Gitlab docker build issue fix.

.gitlab-ci.yml

@@ -24,17 +24,33 @@ build-image:
     - echo "$CI_REGISTRY_PASSWORD" | docker login -u "$CI_REGISTRY_USER" --password-stdin "$CI_REGISTRY"
   script:
     - docker build --pull -t "$IMAGE_SHA" .
-    # with-server-engine extends the runtime stage, so this build reuses every
-    # layer from the one above and only adds the python/faster-whisper layer.
-    - docker build --target with-server-engine -t "$IMAGE_SHA_FW" .
-    - docker push "$IMAGE_SHA"
-    - docker push "$IMAGE_SHA_FW"
-    # Only the default branch moves the :latest tags.
+    # Fully tag + push this image (including :latest) before building
+    # with-server-engine below. That build shares almost all layers with this
+    # one (it extends the runtime stage), and building a second image sharing
+    # content with an already-tagged one is a known containerd-image-store/
+    # buildx bug where the earlier tag's local reference can stop resolving
+    # ("tag does not exist" on push) — see moby/moby#52897 and
+    # docker/setup-buildx-action#116. Finishing all push/tag work on this
+    # image first closes that window.
     - |
       if [ "$CI_COMMIT_BRANCH" = "$CI_DEFAULT_BRANCH" ]; then
         docker tag "$IMAGE_SHA" "$IMAGE_LATEST"
+      fi
+    - docker push "$IMAGE_SHA"
+    - |
+      if [ "$CI_COMMIT_BRANCH" = "$CI_DEFAULT_BRANCH" ]; then
         docker push "$IMAGE_LATEST"
+      fi
+    # with-server-engine extends the runtime stage, so this build reuses every
+    # layer from the one above and only adds the python/faster-whisper layer.
+    - docker build --target with-server-engine -t "$IMAGE_SHA_FW" .
+    - |
+      if [ "$CI_COMMIT_BRANCH" = "$CI_DEFAULT_BRANCH" ]; then
         docker tag "$IMAGE_SHA_FW" "$IMAGE_LATEST_FW"
+      fi
+    - docker push "$IMAGE_SHA_FW"
+    - |
+      if [ "$CI_COMMIT_BRANCH" = "$CI_DEFAULT_BRANCH" ]; then
         docker push "$IMAGE_LATEST_FW"
       fi
   rules: