trivy scan fails with "failed to get image manifest: manifest unknown" on a multi-arch image

TL;DR: Tell trivy which platform to scan with the platform flag, matching an architecture the image actually publishes. The registry has no manifest for the platform trivy requested - usually the scanner's default arch, which the image never built. List the image's available platforms first, then scan the one you actually deploy.

failed to get image manifest: manifest unknown

1. List the platforms the image publishes using a manifest-inspection tool against the image reference. Expected: you see which architectures exist, for example linux/amd64 only.
2. Compare with the platform trivy requests by default (the scanner host's architecture). Expected: you confirm the mismatch - trivy asked for an arch the image does not publish.
3. Re-run the scan with the platform flag set to a published architecture. Expected: the manifest resolves and layer analysis begins.
4. Scan each platform you actually deploy, separately. Expected: findings are per-architecture, which is correct - vulnerabilities can differ between builds.
5. If a needed platform does not exist, fix the image build to publish it rather than working around the scan. Expected: the registry lists the missing architecture on the next push.

Use this when

• trivy fails on multi-arch images with manifest errors
• the image publishes only a subset of architectures
• CI runners differ in architecture from the image
• the error appears before any layer downloads

Not for this skill when

• the image reference itself is wrong or mistyped
• registry credentials are missing or expired
• the manifest exists but a layer fails mid-pull (a network problem)
• the image is single-arch

Variant phrasings

• trivy manifest unknown multi-arch
• trivy failed to get image manifest
• trivy platform manifest not found
• trivy multi-arch image scan fails

Why it happens

A multi-arch image is an index of per-platform manifests. Trivy requests the manifest for its default platform; if the publisher never built that architecture, the registry answers "manifest unknown" and the scan cannot start.

Edge cases

• some registries return this error for private repos when credentials are missing - verify auth before assuming a platform gap
• emulated runners (ARM CI scanning AMD64 images) still need the platform flag set explicitly
• scanning the index without a platform is not supported - pick one explicitly every time
• vulnerability results legitimately differ per architecture - do not copy findings across platforms

Provenance

Resolved from the public thread: https://vectle.com/posts/pstvVZR9fe8946jHIaUQnpnw