, skip the settings from containers.confblob %s with type %s should be compressed with %s, but compressor appears to be %sx509: a root or intermediate certificate is not authorized to sign for this name: refusing to use HTTP_PROXY value in CGI environment; see golang.org/s/cgihttpproxyoverlay: test mount with multiple lowers failed, but succeeded with a single lowerfailed to check if rootless netns program is running: %v, trying to start it againInvalid _query_only: %v, expecting boolean value of '0 1 false true no yes off on'grpc: Server.RegisterService found the handler of type %v that does not satisfy %vreceived goaway with stream id: %v, which exceeds stream id of previous goaway: %vtransport: http2Server.HandleStreams failed to receive the preface from client: %vssh should have syntax id=id[,target=path,required=bool,mode=uint,uid=uint,gid=uintregistry %q is not listed in registries configuration %q, assuming it's not blockedinvalid build output option %q, accepted keys are "type" and "dest" must be presentWhile recovering from a failure to create a container, error deleting layer %#v: %vjson: invalid use of ,string struct tag, trying to unmarshal unquoted value into %vexpected all size classes up to min size for malloc header to fit in one-page spansmultiple private key sources specified when preparing to create sigstore signaturesreflect: embedded type with methods not implemented if there is more than one fieldcrypto/hkdf: use of keys shorter than 112 bits is not allowed in FIPS 140-only modecopier: stat: mapping host filesystem owners %#v to container filesystem owners: %wDocker reference %s is for an unknown digest case but reference has a tag or digestunable to replace %q of host entry %q: host containers internal IP address is emptyinvalid condition: location is unset and prefix is not in the format: *.example.comThe storage 'driver' option should be set in %s. A driver was picked automatically.internal error: modifyDockerConfigJSON called with DockerCompatAuthFilePath not setcannot use ~ outside of interface or type constraint (use ^ for bitwise complement)crypto/rsa: use of keys smaller than 2048 bits is not allowed in FIPS 140-only modex509: issuer has name constraints but leaf contains unknown or unconstrained name: (possibly because of %q while trying to verify candidate authority certificate %q)crypto/cipher: use of CBC with non-AES ciphers is not allowed in FIPS 140-only modecrypto/cipher: use of CTR with non-AES ciphers is not allowed in FIPS 140-only modecrypto/cipher: use of GCM with non-AES ciphers is not allowed in FIPS 140-only modecrypto/hmac: use of keys shorter than 112 bits is not allowed in FIPS 140-only modeThis is returned if the name used during an operation is unknown to the registry.failed to move the rootless netns slirp4netns process to the systemd user.slice: %vmethod configs in service config will be ignored due to presence of config selectoruse the specified container's or image's root directory as the source root directorycan't add prebuilt layers and produce an image with only one layer, at the same timeset the OS to the provided value instead of the current operating system of the hostcould not find image instance %s of manifest list %s in local containers storage: %wstack too short to match cached location; stk = %#x, l.pcs = %#x, original stk = %#xinternal error: no file or blob with artifact "config" or "layer" digest %q recordedcleaning up after failing to set up overlay: %v, while setting up overlay for %q: %wtls: downgrade attempt detected, possibly due to a MitM attack or a broken middleboxTrying to reuse blob with cached digest %s compressed with %s in destination repo %sInternal inconsistency: policyconfiguration.DockerReferenceIdentity returned %#v, %vExactly one of keyPath, keyPaths and keyData must be specified, none of them presentInternal inconsistency: both "rekorPublicKeyPath" and "rekorPublicKeyData" specifiedDocker reference match attempted on image %s with no known Docker reference identity/proc/sys/crypto/fips_enabled does not contain '1', not adding FIPS mode bind mountsinvalid argument: cannot clear %s: argument must be (or constrained by) map or sliceduring manifest conversion: encrypted layers (%q) are not supported in docker