Getting invalid image digest when I specify the `--platform linux/amd64` flag during a docker pull

Question

When I docker pull bitnami/sealed-secrets-controller:v0.19.4, the digest I get matches the digest returned by docker run --rm regclient/regctl image digest bitnami/sealed-secrets-controller:v0.19.4.

The problem is if I'm doing it on my mac, I'm getting the arm64 architecture, so I need to do the same thing with the --platform linux/amd64 flag like so:

docker pull --platform linux/amd64 bitnami/sealed-secrets-controller:v0.19.4 gets me the digest ca8b5651578f4909d15be21e81c4d7bdc76ff39e0e9f34f6a95e3ca4d26b7c0e, but docker run --rm regclient/regctl image digest --platform linux/amd64 bitnami/sealed-secrets-controller:v0.19.4 returns the digest ed88880030cfe6b7325f6ab06d1667325228f7aa2d8b9f4fc6197acab181e165 which is correct for that platform according to docker manifest inspect, but doesn't match the digest I got when pulling the image.

> docker manifest inspect bitnami/sealed-secrets-controller:v0.19.4
...
         "digest": "sha256:ed88880030cfe6b7325f6ab06d1667325228f7aa2d8b9f4fc6197acab181e165",
         "platform": {
            "architecture": "amd64",
            "os": "linux"
...

so it seems like adding the --platform flag is somehow messing up the digest?

Answer 1

Found the issue, If you don't specify platform, you get the combined manifest digest. if you do specify platform, you get the single platform manifest digest.

> docker run --rm regclient/regctl image digest --platform linux/amd64 bitnami/sealed-secrets-controller:v0.19.4
sha256:ed88880030cfe6b7325f6ab06d1667325228f7aa2d8b9f4fc6197acab181e165
> docker run --rm regclient/regctl image digest bitnami/sealed-secrets-controller:v0.19.4
sha256:ca8b5651578f4909d15be21e81c4d7bdc76ff39e0e9f34f6a95e3ca4d26b7c0e
> docker manifest inspect bitnami/sealed-secrets-controller:v0.19.4
{
   "schemaVersion": 2,
   "mediaType": "application/vnd.docker.distribution.manifest.list.v2+json",
   "manifests": [
      {
         "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
         "size": 701,
         "digest": "sha256:ed88880030cfe6b7325f6ab06d1667325228f7aa2d8b9f4fc6197acab181e165",
         "platform": {
            "architecture": "amd64",
            "os": "linux"
         }
      },
      {
         "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
         "size": 701,
         "digest": "sha256:6e57b2278f98f50cbe64ceca03bc949b53dadd2ae1a4c1be61d9786e761c1611",
         "platform": {
            "architecture": "arm64",
            "os": "linux"
         }
      },
      {
         "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
         "size": 701,
         "digest": "sha256:799920f276374f9b0ab60eddaa5e3a156f764f3cd5fc3989f5be8c9427665cbb",
         "platform": {
            "architecture": "arm",
            "os": "linux",
            "variant": "v7"
         }
      }
   ]
}