13

According to https://docs.docker.com/registry/spec/api/ I can call /v2/<name>/tags/list to get a list of the tags for a given image. It works fine, e.g.:

{"name"=>"avi/test", "tags"=>["latest"]}

However, I would like the digest for each tag. Yes, the "digest" is actually the hash of the manifest (at least as I best understood it from the API; not 100% clear). However, I would like a way of knowing what a unique identifier for "latest" (and every other tag) is.

Use case: I might have someone tag a version as latest, and want to check the tit is up to date:

docker push avi/test:2.6
docker tag avi/test:2.6 avi/test:latest
docker push avi/test:latest
# build 2.7
docker push avi/test:2.7
# oops! Forgot to tag latest to 2.7

In the above case, if I can check not just the tags - which will give me "2.6", "2.7", "latest" - but also the digest (at least of the manifest), I can find what various tags point to, audit, etc.

deitch
  • 14,019
  • 14
  • 68
  • 96

1 Answers1

18

AFAIK, there isn't a digest API. However, according to the v2 API spec you can do a HEAD or GET request against /v2/<name>/manifests/<reference>. The response will include a Docker-Content-Digest header containing the digest of the specified manifest (e.g. latest).

Ryan Wentzel
  • 196
  • 1
  • 3
  • 1
    Ohhh, I missed that in the spec. So if I do `HEAD /v2/avi/test/manifests/latest` or `HEAD /v2/avi/test/manifests/2.7` then the header for `Docker-Content-Digest` should be unique that I can compare versions? – deitch Feb 16 '16 at 07:14
  • 1
    Yes, the `Docker-Content-Digest` header should give you what you need. – Ryan Wentzel Feb 17 '16 at 16:25
  • Thanks, Ryan, much appreciated. I have a simple registry:2 Ruby gem that does a search, gets tags, and now will be able to get hashes to compare. Perfect. https://github.com/deitch/docker_registry2 – deitch Feb 17 '16 at 16:56
  • 1
    when I'm using HEAD https://registry.hub.docker.com/v2/alpine/manifests/latest I'm getting 404, any idea? – soninob Jul 21 '16 at 12:27
  • 3
    I'm able to get a `Docker-Content-Digest` from this endpoint, but it's not the digest of the image, so I think this answer no longer applies. I've posted a follow-up question http://stackoverflow.com/q/39375421/1220269 – Nathaniel Waisbrot Sep 07 '16 at 16:56
  • 11
    The question @NathanielWaisbrot linked gives the correct answer. The short version is add an `Accept: application/vnd.docker.distribution.manifest.v2+json` header to the request and then `Docker-Content-Digest` is the correct digest. – mcrute Mar 26 '18 at 02:52