Use arm64 Linux runners to build linux/arm64 platform images

[eitsupi]

Is it necessary to use cache built with arm64 runner during multi-platform builds using buildx bake?
Need to look into best practices.

[eitsupi]

Note: Build each platform images with --output push-by-digest=true and --metadata-file option and create the multi platform manifest with the docker buildx imagetools create command.

Ref: https://docs.docker.com/build/ci/github-actions/multi-platform/#distribute-build-across-multiple-runners

[eitsupi]

@cboettig I know you were against the adoption of docker/build-push-action a few years ago, are you still of the same opinion?
I tried arm64 runner build manually on rocker-org/devcontainer-images#72 and it seems to me that aggregating information on images generated across multiple runners with digest is a fairly complex task and quite difficult without docker/build-push-action.

[cboettig]

agreed, the prebuilt action seems like a good choice here.

[eddelbuettel]

FWIW and chiefly because it is the only arm64 access I have I also resorted to building Docker containers for arm64 under the arm64 runners. Naively ignoring the aspect at first I also ran into the manifest issue, so now (for noble) I build arm64 and amd64 in one job using the basic standard approach via QEMU. See the corresponding Dockerfile which now has two (non-interdependent) jobs: the old matrix, now just for focal and jammy, and the new 'platform' build for arm64 and amd64. Easy enough, but slower as it is sequential. These are fairly small containers so it doesn't matter.

[eitsupi]

For context, I panicked and switched to a using multiple runners because multi-platform builds that used to take about 3 hours to finish on https://github.com/rocker-org/devcontainer-images recently started failing to finish within the 6-hour limit.

https://github.com/rocker-org/devcontainer-images/actions/runs/13688987947

After rocker-org/devcontainer-images#72, the job that could not be finished in 6 hours is now finished within 10 minutes, which is a significant speed-up.
However, ugly tags from before the merge remain in the registry. (It was necessary to do a push using per-platform tags as an intermediate format, as it was deemed impossible to get a digest of the built images with a simple shell script.)