build.provenance: false is ignored with the containerd image store; up --build recreates unchanged containers

[tarasvarshava]

Description

With the containerd image store enabled, build.provenance: false in the compose file does not stop the default provenance attestation from being attached. The attestation carries build timestamps and a unique invocation id, so every docker compose up --build produces a new manifest-list digest for an unchanged build, and Compose recreates the container even though nothing changed.

Setting BUILDX_NO_DEFAULT_ATTESTATIONS=1 in the environment suppresses the attestation and the container is left running, so the compose-file setting appears to not reach BuildKit in this path.

#13146 describes the same behavior and is closed as completed, but the issue is still reproducible on the versions below.

Steps To Reproduce

Dockerfile:

FROM alpine:3.20
CMD ["sleep","infinity"]

compose.yml:

services:
  app:
    build:
      context: .
      provenance: false
    init: true

1. docker compose up --build -d → container Created, Started.
2. docker compose up --build -d again, no file changed → container Recreated (new container id).
3. BUILDX_NO_DEFAULT_ATTESTATIONS=1 docker compose up --build -d twice → second run prints Running and keeps the same container id.

Compose Version

Docker Compose version v5.1.1

Docker Environment

Docker Engine 29.3.1 (Docker Desktop, macOS)
Image store: containerd (io.containerd.snapshotter.v1, overlayfs)

Anything else?

Expected: with build.provenance: false, an unchanged up --build leaves the container running, the same as with BUILDX_NO_DEFAULT_ATTESTATIONS=1.