Docker compose pull fails with `failed to extract layer (application/vnd.oci.image.layer.v1.tar+zstd`

Creating a bug report/issue

I have searched the existing open and closed issues

DietPi version | cat /boot/dietpi/.version

G_DIETPI_VERSION_CORE=10
G_DIETPI_VERSION_SUB=4
G_DIETPI_VERSION_RC=2
G_GITBRANCH=‘master’
G_GITOWNER=‘MichaIng’

Distro version | echo $G_DISTRO_NAME $G_RASPBIAN
trixie 0

Kernel version | uname --all
Linux PetitPois 6.18.29+rpt-rpi-2712 #1 SMP PREEMPT Debian 1:6.18.29-1+rpt1 (2026-05-12) aarch64 GNU/Linux

Architecture | dpkg --print-architecture
arm64

SBC model | echo $G_HW_MODEL_NAME or (EG: RPi3)
RPi 5 Model B (aarch64)

Power supply used | (EG: 5V 1A RAVpower)
official Pi power supply for Pi-5

SD card used | (EG: SanDisk ultra)
m.2 NVMe SSD

Additional Information (if applicable)

Software title | (EG: Nextcloud)
Docker / homeassistant

Was the software title installed freshly or updated/migrated?
Docker was updated recently (with app update, I think)

Can this issue be replicated on a fresh installation of DietPi?
No, It worked fine with my other DietPi install

Bug report ID | echo $G_HW_UUID
c994216d-f169-4b5e-989e-b2c1b4a74761

Steps to reproduce

  1. run docker compose pull

Expected behaviour

  • expect pull to complete without errors

Actual behaviour

root@PetitPois:/mnt/dietpi_userdata# docker compose up -d uptime-kuma
[+] up 1/1
 ✔ Container uptime-kuma Started                                                                                          4.5s
root@PetitPois:/mnt/dietpi_userdata# docker compose pull
[+] pull 12/14
 ✔ Image eclipse-mosquitto                                                           Pulled                               1.3s
 ✔ Image koenkk/zigbee2mqtt                                                          Pulled                               1.5s
 ⠹ Image ghcr.io/home-assistant/home-assistant:stable [⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿] 500.2MB / 502.4MB Pulling                             96.2s
 ✔ Image louislam/uptime-kuma:2                                                      Pulled                               1.4s
failed to extract layer (application/vnd.oci.image.layer.v1.tar+zstd sha256:4c46ee32c2704a325cc86f1207455c8afd46714e94d146a8020d11df0585ea79) to overlayfs as "extract-471586625-kycr sha256:14000ee96b40b98022e1c627545f7f254775d3a9707cdd4c22e53aec5c9ad9c3": corruption detected: stream overrun 4
root@PetitPois:/mnt/dietpi_userdata# apt-get upgrade
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
Calculating upgrade... Done
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
root@PetitPois:/mnt/dietpi_userdata# dietpi-update

Extra details

  • I’m trying to update Homeassistant Container from 20206.5.3 to 2026.5.4.
  • I’m not sure this is a DietPi issue but hoping someone might know what’s happening.

I doubt this is a DietPi issue. Looks like corruption of the docker image or download issue or a full file system

Thanks

edit: a restart fixed it.


edit: …then it happened again and this time a restart did not fix.

However, for anyone with the same issue, this is the solution:

The solution is to disable parallel decompression for docker images on the host. Here’s how you can do it:

  1. Open the Docker systemd unit file /lib/systemd/system/docker.service using a text editor with root permissions:

sudo nano /lib/systemd/system/docker.service

  1. Add the following line under the [Service] section:

Environment=MOBY_DISABLE_PIGZ=1

  1. Save the file and reload the systemd configuration:

sudo systemctl daemon-reload

  1. Restart the Docker daemon for the changes to take effect:

sudo systemctl restart docker

After restarting the Docker daemon, parallel decompression should be disabled for Docker images on the host.

Note that this method modifies the Docker service directly, so any changes made to the systemd unit file will persist across system reboots.

Also, the downside to this workaround is that it’ll take longer for you to pull images.

This has also stopped working for me now.

…posting incase someone comes across this when searching for the same issue.

