I have a Docker image on my system 12346789ABCD.
Is there a way to know where it is coming from?
Specifically, I would like to know if it was built locally or downloaded from a repository, and in that latter case, downloaded from which repository.
asked Dec 4, 2018 at 14:36
1 Answer
Typically, if it's from a registry, you see that in the name of the image (if it's not from the default registry, Docker Hub). Images from Quay look like quay.io/<namespace>/<image name>:<tag>.
Some images are from from anywhere else at all. For example images that are FROM: scratch and images created via docker import will not be associated with any registry. These are the famous none:none images (no repository and no tag). In this case, you only have the ID (SHA) and you need do be Sherlock Holmes (or Jessie Frazelle) to match it with something.
So, you can only see what is written in the manifest. Should you trust it? The manifest can be signed, using docker content trust even if the image contents themselves are not. If you need more certainty on the provenance, you probably need notary to ensure that trust is maintained throughout the delegation chain.
Hope that answers the question.
answered Dec 4, 2018 at 18:23
docker inspect:docker inspect -f '{{json .}}' debian | jq '{RepoTags,RepoDigests}'The presence of RepoTags and RepoDigest is a clue the image was downloaded. But I can't see from where.