When trying to use a WasmPlugin with a image that's made up of more than one layer - in other words: Image not built FROM SCRATCH, the plugin is not applied and the following log is seen in the proxy container:

error	wasm	cannot fetch Wasm module oci://quay.io/jwendell/header-append-filter:2.3: could not fetch Wasm binary: could not extract Wasm file from the image as Docker container number of layers must be 1 but got 2

This was recently fixed in upstream: https://github.com/istio/istio/pull/40647. It will likely be present in 1.16 which will likely be part of OSSM 2.4.

If this is critical we could backport that commit into 2.3.

The workaround is to make use of a multi-stage container build, where the last stage is just an image `FROM scratch` + the plugin file.