I want to build a very simple system (thinking some lines of Python) that converts a given docker tag (e.g. ubuntu:latest) to the SHA256 digest of the image that tag is currently pointing to.
I'm aware that if we have Docker installed, we can simply pull and then list out the digest of the pulled image. I was thinking whether this can be achieved without actually pulling the image.
The docker client does not (appear to) surface this functionality so you'll need to use a Registry client SDK. I am using Golang and have been unable to find an SDK that's easy-to-use and works across registries (I'm interested in using Google Container Registry in addition to Docker Hub). You may be more successful with Python.
I've been working on a project with container image manifests and wrote a Medium post about how to enumerate manifests and manifest digests. I hope it's useful to you:
https://medium.com/google-cloud/adventures-w-docker-manifests-78f255d662ff
NB There are some inconsistencies with Docker Hub's implementation of the Docker Registry HTTP v2 API. FWIW, Google Container Registry (GCR) accurately implements the Registry API. I work for Google albeit not in the GCR team.
You can use crane to get the image manifest, then use skopeo to compute the digest.
$ crane manifest ubuntu:18.04 | skopeo manifest-digest /dev/stdin
sha256:86510528ab9cd7b64209cbbe6946e094a6d10c6db21def64a93ebdd20011de1d
Alternatively you can get the same digest from the output of skopeo inspect
$ skopeo inspect docker://ubuntu:18.04 | jq -r .Digest
sha256:86510528ab9cd7b64209cbbe6946e094a6d10c6db21def64a93ebdd20011de1d
Or if you'd like to do it by hand without any of those tools mentioned above, try this:
$ curl -s -L \
-H "Accept: application/vnd.docker.distribution.manifest.v2+json,application/vnd.docker.distribution.manifest.list.v2+json" \
-H "Authorization: Bearer $(curl -s "https://auth.docker.io/token?service=registry.docker.io&scope=repository:library/ubuntu:pull" | jq -r .token)" \
https://index.docker.io/v2/library/ubuntu/manifests/18.04 | sha256sum
86510528ab9cd7b64209cbbe6946e094a6d10c6db21def64a93ebdd20011de1d -
In fact, a HEAD request is enough to obtain the manifest hash
$ curl -s -L -I \
-H "Accept: application/vnd.docker.distribution.manifest.v2+json,application/vnd.docker.distribution.manifest.list.v2+json" \
-H "Authorization: Bearer $(curl -s "https://auth.docker.io/token?service=registry.docker.io&scope=repository:library/ubuntu:pull" | jq -r .token)" \
https://index.docker.io/v2/library/ubuntu/manifests/18.04 | grep ^Docker-Content-Digest | awk '{print $2}'
sha256:86510528ab9cd7b64209cbbe6946e094a6d10c6db21def64a93ebdd20011de1d