Fixing "Selected tag uses an invalid operating system " error when deploying to Azure Container Apps
Yesterday I tried deploying a Docker image to Azure Container Apps and hit a wall with a cryptic error about an invalid operating system. It took me a lot of time to find the root cause and fix it.Here's what happened, why it happens, and the exact command to fix it.
The error
After pushing an image to Azure Container Registry and pointing a Container App at it, the deployment failed with this message:
Selected tag uses an invalid operating system ''. Error when deploying an Azure Container App image.
The error is frustrating because it gave me almost nothing to work with; an empty string where the OS name should be. The image built and pushed just fine, so what's going on?
Root cause
The culprit is provenance attestation — a feature that Docker BuildKit enables by default when using docker buildx. When provenance is enabled, Docker generates an extra manifest layer containing build metadata. This results in a multi-platform image manifest (an OCI image index) rather than a plain single-platform manifest.
You can check the generated manifest using the following command:
docker manifest inspect <your-registry>/<your-image>
Here is the output for my docker image:
Azure Container Apps inspects the image manifest to determine the OS. When it encounters a manifest list that includes the provenance attestation layer, it finds an entry with an empty os field — and rejects the whole image.
The fix
I was able to fix it by using the following command when building my Docker image:
docker buildx build --platform linux/amd64 --provenance=false -t <your-registry>/<your-image> .
Two flags are doing the work here. Here's what each one does:
--platform linux/amd64
Pins the build to a single, explicit target platform. Azure Container Apps runs on Linux x86-64, so this ensures the image matches what's expected.
--provenance=false
Disables the provenance attestation that Docker BuildKit adds by default. Without this flag, an extra manifest entry with an empty OS field is included — which is exactly what Azure chokes on.
Summary
Docker's default provenance attestation creates a manifest entry with an empty OS field. Azure Container Apps can't handle it and rejects the image. Add --provenance=false to your docker buildx build command and the deployment will work.
Anyone who knows another/better way to handle this?