[go/docker/podman]：获取容器镜像信息而不下载整个镜像

Question

I am currently developing a small program that uses constraints to check container image labels . The whole thing should run automatically in the CI.

I am currently using docker to get the labels of the images. However, I always have to download the container image. Now I wonder if there is a way to get the meta information without downloading the image with docker or alternatively podman.

If yes, I would be glad to get some sample code.

Answer 1

There are several tools do this, including crane, skopeo, and my own regclient. The specs for this are defined in OCI. Specifically:

• config json which is stored as a blob, containing the labels: https://github.com/opencontainers/image-spec/blob/main/config.md
• image manifest that contains the config descriptor: https://github.com/opencontainers/image-spec/blob/main/manifest.md
• distribution spec that tells how to pull manifests and blobs: https://github.com/opencontainers/distribution-spec/blob/main/spec.md

I'd recommend using a library for this, mainly to handle the authentication, which can be challenging. Or if you just want a quick CLI, here's the example with regctl from regclient :

regctl image config $image_name

The above also accepts Go templates in the --format flag, allowing you to retrieve specific labels. You can see the implementation for that, in Go, in that command definition .