Add support for zstd-compressed layer media types in container images

[Copilot]

Plan: Add zstd-compressed layer mediaType support

• Update SchemaTypes.cs to add constants for zstd media types
• Update ContentStore.cs to accept zstd media types in PathForDescriptor
• Add logging when zstd layers are encountered (trace/debug level)
• Add end-to-end test using Docker hardened image with zstd layers
• Build and test the changes
• Run code review and address feedback
• Run security scan (codeql)
• Unskip test so it runs in CI pipelines

Summary

This PR adds support for zstd-compressed layers in container images. The SDK now recognizes and handles application/vnd.oci.image.layer.v1.tar+zstd and application/vnd.docker.image.rootfs.diff.tar.zstd media types when reading/downloading container image layers from base images.

Key Changes

1. SchemaTypes.cs: Added constants for Docker and OCI zstd media types
2. ContentStore.cs: Updated to accept zstd-compressed layer media types and map them to .tar.zst extension
3. Registry.cs: Added trace-level logging when zstd layers are encountered during download
4. EndToEndTests.cs: Added end-to-end test using Docker hardened image (dhi.io/dotnet:8-alpine3.22) that contains zstd-compressed layers

Implementation Details

• The SDK does not decompress or compress zstd blobs—they are downloaded and passed through unmodified
• Output images will continue to use gzip compression for newly created layers
• zstd layers are logged at trace level to help with debugging
• Uses constants from SchemaTypes to maintain consistency and avoid typos

Testing

• Added test that pulls a base image with zstd layers, adds a custom layer, and runs the resulting image
• Test is now enabled to run in CI pipelines
• Test includes TODO comment noting that the base image should be mirrored to test ACR in the future for deterministic runs
• All existing tests pass with no breaking changes

Original prompt

Add support for OCI and Docker zstd-compressed layer mediaTypes (e.g., application/vnd.oci.image.layer.v1.tar+zstd and application/vnd.docker.image.rootfs.diff.tar.zstd) when reading/downloading container image layers. The SDK should recognize these as valid when reading a base image, even though output images will still use gzip compression. Do not attempt to decompress or compress zstd blobs—just download and include them if present in a base image manifest.

Update any strict content/mediaType validation (e.g., switches/throws) so these mediatypes are accepted during image pull, copying, and test. Emit a warning/note if running in verbose/debug mode about zstd layers being passed through unmodified.

To validate, add a new end-to-end test that uses a current Docker hardened image (e.g., dhi.io/dotnet:8-alpine3.22) as a base image, publishes a test app, and runs it. Add a code comment in the test pointing out that in the future, this image should be mirrored to the test ACR and the manifest updated to use the ACR ref for deterministic test runs.

This pull request was created from Copilot chat.

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[baronfel]

@copilot test/Microsoft.NET.Build.Containers.IntegrationTests/EndToEndTests.cs:1554 for now, this test should not be skipped - otherwise we can't see it run in the CI pipelines. Unskip it.

[Copilot]

@copilot test/Microsoft.NET.Build.Containers.IntegrationTests/EndToEndTests.cs:1554 for now, this test should not be skipped - otherwise we can't see it run in the CI pipelines. Unskip it.

Done. Removed the Skip attribute in commit 303a982.