imagesexpected a top-level item to end with a newline, comment, or EOF, but got %q insteadx509: signature algorithm specifies an %s public key, but have public key of type %TThe blob has been created in the registry and is available at the provided location.public key or cert to be matched against publicKey in Rekor SET is not in PEM formattype='signal',interface='org.freedesktop.DBus.Properties',member='PropertiesChanged'%s driver needs at least one subnet specified when the host-local ipam driver is setinvalid GOARM: must start with 5, 6, or 7, and may optionally end in either %q or %qfailed to set quota limit for projid %d on %s after backingFsBlockDev recreation: %wInvalid _foreign_keys: %v, expecting boolean value of '0 1 false true no yes off on'buildah tag imageName firstNewName buildah tag imageName firstNewName SecondNewName`path` to an alternate runtime. Use BUILDAH_RUNTIME environment variable to override.at least two arguments are necessary: list and digest of instance to remove from listnetwork namespace isolation not supported with chroot isolation, forcing host networkunable to delete image %q by digest with more than one tag (%s): please force removalThe cgroupv2 manager is set to systemd but there is no systemd user session availableInternal error: copy needs an updated manifest but that was known to be forbidden: %qreflect.Value.Interface: cannot return value obtained from unexported field or methodExactly one of keyPath, keyPaths and keyData must be specified, more than one presentdocker-daemon: reference must have at least one of an image ID and a reference stringcrypto/rsa: use of PSS salt longer than the hash is not allowed in FIPS 140-only modex509: failed to parse private key (use ParseECPrivateKey instead for this key format)x509: failed to parse public key (use ParsePKIXPublicKey instead for this key format)attempt to delete child with id %d from a parent (id=%d) that doesn't currently existthe '--group-add keep-groups' option is not allowed with any other --group-add optionssecret should have syntax id=id[,target=path,required=bool,mode=uint,uid=uint,gid=uintCopying this image would require changing layer representation, which we cannot do: %qreflect: New of type that may not be allocated in heap (possibly undefined cgo C type)tls: MinVersion must be >= VersionTLS13 if EncryptedClientHelloConfigList is populatedtls: MaxVersion must be >= VersionTLS13 if EncryptedClientHelloConfigList is populatedIgnoring exact blob match, compression %s does not match required %s or MIME types %#vexactly one of keyPath, keyPaths, keyData, keyDatas, fulcio, and pki must be specifiedInternal inconsistency: Fulcio specified with not exactly one of "caPath" nor "caData"Internal inconsistency: both "caIntermediatesPath" and "caIntermediatesData" specifiedtweaking mount flags on host root directory before unmounting from mount namespace: %w'name' and 'names' were specified in the seccomp profile, use either 'name' or 'names'Aborting upload, daemonImageDestination closed without a previous .CommitWithOptions()x509: a root or intermediate certificate is not authorized for an extended key usage: x509: failed to parse public key (use ParsePKCS1PublicKey instead for this key format)The specified `name` or `reference` were invalid and the delete was unable to proceed.The blob has been mounted in the repository and is available at the provided location.Failed to load cached network config: %v, falling back to loading network %s from disktarget rename dir '%s' exists but should not, this needs to be manually cleaned up: %woverlay: force_mask option for writeable layers is only supported with a mount_programinternal error using pkg/blobinfocache/sqlite.cache: Close() without a matching Open()cache file path requires network name (%q), container ID (%q), and interface name (%q)Subchannel health check is unimplemented at server side, thus health check is disabledalways remove intermediate containers after a build, even if the build is unsuccessful.set the ARCH of the image to the provided value instead of the architecture of the hostimage name used to replace the value in the first FROM instruction in the Containerfiledestination file to which rusage should be logged to instead of stdout (= the