Description

When pulling a manifest containing multiple builds on Windows Server 2025 containerd does not necessary pull the correct image version.

Name:        docker-image/test:test
MediaType:   application/vnd.docker.distribution.manifest.list.v2+json
Digest:      sha256:<digest>

Manifests:

  Name:      docker-image/test:test@sha256:<digest-linux>
  Digest:    sha256:<digest-linux>
  MediaType: application/vnd.docker.distribution.manifest.v2+json
  Platform:  linux/amd64

  Name:      docker-image/test:test@sha256:<digest-ws2022>
  Digest:    sha256:<digest-ws2022>
  MediaType: application/vnd.docker.distribution.manifest.v2+json
  Platform:  windows/amd64/10.0.20348.3091
  OSVersion: 10.0.20348.3091

  Name:      docker-image/test:test@sha256:<digest-ws2025>
  Digest:    sha256:<digest-ws2025>
  MediaType: application/vnd.docker.distribution.manifest.v2+json
  Platform:  windows/amd64/10.0.26100.2894
  OSVersion: 10.0.26100.2894

in this case the windows server 2025 has pulled the image for windows server 2022 (10.0.20348.3091) instead of the fully matching 2025 version (10.0.26100.2894).

Steps to reproduce the issue

1. create a manifest with multiple windows version (ws2022/ws2025)
2. crictl.exe pull
3. check the image digest with ctr.exe

Describe the results you received and expected

Expected would be the best matching OS-Version container. In this specific case the image with should have been fetched

What version of containerd are you using?

containerd 2.0.2 on windows server 2025 (10.0.26100.2894)

Any other relevant information

No response

Show configuration if it is related to CRI plugin.

No response