From 698f767f82c50e9190bba690ca8c6939578cca25 Mon Sep 17 00:00:00 2001
From: Gloridust <Gloridust@gmail.com>
Date: Fri, 19 Jun 2026 01:44:23 +0800
Subject: [PATCH] =?UTF-8?q?fix(build):=20build-local=20=E7=94=A8=20--prove?=
 =?UTF-8?q?nance=3Dfalse=20=E5=87=BA=E5=8D=95=E4=B8=80=E9=95=9C=E5=83=8F?=
 =?UTF-8?q?=EF=BC=8C=E9=81=BF=E5=85=8D=E7=BB=8F=E5=85=B8=20API=20=E4=BB=8D?=
 =?UTF-8?q?=E8=A7=A3=E6=9E=90=E5=88=B0=E6=97=A7=E9=95=9C=E5=83=8F?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Docker 29 + containerd 镜像存储下，plain docker build -t :tag 会生成带 attestation 的
manifest list；docker image inspect / docker run / 面板用的 dockerode 解析 :tag 时不跟到
新 manifest list，仍指向同名旧镜像，导致重建实例还是用旧镜像。加 --provenance/--sbom=false
出单一镜像即可被经典 API 正确解析。

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 scripts/build-local.sh | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/scripts/build-local.sh b/scripts/build-local.sh
index 75ba323..4066f7d 100755
--- a/scripts/build-local.sh
+++ b/scripts/build-local.sh
@@ -18,11 +18,15 @@ VER="${WOC_VERSION:-dev-$(git -C "$ROOT" rev-parse --short HEAD 2>/dev/null || e
 PANEL_IMAGE="ghcr.io/${OWNER}/woc-panel:${TAG}"
 WECHAT_IMAGE="ghcr.io/${OWNER}/wechat-on-cloud:${TAG}"
 
+# --provenance=false --sbom=false：本地构建出「单一镜像」而非带 attestation 的 manifest list。
+# 否则在 Docker 29 + containerd 镜像存储下，经典 API（docker image inspect / docker run / 面板用的
+# dockerode）解析 :tag 时不会跟到新 manifest list、仍指向同名旧镜像 → 重建实例还是用旧镜像（实测踩过）。
+# 面板靠 dockerode 跑实例，故实例镜像尤其必须用这俩参数。
 echo "==> 构建面板镜像 ${PANEL_IMAGE} （版本号 ${VER}）"
-docker build --build-arg "WOC_VERSION=${VER}" -t "${PANEL_IMAGE}" "${ROOT}/panel"
+docker build --provenance=false --sbom=false --build-arg "WOC_VERSION=${VER}" -t "${PANEL_IMAGE}" "${ROOT}/panel"
 
 echo "==> 构建微信实例镜像 ${WECHAT_IMAGE}"
-docker build -t "${WECHAT_IMAGE}" "${ROOT}/docker"
+docker build --provenance=false --sbom=false -t "${WECHAT_IMAGE}" "${ROOT}/docker"
 
 echo
 echo "完成。本地镜像："