How to find a container image tag/label from its hash

user_3375141 0
Viewed 58

I have a use case I need to find the image tag from its hashed format.

for example, if I have this image

quay.io/containerdisks/centos-stream@sha256:0c8d8b253a0b729c602efe45a5bc4640b3d4161b6924db3def2e7a76296e42c9

I would like to find one or more labels that point to this image. At the moment the only option I know of is to "brute-force" it by fetching all the labels related to this image and checking the digest of each against the hash I'm looking for.

Is there another option?

skopeo podman docker-registry docker
2 Answers

Another iteration on @BMitch answer is to use the parallel to make several queries in parallel, which reduces the time to query all the tags.

skopeo list-tags docker://quay.io/containerdisks/centos-stream \
 | jq -r '.Tags[]' \
 | parallel bash -c "\"printf \"%-16s\" {} '-> ' && skopeo inspect -n docker://quay.io/containerdisks/centos-stream:{} --format '{{ .Digest }}'\"" \
 | grep 'sha256:0c8'
user_33751410

The tag listing only includes tags, not the digests for each of those tags (though I'd like to see that improved). So you're left with brute forcing a digest check against each tag. With regctl that looks like:

for tag in $(regctl tag ls quay.io/containerdisks/centos-stream); do
  echo "${tag}: $(regctl image digest quay.io/containerdisks/centos-stream:${tag})"
done | grep "sha256:0c8"

Which lists the following matches:

9: sha256:0c8d8b253a0b729c602efe45a5bc4640b3d4161b6924db3def2e7a76296e42c9
9-20220829.0: sha256:0c8d8b253a0b729c602efe45a5bc4640b3d4161b6924db3def2e7a76296e42c9
9-2209010207: sha256:0c8d8b253a0b729c602efe45a5bc4640b3d4161b6924db3def2e7a76296e42c9

Note that the image digest command here only runs a HEAD request to the registry, so it doesn't download the image and should be relatively fast.

user_5962850
Related