带有两个不同SHA256摘要的码头图像

Question

当inspect显示一个Docker映像的两个RepoDigests值时，意味着什么？

示例：

$ docker inspect aquasec/trivy:latest
[
    {
        "Id": "sha256:33106c9ec694a2e9057fb80a5451f4648ed67d6159cc034fa6340f4cfbe2b98a",
        "RepoTags": [
            "aquasec/trivy:latest"
        ],
        "RepoDigests": [
            "aquasec/trivy@sha256:76d47e5917c583fcad5ab4f83a23cb5e534c34649a994c73722fe6dfd86f2855",
            "aquasec/trivy@sha256:c0d08ac683a0e36ac71555314140718cd8d224efb70a5ebe388ad5879be56445"
        ],
...
]

当我去码头枢纽时，只显示c0d08ac683a0。

Answer 1

aquasec/trivy是以多平台映像的形式分布的.列表中的第一个来自清单列表本身，第二个摘要用于特定平台：

$ regctl manifest get --list aquasec/trivy
Name:        aquasec/trivy
MediaType:   application/vnd.docker.distribution.manifest.list.v2+json
Digest:      sha256:76d47e5917c583fcad5ab4f83a23cb5e534c34649a994c73722fe6dfd86f2855
             
Manifests:   
             
  Name:      docker.io/aquasec/trivy@sha256:c0d08ac683a0e36ac71555314140718cd8d224efb70a5ebe388ad5879be56445
  MediaType: application/vnd.docker.distribution.manifest.v2+json
  Platform:  linux/amd64
             
  Name:      docker.io/aquasec/trivy@sha256:5d0d4ce0af0888f77b9831172f0ec6a6f8e6b087496a5d2677426e0492224302
  MediaType: application/vnd.docker.distribution.manifest.v2+json
  Platform:  linux/arm64

清单列表是指向每个平台清单的一组指针(它有自己的摘要)：

{
  "schemaVersion": 2,
  "mediaType": "application/vnd.docker.distribution.manifest.list.v2+json",
  "manifests": [
    {
      "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
      "size": 1159,
      "digest": "sha256:c0d08ac683a0e36ac71555314140718cd8d224efb70a5ebe388ad5879be56445",
      "platform": {
        "architecture": "amd64",
        "os": "linux"
      }
    },
    {
      "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
      "size": 1159,
      "digest": "sha256:5d0d4ce0af0888f77b9831172f0ec6a6f8e6b087496a5d2677426e0492224302",
      "platform": {
        "architecture": "arm64",
        "os": "linux"
      }
    }
  ]
}

然后，您的平台的停靠清单包含对配置和层块的引用：

{
  "schemaVersion": 2,
  "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
  "config": {
    "mediaType": "application/vnd.docker.container.image.v1+json",
    "size": 1820,
    "digest": "sha256:33106c9ec694a2e9057fb80a5451f4648ed67d6159cc034fa6340f4cfbe2b98a"
  },
  "layers": [
    {
      "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
      "size": 2814446,
      "digest": "sha256:a0d0a0d46f8b52473982a3c466318f479767577551a53ffc9074c9fa7035982e"
    },
    {
      "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
      "size": 6900624,
      "digest": "sha256:0df7abe0cb9353fe074cad7942ce432f7a95cc1e80a4e4f15e326f4c79af7364"
    },
    {
      "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
      "size": 13101667,
      "digest": "sha256:49b8248ae36d0bf5eefe15d56704da18a3239db65bb82d5e73426dafbc16e7df"
    },
    {
      "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
      "size": 4268,
      "digest": "sha256:33a14db32fe04bfed4ebca691c13c0947b2bbceb9ae68c5118435b9dbaf4dfcd"
    }
  ]
}