计算 docker 镜像的 digest 值

1.拉取镜像 nginx:latest

nginx:latest 镜像的 sha256 值为 Digest: sha256:104c7c5c54f2685f0f46f3be607ce60da7085da3eaa5ad22d3d9f01594295e9c

root@Ubuntu:~# docker pull nginx
Using default tag: latest
latest: Pulling from library/nginx
52d2b7f179e3: Pull complete 
fd9f026c6310: Pull complete 
055fa98b4363: Pull complete 
96576293dd29: Pull complete 
a7c4092be904: Pull complete 
e3b6889c8954: Pull complete 
da761d9a302b: Pull complete 
Digest: sha256:104c7c5c54f2685f0f46f3be607ce60da7085da3eaa5ad22d3d9f01594295e9c
Status: Downloaded newer image for nginx:latest
docker.io/library/nginx:latest

digest 是 manifest 的 sha256 值，而 manifest 不在本地存储，所以我们可以通过 registry 的 api 去获取

2.新建本地 registry

root@Ubuntu:~# docker run -d -p 5000:5000 --name registry registry
Unable to find image 'registry:latest' locally
latest: Pulling from library/registry
7264a8db6415: Pull complete 
c4d48a809fc2: Pull complete 
88b450dec42e: Pull complete 
121f958bea53: Pull complete 
7417fa3c6d92: Pull complete 
Digest: sha256:e642e8604d305a3b82c8c1807b5df7a1a84cc650d57a60f9c5c2b78efec54b3f
Status: Downloaded newer image for registry:latest
fee4ee1fb68b52030053d646125f376948153646dfc7b39c7e3e492054911440

3.上传本地镜像到本地 registry

镜像重 tag

root@Ubuntu:~# docker tag nginx:latest 127.0.0.1:5000/nginx:latest
root@Ubuntu:~# docker images -a
REPOSITORY             TAG       IMAGE ID       CREATED       SIZE
127.0.0.1:5000/nginx   latest    eea7b3dcba7e   5 days ago    187MB
nginx                  latest    eea7b3dcba7e   5 days ago    187MB
registry               latest    0030ba3d620c   12 days ago   24.1MB

镜像上传到本地 registry ，此时的nginx镜像值为

root@Ubuntu:~# docker push 127.0.0.1:5000/nginx
Using default tag: latest
The push refers to repository [127.0.0.1:5000/nginx]
563c64030925: Pushed 
6fb960878295: Pushed 
e161c3f476b5: Pushed 
8a7e12012e6f: Pushed 
d0a62f56ef41: Pushed 
4713cb24eeff: Pushed 
511780f88f80: Pushed 
latest: digest: sha256:48a84a0728cab8ac558f48796f901f6d31d287101bc8b317683678125e0d2d35 size: 1778

4.获取本地 registry 中镜像的 manifest 文件

注意： manifest 文件必须是 v2 格式， v1 格式的 manifest 文件计算结果是错误的。

“application/vnd.docker.distribution.manifest.v2+json” 限制了新的图像清单格式 (schemaVersion = 2)

具体的文件类型见 https://docs.docker.com/registry/spec/manifest-v2-2/

具体的 registry api 见 https://docs.docker.com/registry/spec/api/#detail

root@Ubuntu:~# curl -H "Accept:application/vnd.docker.distribution.manifest.v2+json" 127.0.0.1:5000/v2/nginx/manifests/latest
{
   "schemaVersion": 2,
   "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
   "config": {
      "mediaType": "application/vnd.docker.container.image.v1+json",
      "size": 8146,
      "digest": "sha256:eea7b3dcba7ee47c0d16a60cc85d2b977d166be3960541991f3e6294d795ed24"
   },
   "layers": [
      {
         "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
         "size": 29124563,
         "digest": "sha256:52d2b7f179e32b4cbd579ee3c4958027988f9a8274850ab0c7c24661e3adaac5"
      },
      {
         "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
         "size": 41338560,
         "digest": "sha256:fd9f026c631046113bd492f69761c3ba6042c791c35a60e7c7f3b8f254592daa"
      },
      {
         "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
         "size": 628,
         "digest": "sha256:055fa98b43638b67d10c58d41094d99c8696cc34b7a960c7a0cc5d9d152d12b3"
      },
      {
         "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
         "size": 958,
         "digest": "sha256:96576293dd2954ff84251aa0455687c8643358ba1b190ea1818f56b41884bdbd"
      },
      {
         "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
         "size": 371,
         "digest": "sha256:a7c4092be9044bd4eef78f27c95785ef3a9f345d01fd4512bc94ddaaefc359f4"
      },
      {
         "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
         "size": 1214,
         "digest": "sha256:e3b6889c89547ec9ba653ab44ed32a99370940d51df956968c0d578dd61ab665"
      },
      {
         "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
         "size": 1405,
         "digest": "sha256:da761d9a302b21dc50767b67d46f737f5072fb4490c525b4a7ae6f18e1dbbf75"
      }
   ]
}

5.计算镜像的 digest 值

计算结果为 48a84a0728cab8ac558f48796f901f6d31d287101bc8b317683678125e0d2d35

与上文中上传镜像时 latest: digest: sha256:48a84a0728cab8ac558f48796f901f6d31d287101bc8b317683678125e0d2d35 结果一致

root@Ubuntu:~# curl -H "Accept:application/vnd.docker.distribution.manifest.v2+json" 127.0.0.1:5000/v2/nginx/manifests/latest |sha256sum 
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  1778  100  1778    0     0   173k      0 --:--:-- --:--:-- --:--:--  192k
48a84a0728cab8ac558f48796f901f6d31d287101bc8b317683678125e0d2d35  -