Publish operator images as Docker manifest lists for disconnected registry compatibility

[butler54]

Summary

The patterns-operator container images are published as OCI image indexes (application/vnd.oci.image.index.v1+json), while most Red Hat operator images use Docker manifest lists (application/vnd.docker.distribution.manifest.list.v2+json). This causes mirroring failures in disconnected environments where the target registry does not fully support OCI image indexes.

Problem

When mirroring the patterns-operator from the community-operator-index to a disconnected registry using oc-mirror --v2, the following error occurs:

error mirroring image docker://quay.io/validatedpatterns/patterns-operator@sha256:eeb82d8c...
error: Manifest list must be converted to type "application/vnd.docker.distribution.manifest.list.v2+json"
to be written to destination, but we cannot modify it: "Instructed to preserve digests"

oc-mirror v2 uses --preserve-digests by default. Because the source manifest is an OCI image index and the destination registry only accepts Docker manifest lists, the tool cannot convert without changing the digest — so it fails.

Affected images:

• quay.io/validatedpatterns/patterns-operator:0.0.78 — application/vnd.oci.image.index.v1+json
• quay.io/validatedpatterns/patterns-operator-console:0.0.74 — application/vnd.docker.distribution.manifest.list.v2+json (this one is fine)

Only patterns-operator uses OCI index format. The console plugin already uses Docker manifest list format and mirrors without issues.

Impact

In disconnected/airgap deployments:

• The operator cannot be installed via OLM because CRI-O pulls by the OCI index digest, which does not exist on the mirror
• Workarounds (manual deployment, digest remapping) add significant operational complexity
• All other Red Hat operators (gitops, sandboxed-containers, trustee, ACM, cert-manager, etc.) mirror successfully because they use Docker manifest list format

Suggested Fix

Publish patterns-operator images using Docker manifest list format (application/vnd.docker.distribution.manifest.list.v2+json) instead of OCI image index format. This matches what all other Red Hat operators do and maximises compatibility with:

• oc-mirror (both v1 and v2)
• Quay registries without FEATURE_GENERAL_OCI_SUPPORT enabled
• Other registry implementations with varying OCI support levels

Alternatively, ensure the build pipeline produces both formats so the registry can serve whichever the client requests.

Environment

• OCP: 4.21.24 (disconnected SNO)
• oc-mirror: v2 (4.21.0-202607031221)
• Mirror registry: Red Hat Quay
• patterns-operator: v0.0.78
• community-operator-index: v4.21

Workaround

Currently the only workarounds are:

1. Deploy the operator manually (Deployment + ServiceAccount + RBAC + webhook certs) using tag-based image refs instead of OLM
2. Ask the Quay admin to enable FEATURE_GENERAL_OCI_SUPPORT: true — but this is not always possible and should not be a prerequisite for a standard OLM operator install