TL;DR : When a Docker daemon uses the graphdriver image store (overlay2: every Docker 28, and Docker 29 installs that were upgraded from 28 or have "containerd-snapshotter": false ), docker push of an image it pulled with zstd-compressed layers writes a manifest that labels those layers application/vnd.docker.image.rootfs.diff.tar.gzip . The blobs are reused as they are, so they're still zstd. The push succeeds, the registry accepts it, and docker run of the image works, because Docker detects the compression from the data. Tools that trust the label don't: a BuildKit build FROM the relabelled image with compression=zstd,force-compression=true failed with failed to get compression blob "zstd": not found , and without force-compression it succeeded and copied the gzip label into the new image. Reproduced on Docker 29.9.1 and 29.9.2; the containerd image store labels the same layers correctly.…