Registries & Distribution

docker buildx imagetools inspect <ref> --format '{{ json .Provenance }}' and the same with .SBOM decode the attestation payloads straight from the registry. --raw prints the underlying index JSON. No local pull is needed.

It turns on Docker Content Trust: pushes get signed via a Notary server and pulls or FROM references refuse unsigned or unverified tags. It uses TUF roles — an offline root key, a per-repository targets key, plus server-held snapshot and timestamp keys. Teams moved on because it is tag-scoped, Docker-client-only and painful to operate.

A commit SHA ties the image to the source that produced it, needs no shared counter, and stays unique across branches and parallel builds. Its weakness is that SHAs carry no order, so many teams combine a build number with the SHA.

They make image layers seekable, so a container starts before its image has finished transferring and file content is fetched on demand. Both need a containerd snapshotter on the node, and they trade a faster start for a live registry dependency while running.

Get a bearer token, then GET /v2/<repo>/manifests/<tag> with an Accept header listing acceptable manifest media types — the response body plus the Docker-Content-Digest header give you the manifest and digest. HEAD /v2/<repo>/blobs/<digest> reports whether a blob exists.

The tag points at an image index (manifest list) — a small document listing one manifest digest per platform. Pin the index digest: it stays immutable while still resolving per architecture. A per-platform manifest digest also works but hard-codes one CPU architecture.

Run an internal registry as the single source of truth. On a connected staging host, copy an explicit, digest-pinned allowlist of images with a tool like skopeo or crane, transfer them across the boundary (registry-to-registry sync or tarball), and re-tag them into the internal registry. Rewrite all references internally; schedule refreshes.