fix containerd config generation

pkg/oci/containerd.go

@@ -10,6 +10,7 @@ import (
 	"os"
 	"path"
 	"path/filepath"
+	"reflect"
 	"strings"
 
 	"github.com/containerd/containerd"
@@ -314,6 +315,11 @@ type hostFile struct {
 	Server      string                `toml:"server"`
 }
 
+type hostFileOut struct {
+	HostConfigs any    `toml:"host"`
+	Server      string `toml:"server"`
+}
+
 type hostConfig struct {
 	CACert       interface{}            `toml:"ca"`
 	Client       interface{}            `toml:"client"`
@@ -350,15 +356,52 @@ func AddMirrorConfiguration(ctx context.Context, fs afero.Fs, configPath string,
 	if resolveTags {
 		capabilities = append(capabilities, "resolve")
 	}
+
+	hostConfigType := reflect.TypeFor[hostConfig]()
 	for _, registryURL := range registryURLs {
 		hf, appending, err := getHostFile(fs, configPath, appendToBackup, registryURL)
 		if err != nil {
 			return err
 		}
+
+		// We make a struct to represent the hosts which allow us to control the order of the hosts in the output toml table
+		// Hosts order is important as containerd will try them in the order of apparition
+		// The order with a map would be unspecified while the go-toml lib guarantees the same order as the struct fields
+		hostConfigStructFields := make([]reflect.StructField, 0, len(registryURLs)+len(hf.HostConfigs))
 		for _, u := range mirrorURLs {
-			hf.HostConfigs[u.String()] = hostConfig{Capabilities: capabilities}
+			hostConfigStructFields = append(hostConfigStructFields, reflect.StructField{
+				Name: fmt.Sprintf("F%d", len(hostConfigStructFields)),
+				Type: hostConfigType,
+				Tag:  reflect.StructTag(fmt.Sprintf("toml:\"%s\"", u.String())),
+			})
+		}
+		for u := range hf.HostConfigs {
+			hostConfigStructFields = append(hostConfigStructFields, reflect.StructField{
+				Name: fmt.Sprintf("F%d", len(hostConfigStructFields)),
+				Type: hostConfigType,
+				Tag:  reflect.StructTag(fmt.Sprintf("toml:\"%s\"", u)),
+			})
 		}
-		b, err := toml.Marshal(&hf)
+
+		hostsConfigs := reflect.New(reflect.StructOf(hostConfigStructFields))
+		i := 0
+		for range mirrorURLs {
+			f := hostsConfigs.Elem().Field(i)
+			f.Set(reflect.ValueOf(hostConfig{Capabilities: capabilities}))
+			i = i + 1
+		}
+		for _, c := range hf.HostConfigs {
+			f := hostsConfigs.Elem().Field(i)
+			f.Set(reflect.ValueOf(c))
+			i = i + 1
+		}
+
+		out := &hostFileOut{
+			Server: hf.Server,
+		}
+		reflect.ValueOf(&out.HostConfigs).Elem().Set(hostsConfigs)
+
+		b, err := toml.Marshal(out)
 		if err != nil {
 			return err
 		}