Multi-Arch Support

info

The English user guide is currently in beta preview. Most of the documents have been automatically translated from the Japanese version. Should you find any inaccuracies, please reach out to Flatt Security.

Each Takumi image supports both amd64 and arm64. When you pull a single tag such as :latest, the image for the runtime environment's architecture is selected automatically. This works because both architecture-specific builds are published together as a multi-arch OCI index.

Relationship between index and manifest

A multi-arch OCI index is a higher-level reference that points to manifests for multiple architectures. Users normally specify a single tag such as images.flatt.tech/takumi/<image>:latest, and the container runtime selects the manifest matching the environment.

You can confirm both the index and supported architectures by inspecting the tag manifest.

$ crane manifest images.flatt.tech/takumi/busybox:latest \
    | jq '{mediaType, platforms: [.manifests[].platform]}'
{
  "mediaType": "application/vnd.oci.image.index.v1+json",
  "platforms": [
    {
      "architecture": "amd64",
      "os": "linux"
    },
    {
      "architecture": "arm64",
      "os": "linux"
    }
  ]
}

The mediaType shows that this is an OCI image index, and the child manifests are for amd64 and arm64.

Digest pinning

To keep automatic amd64/arm64 selection while pinning, use the digest of the multi-arch index. If you want to pin a specific architecture only, use the child manifest digest for that architecture.

For most deployments, pinning the index digest is easier because the same image reference can be used on both amd64 and arm64. See the digest section in the Quickstart for concrete steps.

Relationship with attestations

SBOM and SLSA Provenance contents differ by architecture, so they are attached to each architecture-specific child manifest rather than directly to the index. VEX records triage decisions for the image as a whole, so it is generally attached to the multi-arch index.

See Attestation and SBOM for retrieval steps and contents.