Where are the manifest files of docker images stored on private registry?

392 Views Asked by At

I have a Harbor registry containing docker images on AWS s3, what is the path for the manifest file for each image?

1

There are 1 best solutions below

0
BMitch On

I wouldn't go to the S3 backend since this can be implementation specific and subject to change.

Instead, the APIs for listing tags and pulling manifests are documented in the OCI distribution-spec. And rather than implementing the API yourself, I'd recommend looking at one of the existing implementations like go-containerregistry from Google or regclient from myself to help implement these requests. This will help with authentication, setting the needed headers, and parsing the response.

Note that there are multiple types of manifests, both the OCI and Docker schemas, plus multi-platform manifests, and an artifact manifest is being developed. For those multi-platform manifests, you need to recursively check the contained manifests.

OCI has also documented annotations that include those for the base image, but hardly anyone is setting those. So you would need to cross reference the layer digests for the image with the various layer digests in the base image repo for all manifests there. I'd supplement that by comparing the history steps between the image and it's suspected base image, since some changes to the base image will not modify the layers (it could be an environment variable change). And this will miss an intermediate base image (e.g. you may pickup debian, instead of nginx that is based on debian, if you aren't looking in the right repository).