Question posted in
The official documentation can be found here.

Error in pulling a docker image based on its digest

I want to pull images from my private registry based on their sha256 digests but I get "manifest unknown" error.

The workflow is:
I get digest by running:
# docker manifest inspect MY_REPO/my-product/development/my_artifact:latest | grep digest | head -n1 | xargs
and the output is:
digest: sha256:e911cd696274444426a8da826da75710cf6909e87887b57f929b9fb8741ffa9a

But when I run pulling it by its digest, get "manifest unknown" error:

# docker pull MY_REPO/my-product/development/my_artifact:latest@sha256:e911cd696274444426a8da826da75710cf6909e87887b57f929b9fb8741ffa9a

Error response from daemon: manifest for MY_REPO/my-product/development/my_artifact@sha256:e911cd696274444426a8da826da75710cf6909e87887b57f929b9fb8741ffa9a not found: manifest unknown: manifest unknown

What is wrong?

Update:
We use nexus (community edition) as the container registry. It seems we have no problem by images are proxied but hosted images have that error.
So it may be the main question, if hosted docker registry by nexus supports digest based pulling?

Tags:

2

Answers


  1. 0

    Verify Digest-Tag Match:
    Ensure the digest matches the :latest tag. Run:

    bash
    Copy code
    docker manifest inspect MY_REPO/my-product/development/my_artifact:latest
    Pull by Digest Only:
    Try pulling without the :latest tag:

    bash
    Copy code
    docker pull MY_REPO/my-product/development/my_artifact@sha256:e911cd696274444426a8da826da75710cf6909e87887b57f929b9fb8741ffa9a
    Authenticate:
    Ensure you’re logged into the private registry:

    bash
    Copy code
    docker login MY_REPO
    Check Registry Support:
    Confirm your registry supports digest-based pulls or verify using the API.

    Clear Cache:
    Pull with –no-cache:

    bash
    Copy code
    docker pull –no-cache MY_REPO/my-product/development/my_artifact@sha256:e911cd696274444426a8da826da75710cf6909e87887b57f929b9fb8741ffa9a
    Inspect Permissions:
    Ensure you have access to the repository and digest.

    Login or Signup to reply.
  2. 0

    The digest you received from the command is most likely not the digest of a manifest, and therefore is not something you would pull with a docker pull command. In general, there are two types of manifests you’ll see on a registry, a manifest list and an image manifest. There are Docker and OCI variants of each, but the format is nearly identical between the two.

    When the docker manifest inspect command is run on a manifest list, you’ll receive a list of digests for each platform specific image manifest, and your command would return the first platform from the list. But if the command is run on an image manifest, the digest returned will be for the config blob of that image, and the config blob is not something you would pull with docker pull, causing the manifest unknown error.

    What you would be better off doing is using docker buildx imagetools inspect, e.g.:

    docker buildx imagetools inspect alpine --format '{{printf .Manifest.Digest.String}}'

docker buildx imagetools inspect alpine@sha256:029a752048e32e843bd6defe3841186fb8d19a28dae8ec287f433bb9d6d1ad85 --format '{{printf .Manifest.Digest.String}}'

    Both of these commands will return the digest of the manifest pulled, and not a child object of that manifest. For a more efficient command, there’s also:

    # crane is from Google's go-containerregistry project
crane digest $image

# regctl is from my own regclient project
regctl image digest $image

    The advantage of these two commands is they do not pull the manifest, which counts against rate limits on some registries.

    That said, the command you then attempt to run:

    docker pull MY_REPO/my-product/development/my_artifact:latest...

    appears to be trying to pull something that may not be an image. If the media types do not match those of a container image, and are instead an OCI artifact, the docker pull will fail since it is a container engine. Other tools like crane, oras, or regctl would be better for working with artifacts.

    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search