default).set required OS `version` for the target image instead of the value from the base imagelooking up signatures data for image %q (%s): expected at least %d bytes, only found %d%q is an invalid OS component of %q: OSAndVersion specifier component must match %q: %winitializing ID mappings: %s setting is malformed expected ["uint32:uint32:uint32"]: %q/etc/system-fips does not exist in the container, not creating /run/secrets/system-fipsInternal error: NewReaderForReference called for a non-docker/archive ImageReference %sclient-key-data and client-key are both specified for %v; client-key-data will overrideSELECT specificVariantCompressor FROM DigestSpecificVariantCompressors WHERE digest = ?Invalid _writable_schema: %v, expecting boolean value of '0 1 false true no yes off on'path of the authentication file. Use REGISTRY_AUTH_FILE environment variable to overrideadd `environment variable` to be set when running containers based on image (default [])neither --attestation-url nor --passphrase flags provided, disk would not be decryptablebuildah rmi imageID buildah rmi --all --force buildah rmi imageID1 imageID2 imageID3add the image to the specified manifest list. Creates manifest list if it does not existdo not create new /etc/hosts file for RUN instructions, use the one from the base image.set required OS `feature` for the target image in addition to values from the base imagesaving credentials to ~/.docker/config.json, but not using Docker-compatible file formatshort-name %q did not resolve to an alias and no containers-registries.conf(5) was foundinternal error: PrepareStagedLayer returned CompressedDigest %q not matching expected %qInternal error: storageImageDestination.CommitWithOptions() called without PutManifest()docker: image reference %q has unknown digest set but it contains either a tag or digestInternal inconsistency: not exactly one of "keyPath", "keyPaths" and "keyData" specifiedgenerating measurement: no line starting with %q found in output from krunfw_measurementexpected %d bytes of padding after previous file, but next SegmentType only has %d bytesx509: failed to parse private key (use ParsePKCS8PrivateKey instead for this key format)x509: failed to parse private key (use ParsePKCS1PrivateKey instead for this key format)finished reading from image %q using blob cache: cache had %d hits, %d misses, %d errorserror parsing configuration list: `loadOnlyInlinedPlugins` is true, and no 'plugins' keyset the maximum amount of `time` to wait for a `healthcheck` command for the target imageSHELL is not supported for OCI image format, %s will be ignored. Must use `docker` formatincorrect secret flag format: should be --secret id=foo,src=bar[,env=ENV][,type=file|env]v2s1 image uses a layer identified by TOC with unknown diffID; choosing a random image IDImage operating system mismatch: image uses OS %q+architecture %q+%q, expecting one of %qcopier: put: error mapping container filesystem owner %d:%d to host filesystem owners: %vError parsing signature storage configuration: "default-docker" defined both in %q and %qError during manifest conversion: %q: zstd compression is not supported for docker imagesstorage option overlay.size and overlay.inodes only supported for backingFS XFS. Found %vUnexpected error by Additional Layer Store %v during use; GC doesn't seem to be supporteduse certificates at the specified path to access registries and sources in HTTPS locationsset annotations or artifact type for the index itself instead of for an entry in the indexuse intermediate layers during build. Use BUILDAH_LAYERS environment variable to override.ulimit soft limit must be less than or equal to hard limit: soft: -1 (unlimited), hard: %dhttp2: server sent GOAWAY and closed the connection; LastStreamID=%v, ErrCode=%v, debug=%qfunc must be func(yield func(...) bool): yield func returns user-defined boolean, not boolInternal error: ManifestTagsForReference called for a non-docker/archive ImageReference %sclient-cert-data and client-cert are both specified for %v. client-cert-data will overrideComplete the upload specified by `uuid`, optionally appending the body as the final chunk.