具有 2 個不同 SHA256 摘要的 Docker 映像

Question

當inspect顯示 Docker 映像的兩個RepoDigests值時，這意味着什么？

例子：

$ docker inspect aquasec/trivy:latest
[
    {
        "Id": "sha256:33106c9ec694a2e9057fb80a5451f4648ed67d6159cc034fa6340f4cfbe2b98a",
        "RepoTags": [
            "aquasec/trivy:latest"
        ],
        "RepoDigests": [
            "aquasec/trivy@sha256:76d47e5917c583fcad5ab4f83a23cb5e534c34649a994c73722fe6dfd86f2855",
            "aquasec/trivy@sha256:c0d08ac683a0e36ac71555314140718cd8d224efb70a5ebe388ad5879be56445"
        ],
...
]

當我轉到Docker Hub 時，只顯示了c0d08ac683a0 。

Answer 1

aquasec/trivy作為多平台映像分發。 您列表中的第一個來自清單列表本身，第二個摘要針對您的特定平台：

$ regctl manifest get --list aquasec/trivy
Name:        aquasec/trivy
MediaType:   application/vnd.docker.distribution.manifest.list.v2+json
Digest:      sha256:76d47e5917c583fcad5ab4f83a23cb5e534c34649a994c73722fe6dfd86f2855
             
Manifests:   
             
  Name:      docker.io/aquasec/trivy@sha256:c0d08ac683a0e36ac71555314140718cd8d224efb70a5ebe388ad5879be56445
  MediaType: application/vnd.docker.distribution.manifest.v2+json
  Platform:  linux/amd64
             
  Name:      docker.io/aquasec/trivy@sha256:5d0d4ce0af0888f77b9831172f0ec6a6f8e6b087496a5d2677426e0492224302
  MediaType: application/vnd.docker.distribution.manifest.v2+json
  Platform:  linux/arm64

清單列表是一組指向每個平台清單的指針（它有自己的摘要）：

{
  "schemaVersion": 2,
  "mediaType": "application/vnd.docker.distribution.manifest.list.v2+json",
  "manifests": [
    {
      "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
      "size": 1159,
      "digest": "sha256:c0d08ac683a0e36ac71555314140718cd8d224efb70a5ebe388ad5879be56445",
      "platform": {
        "architecture": "amd64",
        "os": "linux"
      }
    },
    {
      "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
      "size": 1159,
      "digest": "sha256:5d0d4ce0af0888f77b9831172f0ec6a6f8e6b087496a5d2677426e0492224302",
      "platform": {
        "architecture": "arm64",
        "os": "linux"
      }
    }
  ]
}

然后，您平台的 docker 清單包含對配置和層 blob 的引用：

{
  "schemaVersion": 2,
  "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
  "config": {
    "mediaType": "application/vnd.docker.container.image.v1+json",
    "size": 1820,
    "digest": "sha256:33106c9ec694a2e9057fb80a5451f4648ed67d6159cc034fa6340f4cfbe2b98a"
  },
  "layers": [
    {
      "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
      "size": 2814446,
      "digest": "sha256:a0d0a0d46f8b52473982a3c466318f479767577551a53ffc9074c9fa7035982e"
    },
    {
      "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
      "size": 6900624,
      "digest": "sha256:0df7abe0cb9353fe074cad7942ce432f7a95cc1e80a4e4f15e326f4c79af7364"
    },
    {
      "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
      "size": 13101667,
      "digest": "sha256:49b8248ae36d0bf5eefe15d56704da18a3239db65bb82d5e73426dafbc16e7df"
    },
    {
      "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
      "size": 4268,
      "digest": "sha256:33a14db32fe04bfed4ebca691c13c0947b2bbceb9ae68c5118435b9dbaf4dfcd"
    }
  ]
}