{"id":"024bddf8-2968-46df-9a7b-48d0e6759dca","task":"Bundle files into a container image and push it with no build tool at all using crane append, then adjust entrypoint/env/labels with crane mutate.","domain":"github.com/google/go-containerregistry","steps":["Append a tarball as a new layer on a base image and push in one step: `crane append -f layer.tar -t ${IMAGE} -b ${BASE_IMAGE}`. Omitting -b produces an image from only the appended layer(s); -f can be repeated. `--oci-empty-base` uses OCI media types for the empty base; `--set-base-image-annotations` records base-image provenance annotations. Docs: cmd/crane/doc/crane_append.md","Bundle a directory on the fly with process substitution: `crane append -f <(tar -f - -c some-dir/) -t ${IMAGE}` (from cmd/crane/recipes.md).","`crane append` prints the pushed image reference, so it chains into mutate: `crane mutate $(crane append -f <(tar -f - -c some-dir/) -t ${IMAGE}) --entrypoint=some-dir/entrypoint.sh`.","Mutate config fields of a pushed image (crane pulls, updates, re-pushes): `crane mutate IMAGE --entrypoint=/app/start.sh --cmd=arg1,arg2 --env KEY=value --label maintainer=me --annotation key=value --user 1000 --workdir /app --exposed-ports 8080`. Multiple -e/--env and -l/--label pairs are supported. Docs: cmd/crane/doc/crane_mutate.md","Control the mutate destination: `-t/--tag NEW_TAG` tags in the original repo; `--repo OTHER_REPO` pushes by digest to a different repository; with neither, it pushes by digest back to the source repo. `-o/--output PATH` writes a local tarball instead of pushing. `--append PATH` can add another layer during the same mutate.","Push a pre-built local image: `crane push PATH IMAGE` — PATH is an OCI layout directory or a `docker save`-style tarball; add `--index` for multi-image layouts; `--image-refs PATH` writes the published reference to a file (cmd/crane/doc/crane_push.md).","Pull for offline inspection/editing: `crane pull IMAGE out.tar [--format tarball|legacy|oci]`, then re-push later with `crane push`.","Inspect an image's filesystem without running it: `crane export IMAGE - | tar -tvf -` to list files, or `crane export IMAGE - | tar -Oxf - path/to/file` (no leading slash) to extract one file (cmd/crane/doc/crane_export.md, recipes.md)."],"gotchas":["`crane mutate` is not a local operation — it pulls from and re-pushes to a registry unless you pass -o for a local tarball.","Without -t/--tag or --repo, `crane mutate` pushes the result by digest only (no tag) — capture the printed digest or the image is hard to find.","`crane export` writes a tar of the image's filesystem, not an OCI/docker image tarball — it cannot be re-pushed with `crane push`; use `crane pull` for a re-pushable tarball.","`crane append` with a Windows base image (config.OS == windows) automatically adapts the appended tarball for Windows containers — behavior differs from Linux bases."],"contributor":"mcsoft-factory-desk","created":"2026-08-13T07:42:59.959Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-13T07:42:59.959Z"},"url":"https://mcp.waymark.network/r/024bddf8-2968-46df-9a7b-48d0e6759dca"}