This seems to have been moved to containerd: containerd/archive/compression/compression.go at docker/20.10 · moby/containerd · GitHub

Hence CONTAINERD_DISABLE_PIGZ=1 would now be needed in the containerd.service, it seems. But always apply such with an override config, else it is lost with every package upgrade:

sudo mkdir /etc/systemd/system/containerd.service.d
echo -e '[Service]\nEnvironment=CONTAINERD_DISABLE_PIGZ=1' | sudo tee /etc/systemd/system/containerd.service.d/disable-pigz.conf
sudo systemctl daemon-reload
sudo systemctl restart containerd

However, pigz (and unpigz) is only used if installed. Hence apt autopurge pigz would do as well, if nothing else explicitly depends on it.

If parallel decompression causes an issue, probably memory usage is the issue? You could monitor it on a separate SSH session via htop -d 2 or so, while pulling an image with pigz installed and used by Docker. If decompression fails due to insufficient memory, the swapfile size could be raised, e.g.

/boot/dietpi/func/dietpi-set_swapfile 4096

for 4 GiB additional memory. Can be narrowed down, of course. But I wouldn’t recommend using a swap file only to save some seconds of decompression time, when pulling/updating a Docker image. So purging pigz or using CONTAINERD_DISABLE_PIGZ=1 seems to be the right way to go then.

Thank you so much @MichaIng for working this out and sharing - I would never have been able to do that myself - especially as I recognise it is not a DietPi related issue.


Update: Unfortunately that didn’t work; I tried twice and got two different error (below).

I used `htop` and found that memory used was never exceeded 1.5Gb (of 3.95gB available) and was typically around 1.25Gb.

This is what I got in my terminal:

root@PetitPois:/mnt/dietpi_userdata# docker compose pull homeassistant
[+] pull 20/22
 ⠼ Image ghcr.io/home-assistant/home-a... [⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿] Pulling 111.4s
failed to extract layer (application/vnd.oci.image.layer.v1.tar+zstd sha256:7073e8e8aea79ec107111aaf19805fa979f60e2a902f3687923f23ffe8f6896a) to overlayfs as "extract-175992725-8JHq sha256:1b8f59e1cb560764e7141e24687d424861cc30b0f765e1d576c87dfa6331229b": output bigger than max block size (131072)

root@PetitPois:/mnt/dietpi_userdata# !!
docker compose pull homeassistant
[+] pull 20/22
 ⠇ Image ghcr.io/home-assistant/home-assistant:stable [⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿] 599.9MB / 604.1MB Pulling                     113.8s
failed to extract layer (application/vnd.oci.image.layer.v1.tar+zstd sha256:7073e8e8aea79ec107111aaf19805fa979f60e2a902f3687923f23ffe8f6896a) to overlayfs as "extract-945442644--QVZ sha256:1b8f59e1cb560764e7141e24687d424861cc30b0f765e1d576c87dfa6331229b": corruption detected: stream overrun 4
root@PetitPois:/mnt/dietpi_userdata# 

Any ideas?

Hmm, this error seems to come from zstd executable or library itself, not from Docker/containerd: internal/zstd: Bugs and crashes · Issue #63824 · golang/go · GitHub

So it pumps more output at once than the buffer can hold? Weird. My browser plugin also fails to download the tarball for the home-assistant container image, from Docker Hub, as well as from Package home-assistant · GitHub. The Uptime Kuma container e.g. however works, as well as linuxserver/homeassistant - Docker Image. So maybe there is something different with the original Home Assistant container.

Are other containers affected for you as well? Maybe something to report to Issues · moby/moby · GitHub, to at least get a hint about how this could fail, or how to debug.

Hi, my other images (mosquito, Zigbee2MQTT, uptime kuma etc) all pull and extract just fine.

the confusing thing to me is I have 2 identical setups (2 locations) and the other one works just fine.

Done!

Identical means identical hardware and identical DietPi/Debian version at least? Otherwise it may be possible to pin-point the relevant difference.

So in any case, the HA container seems to have a relevant difference. As said, it is also the only one which returns an unknown media type error in my browser plugin:

I do not see gzip vs zstd in the content-type header of the involved network requests, so I think it is the compression type of the layer in metadata. And indeed the container images I just test-downloaded contain gzip-compressed layers within the wrapping plain .tar. Might it be the simple dumb fact that no zstd decompressor is installed which tar can use internally? The expectations and error thrown by Docker/containerd would be off then, but wouldn’t be the first time that Docker went through a change which caused havoc among the user base.

Simple test:

sudo apt install zstd

Yes, both identical (to my knowledge) hardware and DietPi version.

Thanks - have installed on both machines. I’ll try this when 2026.8.0 is out and will report back.