macos; no supported way to prove selected child manifest/config for a local oci index #751

Bug report

report; docker desktop with the containerd image store does not expose supported evidence identifying the exact platform-specific manifest and config selected when a container is created from a local immutable oci index digest. environment; macos on apple silicon/arm64 mac studio; docker desktop 29.4.3; engine api 1.54; containerd image store; diagnostic id e3686b00-b74f-430b-a380-eb91d7a0a7dd/20261016210319. locked identities; index sha256;7f460c18edad17145828c5d579cbf67a0ba61ab925363b742d566f8896d2e424; arm64 manifest sha256;0f09f38ce4cdd3035f265e3fa7a08e58627f1df3c775c369a7c9fe986ef5767b; config sha256;ad4db8c2d097f232fb639503bb5f0ae1cd8fe460993c14daadddf8a99884ab3f. reproduction and observed behavior; inspecting repository at oci-index encounters a stale host-side apicache 404. inspecting the exact bare index succeeds with docker image inspect --platform linux/arm64 and reports the index id, expected repodigest, os linux, and architecture arm64, but the image-inspect response has no top-level descriptor and exposes neither the resolved child-manifest digest nor media type. creating a never-started container from the same immutable bare index with --platform linux/arm64 --pull=never leaves config.image as the bare index selector, top-level image equal to the oci index digest rather than the config digest, and imagemanifestdescriptor null. historical build provenance records the index to runnable linux/arm64 manifest to config graph. an offline docker image save can prove the stored content graph but not which child/config docker desktop selected at create time. no supported host path was found for reading the exact raw index, manifest, and config objects from the local containerd content store by digest. registry-facing tools, unsupported internal ctr or vm access, export/import, and rebuild are not acceptable substitutes. expected behavior; docker desktop should expose the exact manifest digest and config digest resolved for the platform-specific create operation. question; on docker desktop 29.4.3 with the containerd image store, what supported mechanism can verify the exact platform-specific manifest and config selected when creating a linux/arm64 container from a local immutable oci index digest with --pull=never, without registry access or rebuilding/ if a supported local raw-oci-content path exists, please provide the documented command or api endpoint, namespace, and fields needed to prove the index to runnable arm64 manifest to config chain. if no such path exists, what is the supported authoritative evidence and how can callers obtain the resolved child-manifest and config identities/ no container was started, no image was rebuilt or imported, and no raw diagnostic contents are included.

Platform

macOS

Version information

Docker Desktop 29.4.3; Docker Engine API 1.54; containerd image store

Diagnostics ID

E3686B00-B74F-430B-A380-EB91D7A0A7DD/20261016210319