Fix: restrict EnsureContent to the requested platform

pkg/cmd/image/convert.go

@@ -76,7 +76,7 @@ func Convert(ctx context.Context, client *containerd.Client, srcRawRef, targetRa
 	convertOpts = append(convertOpts, converter.WithPlatform(platMC))
 
 	// Ensure all the layers are here: https://github.com/containerd/nerdctl/issues/3425
-	err = EnsureAllContent(ctx, client, srcRef, options.GOptions)
+	err = EnsureAllContent(ctx, client, srcRef, platMC, options.GOptions)
 	if err != nil {
 		return err
 	}

pkg/cmd/image/ensure.go

@@ -27,6 +27,7 @@ import (
 	containerd "github.com/containerd/containerd/v2/client"
 	"github.com/containerd/containerd/v2/core/images"
 	"github.com/containerd/log"
+	"github.com/containerd/platforms"
 
 	"github.com/containerd/nerdctl/v2/pkg/api/types"
 	"github.com/containerd/nerdctl/v2/pkg/containerdutil"
@@ -37,7 +38,7 @@ import (
 	"github.com/containerd/nerdctl/v2/pkg/referenceutil"
 )
 
-func EnsureAllContent(ctx context.Context, client *containerd.Client, srcName string, options types.GlobalCommandOptions) error {
+func EnsureAllContent(ctx context.Context, client *containerd.Client, srcName string, platMC platforms.MatchComparer, options types.GlobalCommandOptions) error {
 	// Get the image from the srcName
 	imageService := client.ImageService()
 	img, err := imageService.Get(ctx, srcName)
@@ -51,9 +52,11 @@ func EnsureAllContent(ctx context.Context, client *containerd.Client, srcName st
 	imagesList, _ := read(ctx, provider, snapshotter, img.Target)
 	// Iterate through the list
 	for _, i := range imagesList {
-		err = ensureOne(ctx, client, srcName, img.Target, i.platform, options)
-		if err != nil {
-			return err
+		if platMC.Match(i.platform) {
+			err = ensureOne(ctx, client, srcName, img.Target, i.platform, options)
+			if err != nil {
+				return err
+			}
 		}
 	}
 

pkg/cmd/image/push.go

@@ -67,7 +67,12 @@ func Push(ctx context.Context, client *containerd.Client, rawRef string, options
 
 		// Ensure all the layers are here: https://github.com/containerd/nerdctl/issues/3489
 		// XXX what if the image is a CID, or only otherwise available on ipfs?
-		err = EnsureAllContent(ctx, client, parsedReference.String(), options.GOptions)
+		platMC, err := platformutil.NewMatchComparer(options.AllPlatforms, options.Platforms)
+		if err != nil {
+			return err
+		}
+
+		err = EnsureAllContent(ctx, client, parsedReference.String(), platMC, options.GOptions)
 		if err != nil {
 			return err
 		}

pkg/cmd/image/save.go

@@ -50,7 +50,7 @@ func Save(ctx context.Context, client *containerd.Client, images []string, optio
 			}
 
 			// Ensure all the layers are here: https://github.com/containerd/nerdctl/issues/3425
-			err = EnsureAllContent(ctx, client, found.Image.Name, options.GOptions)
+			err = EnsureAllContent(ctx, client, found.Image.Name, platMC, options.GOptions)
 			if err != nil {
 				return err
 			}

pkg/cmd/image/tag.go

@@ -26,6 +26,7 @@ import (
 
 	"github.com/containerd/nerdctl/v2/pkg/api/types"
 	"github.com/containerd/nerdctl/v2/pkg/idutil/imagewalker"
+	"github.com/containerd/nerdctl/v2/pkg/platformutil"
 	"github.com/containerd/nerdctl/v2/pkg/referenceutil"
 )
 
@@ -61,7 +62,12 @@ func Tag(ctx context.Context, client *containerd.Client, options types.ImageTagO
 	defer done(ctx)
 
 	// Ensure all the layers are here: https://github.com/containerd/nerdctl/issues/3425
-	err = EnsureAllContent(ctx, client, srcName, options.GOptions)
+	platMC, err := platformutil.NewMatchComparer(true, nil)
+	if err != nil {
+		return err
+	}
+
+	err = EnsureAllContent(ctx, client, srcName, platMC, options.GOptions)
 	if err != nil {
 		log.G(ctx).Warn("Unable to fetch missing layers before committing. " +
 			"If you try to save or push this image, it might fail. See https://github.com/containerd/nerdctl/issues/3439.")

pkg/imgutil/commit/commit.go

@@ -128,7 +128,7 @@ func Commit(ctx context.Context, client *containerd.Client, container containerd
 	}
 
 	// Ensure all the layers are here: https://github.com/containerd/nerdctl/issues/3425
-	err = image.EnsureAllContent(ctx, client, baseImg.Name(), globalOptions)
+	err = image.EnsureAllContent(ctx, client, baseImg.Name(), platformMC, globalOptions)
 	if err != nil {
 		log.G(ctx).Warn("Unable to fetch missing layers before committing. " +
 			"If you try to save or push this image, it might fail. See https://github.com/containerd/nerdctl/issues/3439.")