{ "repositories": [ , ... ] "next": "?last=&n=" }Invalid _defer_foreign_keys: %v, expecting boolean value of '0 1 false true no yes off on'Invalid _recursive_triggers: %v, expecting boolean value of '0 1 false true no yes off on'Invalid _secure_delete: %v, expecting boolean value of '0 1 false true no yes off on fast'pkcs7: cannot decrypt data: only RSA, DES, DES-EDE3, AES-256-CBC and AES-128-GCM supported Copies the contents of a file, URL, or directory into a container's working directory.invalid environment variable %q from containers.conf, valid configuration is KEY=value pairprefer OS/ARCH instead of the current operating system and architecture for choosing images`type` of process isolation to use. Use BUILDAH_ISOLATION environment variable to override.ONBUILD is not supported for OCI image format, %s will be ignored. Must use `docker` formatdo not create new /etc/hostname file for RUN instructions, use the one from the base image.memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on NUMA systems.error preparing updated manifest: encryption specified but no counterpart for mediatype: %qtls: unexpected encrypted client hello extension in server hello despite ECH being acceptedcopier: mkdir: error mapping container filesystem owner %d:%d to host filesystem owners: %vUnable to delete %v. Image may not exist or is not stored with a v2 Schema in a v2 registrya library subroutine needed to run a subprocess, but reexec.Init() was not called in main()cannot use interface %s in conversion (contains specific type constraints or is comparable)Limit the number of entries in each response. It not present, all entries will be returned.dbus.Store: type mismatch: destination struct does not have enough fields need: %d have: %dINSERT OR REPLACE INTO DigestUncompressedPairs(anyDigest, uncompressedDigest) VALUES (?, ?)Invalid _case_sensitive_like: %v, expecting boolean value of '0 1 false true no yes off on'Unsupported codec %q. Defaulting to %q for now. This will start to fail in future releases.attempt to add child of type %T with id %d to a parent (id=%d) that doesn't currently existinternal error: untrustedLayerDiffID has no value available and fallback was not implementedAlternatively, you can enable lingering with: `loginctl enable-linger %d` (possibly as root)pulling source images by short name (%q) is not supported, please use a fully-qualified nametls: server sent encrypted client hello retry configs after accepting encrypted client hellotls: handshake hash for a client certificate requested after discarding the handshake buffercopier: ensure: error mapping container filesystem owner %d:%d to host filesystem owners: %v--system --shell /bin/false --no-create-home --disabled-login --disabled-password --group %sNo non-localhost DNS nameservers are left in resolv.conf. Using default external servers: %vFound an empty credential entry %q in %q (an unhandled credential helper marker?), moving onno suitable key unwrapper found or none of the private keys could be used for decryption: %sIf a blob upload has been cancelled or was never started, this error code may be returned.dnsname and internal networks are incompatible. dnsname plugin not configured for network %sa network file system with user namespaces is not supported. Please use a mount_program: %winvalid GOARM64: must start with v8.{0-9} or v9.{0-5} and may optionally end in %q and/or %q%w: subpath %s/%s has an overmount obscuring the real path (mount ids do not match %d != %d)adds created image to the specified manifest list. Creates manifest list if it does not existbuildah rm containerID buildah rm containerID1 containerID2 containerID3 buildah rm --alltls: unsupported certificate: private key is *ed25519.PrivateKey, expected ed25519.PrivateKeyInternal inconsistency: PKI specified with not exactly one of "caRootsPath" nor "caRootsData"parseLine only accepts {*string, *int, *int64, *[]string} as arguments! %#v is not a pointer!The operation was unsupported due to a missing implementation or invalid set of parameters.estargz layers don't support partial pulls with guaranteed consistency with non-partial pullscrypto/rsa: %d-bit keys are insecure (see https://go.dev/pkg/crypto/rsa#hdr-Minimum_key_size)Invalid repository name encountered either during manifest validation or any API operation.Unexpected error by Additional Layer Store %v during release; GC doesn't seem to be supportedinternal error: PrepareStagedLayer succeeded with neither TOCDigest nor UncompressedDigest setEnsureCompressionVariantsExist is not implemented when not creating a multi-architecture imageChecking if we can reuse blob %s: general substitution = %v, compression for MIME type %q = %vError parsing signature storage configuration: "docker" namespace %q defined both in %q and %qA uuid identifying the upload. This field can accept characters that match `[a-zA-Z0-9-_.=]+`.Not using native diff for overlay, this may cause degraded performance for building images: %vINSERT OR REPLACE INTO DigestTOCUncompressedPairs(tocDigest, uncompressedDigest) VALUES (?, ?)sqlite3: Serialize requires the sqlite_serialize build tag when using the libsqlite3 build tagsize mismatch (see https://github.com/golang/protobuf/issues/1609): calculated=%d, measured=%dgrpc-status-details-bin mismatch: grpc-status=%v, grpc-message=%q, grpc-status-details-bin=%+vbuildah unshare id buildah unshare cat /proc/self/uid_map buildah unshare buildah-script.shkey with the encryption protocol to use needed to encrypt the image (e.g. jwe:/path/to/key.pem)set the time between health checks during the start period. Only available with format `docker`the log level to be used, one of "trace", "debug", "info", "warn", "error", "fatal", or "panic"HEALTHCHECK is not supported for OCI image format and will be ignored. Must use `docker` formatinternal error: PrepareStagedLayer returned a TOC-only identity for layer %q with no TOC digestthe first key[%d]=(hex)%s on %s page(%d) needs to be >= the key in the ancestor (%s). Stack: %vkey[%d]=(hex)%s on %s page(%d) needs to be > (found <) than previous element (hex)%s. Stack: %vkey[%d]=(hex)%s on %s page(%d) needs to be > (found =) than previous element (hex)%s. Stack: %vinternal error: in.destSupportedManifestMIMETypes is empty but supportedByDest is empty as wellCompression using zstd:chunked is not beneficial for encrypted layers, using plain zstd instead(heuristic tuning data: total %d @%.3f ms, last retry %d @%.3f ms, last progress @ %.3f ms): %wWriting directly to a %s lookaside %s is not supported. Configure a lookaside-staging: locationInternal inconsistency: more than one of "keyPath", "keyPaths", "keyData", "keyDatas" specifiedInternal inconsistency: "keyPath", "keyPaths", "keyData" and "keyDatas" produced no public keysunable to verify signature: EC Public Key with curve %q does not support signature algorithm %qPut the manifest identified by `name` and `reference` where `reference` can be a tag or digest.cannot mount using driver %s in rootless mode. You need to run it in a `buildah unshare` sessionSSH agent socket or keys to expose to the build. (format: default|[=|[,]])short-name %q did not resolve to an alias and no unqualified-search registries are defined in %qinternal error: layer %d for blob %s was identified by TOC, but we don't have a DiffID in configNot removing credentials because namespaced keys are not supported for the credential helper: %sb3312fa7e23ee7e4988e056be3f82d19181d9c6efe8141120314088f5013875ac656398d8a2ed19d2a85c8edd3ec2aefaa87ca22be8b05378eb1c71ef320ad746e1d3b628ba79b9859f741e082542a385502f25dbf55296c3a545e3872760ab73617de4a96262c6f5d9e98bf9292dc29f8f41dbd289a147ce9da3113b5f0b8c00a60b1ce1d7e819d7a431d7c90ea0e5fcrypto/rsa: use of hash functions other than SHA-2 or SHA-3 is not allowed in FIPS 140-only modeOperations on blobs identified by `name` and `digest`. Used to fetch or delete layers by digest.Invalid _ignore_check_constraints: %v, expecting boolean value of '0 1 false true no yes off on'sqlite3: Deserialize requires the sqlite_serialize build tag when using the libsqlite3 build tagImage %s exists in local storage but may be corrupted (remove the image to resolve the issue): %vinternal error: missing compressor names (src base: %q, uploaded base: %q, uploaded specific: %q)crypto/hkdf: use of hash functions other than SHA-2 or SHA-3 is not allowed in FIPS 140-only modehttp: RoundTripper implementation (%T) returned a *Response with content length %d but a nil Bodymissing key %s for client certificate %s. Note that CA certificates should use the extension .crtcrypto/hmac: use of hash functions other than SHA-2 or SHA-3 is not allowed in FIPS 140-only modeThe upload is known and in progress. The last received offset is available in the `Range` header.