简单描述一下问题和重现方式

Dockerfile

FROM postgres:16-bookworm

.cnb.yml

$:
  vscode:
    - docker:
        image: postgres:16-bookworm
      services:
        - vscode
        - name: docker
          options:
            rootlessBuildkitd: 
              enabled: true
      stages:
        - name: ls
          script: ls

main:
  push:
    - runner:
        tags: cnb:arch:amd64
      docker:
        image: postgres:16-bookworm
      services:
        - name: docker
          options:
            rootlessBuildkitd: 
              enabled: true
      env:
        IMAGE_TAG: ${CNB_DOCKER_REGISTRY}/${CNB_REPO_SLUG_LOWERCASE}:latest
      stages:
        - name: docker login
          script: docker login -u ${CNB_TOKEN_USER_NAME} -p "${CNB_TOKEN}" ${CNB_DOCKER_REGISTRY}
        - name: docker build and push
          script: docker buildx build -t ${IMAGE_TAG} --platform linux/amd64,linux/arm64 --push .

错误提示

Runner[10.235.0.13][docker] 2025-12-08 14:28:52 $ docker buildx build -t ${IMAGE_TAG} --platform linux/amd64,linux/arm64 --push .

docker exec -i $ORANGE_ENVS cnb-ok8-1jbuabkfr-001 sh -e -c "$ORANGE_TMP_SHELL"

#0 building with "buildkit-builder" instance using remote driver

#1 [internal] load build definition from Dockerfile
#1 transferring dockerfile: 62B done
#1 DONE 0.1s

#2 [linux/amd64 internal] load metadata for docker.io/library/postgres:16-bookworm
#2 ...

#3 [linux/arm64 internal] load metadata for docker.io/library/postgres:16-bookworm
#3 ERROR: failed to authorize: failed to fetch anonymous token: Get "https://auth.docker.io/token?scope=repository%3Alibrary%2Fpostgres%3Apull&service=registry.docker.io": tls: failed to verify certificate: x509: certificate signed by unknown authority

#2 [linux/amd64 internal] load metadata for docker.io/library/postgres:16-bookworm
#2 CANCELED
------
 > [linux/arm64 internal] load metadata for docker.io/library/postgres:16-bookworm:
------
WARNING: current commit information was not captured by the build: git was not found in the system: exec: "git": executable file not found in $PATH
Dockerfile:1
--------------------
   1 | >>> FROM postgres:16-bookworm
--------------------
ERROR: failed to solve: failed to fetch anonymous token: Get "https://auth.docker.io/token?scope=repository%3Alibrary%2Fpostgres%3Apull&service=registry.docker.io": tls: failed to verify certificate: x509: certificate signed by unknown authority

Finished, code: 1, duration: 2.2s

任务执行失败，返回码：1, signal: -1

这个问题已经解决，等发版。

我们给 buildkit 启动的时候，配置了 mirror。应该是可以解决你这问题的。

已发布