How can I verify a docker image hash?

user_180416 0
Viewed 2498

I'm trying to reproduce the hash produced by docker images --digests myself.

I've tried running docker save -o image.tar <image> extracting it and running cat metadata.json | shasum -a 256 (and a few variants, like piping through jq or trimming it) but haven't been able to match the hash that docker gives me.

Should what I'm trying work, or is there another mechanism I can use?

docker hash
1 Answers

From this post it is clear that

A Docker image's ID is a digest, which contains an SHA256 hash of the image's JSON configuration object

You were right to try to shasum a JSON config of the saved image, but you used the wrong configuration file.

$ docker image save da86e6ba6ca1 -o img.tar # note the hash
$ tar -xvf img.tar
$ ls
4ab1c614436ccb31a69026cb4e8404a8c8a6503acb3596f9c23283c6cec42321
da86e6ba6ca197bf6bc5e9d900febd906b133eaa4750e6bed647b0fbe50ed43e.json
img.tar
manifest.json

$ cat manifest.json| shasum -a 256
f5ac61be9063b8cc34260a4f18693d3eafcc51af43c98853937dead3b8f0952d  - # wrong hash

$ cat da86e6ba6ca197bf6bc5e9d900febd906b133eaa4750e6bed647b0fbe50ed43e.json| shasum -a 256
da86e6ba6ca197bf6bc5e9d900febd906b133eaa4750e6bed647b0fbe50ed43e  - # correct

So, to calculate the hash yourself, you need to use JSON file with image's hash as its name, and not the manifest.

user_43784000
Related