%s requires libseccomp >= %d.%d.%d and API level >= %d (current version: %d.%d.%d, API level: %d)set new timestamps in image info and layer to `seconds` after the epoch, defaults to current times Adds or updates information about an image index or an entry in a manifest list or image index.locating item named %q for image with ID %q (consider removing the image to resolve the issue): %werror preparing updated manifest: decryption specified but original mediatype is not encrypted: %qNoClientCertRequestClientCertRequireAnyClientCertVerifyClientCertIfGivenRequireAndVerifyClientCertNone of the challenges sent by server (%s) are supported, trying an unauthenticated request anywayclient-key-data or client-key must be specified for %v to use the clientCert authentication methodcrypto/ecdsa: use of hash functions other than SHA-2 or SHA-3 is not allowed in FIPS 140-only modeThe manifest has been accepted by the registry and is stored under the specified `name` and `tag`.suggesting cached blob with digest %q, type %q, and compression %v in place of blob with digest %qLoopback device and filesystem disagree on device/inode for %q: %#x(%d):%#x(%d) vs %#x(%d):%#x(%d)COMMENT is not supported for OCI image format, comment %s will be ignored. Must use `docker` formatinternal error: compressed layer %q (for compressed digest %q) does not have an uncompressed digestcompression using %s, and encryption, required together with format %s, which does not support bothgrpc: the credentials require transport level security (use grpc.WithTransportCredentials() to set)Manifest list must be converted to type %q to be written to destination, but we cannot modify it: %qWildcarded prefix should be in the format: *.example.com. Current prefix %q is incorrectly formatteddocker-daemon: reference must not have an image ID and a reference string specified at the same timeed25519: expected opts.Hash zero (unhashed message, for standard Ed25519) or SHA-512 (for Ed25519ph)Initiate a blob upload. This endpoint can be used to create resumable uploads or monolithic uploads.This error is returned when the manifest, identified by name and tag is unknown to the repository.During manifest upload, if the manifest fails signature verification, this error will be returned.Balancer retrieved for name %q. grpc-go will be switching to case sensitive balancer registries soonnum values of :authority: %v, num values of host: %v, both must only have 1 value as per HTTP/2 specrejecting potential base image architecture %q for which Go has no knowledge of how to do unsafe codecopying multiple images: destination transport %q does not support copying multiple images as a groupThe current kernel doesn't support mounting EROFS directly from a file, fallback to a loopback device%s: the backing %s filesystem is formatted without d_type support, which leads to incorrect behavior.The source and target buckets are not in the same db file, source bucket in %s and target bucket in %scgocheck > 1 mode is no longer supported at runtime. Use GOEXPERIMENT=cgocheck2 at build time instead.http2: failed reading the frame payload: %w, note that the frame header looked like an HTTP/1.1 headerinvalid options %q, can only specify 1 '[r]shared', '[r]private', '[r]slave' or '[r]unbindable' optionssh: signature algorithm %q isn't a key format; key is malformed and should be re-encoded with type %qINSERT OR REPLACE INTO KnownLocations(transport, scope, digest, location, time) VALUES (?, ?, ?, ?, ?)Not considering unrecognized specific compression variant %q for BlobInfoCache record of digest %q: %vignoring service config from resolver (%v) and applying the default because service config is disabledBalancer registered with name %q. grpc-go will be switching to case sensitive balancer registries sooninternal error: in PutBlobPartial, untrustedLayerDiffID returned errUntrustedLayerDiffIDNotYetAvailableLayer %s not found in layer tree. The storage may be corrupted, consider running `podman system check`.encryption required but the destination only supports MIME types [%s], none of which support encryptionincorrect mount format: should be --mount type=,[src=,]target=[,options]copier: conditionalRemove: error mapping container filesystem owner %d:%d to host filesystem owners: %vrequest returned %s with a message (> %d bytes); check if the server supports the requested API versionIgnoring BlobInfoCache record of digest %q, compression %q does not match required %s or MIME types %#vadd onbuild command to be run on images based on this image. Only supported on 'docker' formatted imagesHOSTNAME is not supported for OCI V1 image format, hostname %s will be ignored. Must use `docker` formatrequest returned %s for API route and version %s, check if the server supports the requested API versionClient received GoAway with error code ENHANCE_YOUR_CALM and debug data equal to ASCII "too_many_pings". Creates a new working container, either from scratch or using a specified image as a starting point.expected either a list name and --index or a list name and an image digest or image name or artifact namebuildah umount containerID buildah umount containerID1 containerID2 containerID3 buildah umount --allDOMAINNAME is not supported for OCI image format, domainname %s will be ignored. Must use `docker` format`format` of the built image's manifest and metadata. Use BUILDAH_FORMAT environment variable to override.compression using %s required but the destination only supports MIME types [%s], none of which support itCan't read parent link %q because it does not exist. Going through storage to recreate the missing links.SELECT location, time FROM KnownLocations WHERE transport = ? AND scope = ? AND KnownLocations.digest = ?Failed to write a GOAWAY frame as part of connection close after %s. Giving up and closing the transport.Setting --no-cache=true since --cache-ttl was set to 0s which effectively means user wants to ignore cacheed25519: expected opts.HashFunc() zero (unhashed message, for standard Ed25519) or SHA-512 (for Ed25519ph)The blob identified by `digest` is available. The blob content will be present in the body of the request.asn1: time did not serialize back to the original value and may be invalid: given %q, but serialized as %qState: %v, Target: %s, CallsStarted: %v, CallsSucceeded: %v, CallsFailed: %v, LastCallStartedTimestamp: %vInternal error: storageImageDestination.CommitWithOptions(): commitLayer() not ready to commit for layer %qTrying to reuse blob with cached digest %s compressed with %s with no location match, checking current repo Display information about the host and current storage statistics which are useful when reporting issues.buildah manifest remove mylist:v1.11 sha256:15352d97781ffdf357bf3459c037be3efac4133dc9070c2dce7eca7c05c3e736use the specified compression algorithm if the destination contains a differently-compressed variant alreadyTrying to reuse blob with cached digest %s in destination repo with no location match, checking current repoInternal inconsistency: PKI specified with invalid value from "caIntermediatesPath" or "caIntermediatesData"'architectures' and 'archMap' were specified in the seccomp profile, use either 'architectures' or 'archMap'%s contains several valid graphdrivers: %s; Please cleanup or explicitly choose storage driver (-s )crypto/cipher: use of GCM with arbitrary IVs is not allowed in FIPS 140-only mode, use NewGCMWithRandomNoncestorage options overlay.size and overlay.inodes not supported. Filesystem does not support Project Quota: %wCan't stat lower layer %q because it does not exist. Going through storage to recreate the missing symlinks.CREATE TABLE IF NOT EXISTS DigestCompressors(digest TEXT PRIMARY KEY NOT NULL,compressor TEXT NOT NULL )Ignoring BlobInfoCache record of digest %q, uncompressed format does not match required %s or MIME types %#vReceived a HEADERS frame with a :connection header which makes the request malformed, as per the HTTP/2 specexplicitly requested to combine zstd:chunked with encryption, which is not beneficial; use plain zstd insteadrekorPublickeyPath, rekorPublicKeyPaths, rekorPublickeyData and rekorPublicKeyDatas are not supported for pkiInvalid docker-daemon: reference %s: The %s repository name is reserved for (non-shortened) digest referencesBlob mount is not allowed because the registry is configured as a pull-through cache or for some other reason[