具有 2 个不同 SHA256 摘要的 Docker 镜像

Question

inspect 显示 Docker 镜像的两个 RepoDigests 值是什么意思？

例子:

$ docker inspect aquasec/trivy:latest
[
    {
        "Id": "sha256:33106c9ec694a2e9057fb80a5451f4648ed67d6159cc034fa6340f4cfbe2b98a",
        "RepoTags": [
            "aquasec/trivy:latest"
        ],
        "RepoDigests": [
            "aquasec/trivy@sha256:76d47e5917c583fcad5ab4f83a23cb5e534c34649a994c73722fe6dfd86f2855",
            "aquasec/trivy@sha256:c0d08ac683a0e36ac71555314140718cd8d224efb70a5ebe388ad5879be56445"
        ],
...
]

当我转到 Docker Hub 时, 仅显示 c0d08ac683a0。

Answer 1

aquasec/trivy 作为多平台图像分发。您列表中的第一个来自 list 列表本身，第二个摘要针对您的特定平台:

$ regctl manifest get --list aquasec/trivy
Name:        aquasec/trivy
MediaType:   application/vnd.docker.distribution.manifest.list.v2+json
Digest:      sha256:76d47e5917c583fcad5ab4f83a23cb5e534c34649a994c73722fe6dfd86f2855
             
Manifests:   
             
  Name:      docker.io/aquasec/trivy@sha256:c0d08ac683a0e36ac71555314140718cd8d224efb70a5ebe388ad5879be56445
  MediaType: application/vnd.docker.distribution.manifest.v2+json
  Platform:  linux/amd64
             
  Name:      docker.io/aquasec/trivy@sha256:5d0d4ce0af0888f77b9831172f0ec6a6f8e6b087496a5d2677426e0492224302
  MediaType: application/vnd.docker.distribution.manifest.v2+json
  Platform:  linux/arm64

list 列表是一组指向每个平台 list 的指针(并且它有自己的摘要):

{
  "schemaVersion": 2,
  "mediaType": "application/vnd.docker.distribution.manifest.list.v2+json",
  "manifests": [
    {
      "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
      "size": 1159,
      "digest": "sha256:c0d08ac683a0e36ac71555314140718cd8d224efb70a5ebe388ad5879be56445",
      "platform": {
        "architecture": "amd64",
        "os": "linux"
      }
    },
    {
      "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
      "size": 1159,
      "digest": "sha256:5d0d4ce0af0888f77b9831172f0ec6a6f8e6b087496a5d2677426e0492224302",
      "platform": {
        "architecture": "arm64",
        "os": "linux"
      }
    }
  ]
}

然后您平台的 docker list 包括对配置和图层 blob 的引用:

{
  "schemaVersion": 2,
  "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
  "config": {
    "mediaType": "application/vnd.docker.container.image.v1+json",
    "size": 1820,
    "digest": "sha256:33106c9ec694a2e9057fb80a5451f4648ed67d6159cc034fa6340f4cfbe2b98a"
  },
  "layers": [
    {
      "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
      "size": 2814446,
      "digest": "sha256:a0d0a0d46f8b52473982a3c466318f479767577551a53ffc9074c9fa7035982e"
    },
    {
      "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
      "size": 6900624,
      "digest": "sha256:0df7abe0cb9353fe074cad7942ce432f7a95cc1e80a4e4f15e326f4c79af7364"
    },
    {
      "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
      "size": 13101667,
      "digest": "sha256:49b8248ae36d0bf5eefe15d56704da18a3239db65bb82d5e73426dafbc16e7df"
    },
    {
      "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
      "size": 4268,
      "digest": "sha256:33a14db32fe04bfed4ebca691c13c0947b2bbceb9ae68c5118435b9dbaf4dfcd"
    }
  ]
}