Images only available for single architecture.

[pfandzelter]

Hello, thank you for your work!
Unless I misunderstand how/when LTS images are available, it appears that a recent change has led to LTS to being only pushed for linux/arm64 (Apache) and linux/386 (NGINX). See Docker Hub:
Nginx: https://hub.docker.com/r/owasp/modsecurity-crs/tags?name=4.25-nginx
Apache: https://hub.docker.com/r/owasp/modsecurity-crs/tags?name=4.25-apache

I would expect these images to remain multi-architecture.
Thanks!

[fzipi]

@pfandzelter that's weird. Do you have time for debugging this?

[pfandzelter]

I assume that this was introduced with 7c1554f. CI for the last release (https://github.com/coreruleset/modsecurity-crs-docker/actions/runs/28645668048) shows an individual job for each platform, while the previous (https://github.com/coreruleset/modsecurity-crs-docker/actions/runs/28404527510) had all three platforms within a job. That will cause some race where a push to a tag overwrites a previous tag and only the last architecture that was built remains on Docker Hub

[fzipi]

Thanks! Care to send a PR with the fix? 😃

[pfandzelter]

I could look into using the docker/github-builder/bake.yml action, would that work for you? Simplifies the CI but introduces a dependency on that action 🤔 Manually extending the current publish.yml would probably (?) involve pushing each image by digest (not tag) and then tagging the multi-arch manifest in a separate step. Or going back to the non-parallelized build, which isnt optimal

[fzipi]

I think we had this problem in the past. Whatever you think is good, give it a try. We are open to iterate.

[fzipi]

Root cause confirmed: 7c1554f split each bake target's build into one job per platform (to use native ARM runners), but every job still pushed under the same final tags. The three concurrent pushes for a target raced, and only the last platform to finish survived on Docker Hub/GHCR — that's why LTS tags ended up single-arch.

#445 fixes this by reverting to one job per target (all platforms built together via QEMU), which is correct but gives up the native-ARM speedup.

Opened #447 as an alternative that keeps the per-platform distribution: each platform job now pushes by digest only, and a new merge job assembles the digests per target into one multi-arch manifest with docker buildx imagetools create (which also handles the cross-registry copy to both Docker Hub and GHCR). Validated the core mechanics locally against throwaway registries before opening it.