wolfi-base:latest - image config verification fails on pull (digest mismatch)

[frntn]

Which image/versions are related to this issue/feature request?

wolfi-base:latest

Issue/Feature description

The cgr.dev/chainguard/wolfi-base:latest image currently fails to pull
with a digest mismatch error:

$ docker pull cgr.dev/chainguard/wolfi-base:latest
error pulling image configuration: image config verification failed for digest
sha256:fc2127d0e0886a502a46849c1f0cf57bf228fb758d1d2df0109af69cf4028612

Also fails during Docker build with:
"failed size validation: 33083 != 2863: failed precondition"

Environment:

• Docker Engine on Linux (WSL2)
• Date: 2026-03-04
• Attempted: cache prune, builder prune -af, restart Docker daemon

The issue appears to be server-side — the manifest references a config blob
whose size doesn't match the actual content served by the registry.

[xnox]

Thank you for your report, checking.

[xnox]

Can you provide full version details of your docker?
Are you out of disk space, or have any issues writing to disk?
Do you have any network connectivity issues?
Are you able to try another mirror?

Alternative locations for wolfi-base are available at:

• docker pull public.ecr.aws/chainguard/wolfi-base:latest
• docker pull chainguard/wolfi-base

Unable to reproduce locally:

$ docker pull --platform linux/arm64 cgr.dev/chainguard/wolfi-base:latest
latest: Pulling from chainguard/wolfi-base
f8c70f64240e: Pull complete 
a07f04218323: Pull complete 
78e6465d299b: Pull complete 
476e178de2a6: Pull complete 
58258abbd6ee: Pull complete 
d59129664e62: Pull complete 
a7f7499d6d15: Pull complete 
2ffcaa5eef4c: Pull complete 
0432f8c5292a: Pull complete 
9f197b8c84b9: Pull complete 
becdadfc6313: Pull complete 
Digest: sha256:74cc4315c1344a40a7ac1e7d1b8f26cc7dba2256791338c0f12e745be950a143
Status: Downloaded newer image for cgr.dev/chainguard/wolfi-base:latest
cgr.dev/chainguard/wolfi-base:latest

$ docker pull --platform linux/amd64 cgr.dev/chainguard/wolfi-base:latest
latest: Pulling from chainguard/wolfi-base
8b7b5281edc4: Pull complete 
174181e727b5: Pull complete 
3f02fc482423: Pull complete 
1d53393b78f0: Pull complete 
2a4da0691147: Pull complete 
7c6e71c1fdfd: Pull complete 
a45907cabfcb: Pull complete 
3737345308ab: Pull complete 
54bfed0539e5: Pull complete 
cdea145aa115: Pull complete 
0059584e9238: Pull complete 
Digest: sha256:74cc4315c1344a40a7ac1e7d1b8f26cc7dba2256791338c0f12e745be950a143
Status: Downloaded newer image for cgr.dev/chainguard/wolfi-base:latest
cgr.dev/chainguard/wolfi-base:latest

[frntn]

Environment

• Docker Engine: 29.1.5 (Community), API 1.52
• containerd: v2.2.1,
• runc: 1.3.4
• Platform: linux/amd64 (WSL2, kernel 5.15.167.4-microsoft-standard-WSL2)
• Disk space was not an issue, network was fine (other images pulled successfully)

Timeline

On 2026-03-04, docker pull cgr.dev/chainguard/wolfi-base:latest consistently failed with:

error pulling image configuration: image config verification failed for digest
sha256:fc2127d0e0886a502a46849c1f0cf57bf228fb758d1d2df0109af69cf4028612

During Docker build, the same manifest gave a more specific error:

failed to solve: cgr.dev/chainguard/wolfi-base:latest: failed commit on ref
"config-sha256:fc2127d0e0886a502a46849c1f0cf57bf228fb758d1d2df0109af69cf4028612":
failed size validation: 33083 != 2863: failed precondition

The config blob declared a size of 2863 bytes but the registry served 33083 bytes, causing the digest/size validation to fail.

What I tried (all failed with the same error)

• docker builder prune -af (cleared 25 GB of build cache)
• docker buildx build --no-cache
• sudo systemctl restart docker
• docker pull directly (same digest mismatch)

Resolution

On 2026-03-05, docker pull cgr.dev/chainguard/wolfi-base:latest succeeded with a new manifest digest:

Digest: sha256:00f9662b838432de5f24eabe5dc86f20d1510d158eda1bcaf68bbba8412544cc

The issue resolved itself after the image was republished server-side.

The old manifest (referencing config blob sha256:fc2127d0...) appears to have had a corrupted or mismatched config blob in the registry.

[xnox]

This is still concerning, let me escalate this internally still.