pass --platform to docker save for kind helper images

Plain `docker save` of a multi-arch tag under Docker's containerd image
store exports an OCI index referencing every platform and, for indices
with several platforms (e.g. cert-manager-controller v1.20.2 has 5),
can omit the selected platform's config blob from the tar. This made
`ctr images import --platform=linux/amd64` fail in kind-up with:

  ctr: failed to resolve rootfs: content digest sha256:...: not found

Pass the same `--platform` to `docker save` (Docker 28+/API 1.48+) so
the archive is a self-contained single-platform OCI image.

Author: dmathur0

installer/src/nv_config_manager_installer/deployer.py

@@ -1350,11 +1350,18 @@ def _load_kind_helper_image(
         step: DeployStep,
     ) -> None:
         """Load a helper image into Kind node containerd for one platform."""
+        # Pass --platform to `docker save` so the OCI archive only contains the
+        # selected platform's index/manifest/config/layers. With Docker's
+        # containerd image store, a plain `docker save` of a multi-arch tag
+        # exports an index that still references the other platforms (and may
+        # even drop the selected platform's config blob), causing
+        # `ctr images import` to later fail with
+        # `failed to resolve rootfs: content digest ...: not found`.
         nodes = _kind_node_names(cluster)
         for node in nodes:
             self.callback.on_log(f"Loading helper image {image} into Kind node {node}...")
             _run_logged_pipe(
-                ["docker", "save", image],
+                ["docker", "save", "--platform", platform_name, image],
                 [
                     "docker",
                     "exec",

installer/tests/test_deployer.py

@@ -607,7 +607,7 @@ def fake_run_logged_pipe(source_cmd, sink_cmd, step, callback, **kwargs):
         ] in logged_commands
         assert ["kind", "get", "nodes", "--name", "test-cluster"] in run_commands
         assert (
-            ["docker", "save", LOADER_POD_IMAGE],
+            ["docker", "save", "--platform", "linux/amd64", LOADER_POD_IMAGE],
             [
                 "docker",
                 "exec",
@@ -677,7 +677,13 @@ def fake_run_logged_pipe(source_cmd, sink_cmd, step, callback, **kwargs):
             "docker.io/library/redis:7-alpine",
         ] in logged_commands
         assert (
-            ["docker", "save", "docker.io/library/redis:7-alpine"],
+            [
+                "docker",
+                "save",
+                "--platform",
+                "linux/amd64",
+                "docker.io/library/redis:7-alpine",
+            ],
             [
                 "docker",
                 "exec",