Pulling an image with `application/octet-stream` config media type fails

related to: containerd/containerd#10628

Description

Pulling an image like python:3.5.1-alpine (from 2015) which has a config with media type application/octet-stream fails.

That's not an expected format from the perspective of OCI/Docker spec, and looks to be caused by a bug in distribution: distribution/distribution#1622

However, the graphdriver Docker is able to pull these images.
Also containerd has a "conversion" code that should be able to handle that image on the fly, but it looks like it's broken when used with WithPullUnpack (which we use

moby/daemon/containerd/image_pull.go

Line 164 in d8f079d

opts = append(opts, containerd.WithPullUnpack)

in order for remote snapshotters to work).

Manifest JSON

{
   "schemaVersion": 2,
   "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
   "config": {
      "mediaType": "application/octet-stream",
      "size": 4648,
      "digest": "sha256:1c7f1bf64dde149e36ffe0bcc0b9f1fbaeacc379dd80e4064c3a1e1f0b4b34b5"
   },
   "layers": [
      {
         "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
         "size": 2310286,
         "digest": "sha256:e110a4a1794126ef308a49f2d65785af2f25538f06700721aad8283b81fdfa58"
      },
      {
         "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
         "size": 20528388,
         "digest": "sha256:30dac23631f0219d44d2f43a5dbfb7ed47aa23e09abed01813510d0f64aa16af"
      },
      {
         "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
         "size": 258,
         "digest": "sha256:202fc3980a369fecd7f39c054b996e033347e441a500b9bb0dd03db6b9cc125c"
      }
   ]
}

Reproduce

$ docker pull python:3.5.1-alpine                                                                                                                                                                                                 
3.5.1-alpine: Pulling from library/python

What's next:
    View a summary of image vulnerabilities and recommendations → docker scout quickview python:3.5.1-alpine
failed to unpack image on snapshotter overlayfs: failed to extract layer sha256:4fe15f8d0ae69e169824f25f1d4da3015a48feeeeebb265cd2e328e15c6a869f: NotFound: failed to get reader from content store: content digest sha256:e110a4a1794126ef308a49f2d65785af2f25538f06700721aad8283b81fdfa58: not found

Expected behavior

No response

docker version

27.2.0

docker info

Additional Info

No response

Opened a tracking issue in the upstream: containerd/containerd#10628