Docker: Need to verify which digest I need to remove a manifest related to a tag

scusson_9923

Hi,

I am trying to obtain the correct digest of a particular docker tag and have seen two methods, with different outputs (see below), to accomplish this.  Which is correct?  From your documentation, I need to get the digest associated with 'Docker-Content-Digest', which is option 2.  However, documentation doesn't explicitly mention using curl (unless it's assumed?).

place 'https://<proget_repo>/v2/<container>/library/<image_name>/manifests/<tag>' in a web browser. Alternatively, use Powershell's Invoke-WebRequest
type 'curl -v -H Accept: "application/vnd.docker.distribution.manifest.v2+json" -X HEAD https://<proget_repo>/v2/<container>/library/<image_name>/manifests/<tag>' on the command line

Option 1 output:
{
"schemaVersion": 2,
"mediaType": "application/vnd.docker.distribution.manifest.v2+json",
"config": {
"mediaType": "application/vnd.docker.container.image.v1+json",
"size": 4536,
"digest": "sha256:d8622010e224b5c7dc541c0e8843b993fd5c5afe422ed1309aac207bd06885a7"
},
"layers": [
{
"mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
"size": 22524609,
"digest": "sha256:804555ee037604c40de144f9f8da0d826d38db82f15d74cded32790fe279a8f6"
},
{
"mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
"size": 17692725,
"digest": "sha256:970251047358aea56ba6db6975b14ff12470b75de0c2477f4445240ddd727fd4"
},
{
"mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
"size": 2978257,
"digest": "sha256:f3d4c41a4fd13f35c0b46f19a4e27845f4695163cc7174d908ff84836bbc2f5a"
},
{
"mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
"size": 62145592,
"digest": "sha256:bd391c46585f9f8d84992bbaa9087189148c1601968eaaf097d5b3ed60840e5e"
},
{
"mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
"size": 126,
"digest": "sha256:1674b9537e7545c5665f935cab34e05e09971a88dab2b86fdf00e516089708f5"
},
{
"mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
"size": 25187509,
"digest": "sha256:51ecaa038642c6c35b4be45cf823e06d5f3f50f8f3f5e9cfb52c6b5151a57dc5"
}
]
}

Option 2 output:

Warning: Setting custom HTTP method to HEAD with -X/--request may not work the
Warning: way you want. Consider using -I/--head instead.

Could not resolve host: application
Closing connection 0
curl: (6) Could not resolve host: application
Warning: Setting custom HTTP method to HEAD with -X/--request may not work the
Warning: way you want. Consider using -I/--head instead.
Trying 10.2.0.87...
TCP_NODELAY set
Connected to <proget_repo> port 443 (#1)
schannel: SSL/TLS connection with <proget_repo> port 443 (step 1/3)
schannel: checking server certificate revocation
schannel: sending initial handshake data: sending 190 bytes...
schannel: sent initial handshake data: sent 190 bytes
schannel: SSL/TLS connection with <proget_repo> port 443 (step 2/3)
schannel: encrypted data got 1842
schannel: encrypted data buffer: offset 1842 length 4096
schannel: sending next handshake data: sending 158 bytes...
schannel: SSL/TLS connection with <proget_repo> port 443 (step 2/3)
schannel: encrypted data got 51
schannel: encrypted data buffer: offset 51 length 4096
schannel: SSL/TLS handshake complete
schannel: SSL/TLS connection with <proget_repo> port 443 (step 3/3)
schannel: stored credential handle in session cache

HEAD /v2/<container>/library/<image>/manifests/<tag> HTTP/1.1
Host: <proget_repo>
User-Agent: curl/7.55.1

schannel: client wants to read 102400 bytes
schannel: encdata_buffer resized 103424
schannel: encrypted data buffer: offset 0 length 103424
schannel: encrypted data got 483
schannel: encrypted data buffer: offset 483 length 103424
schannel: decrypted data length: 454
schannel: decrypted data added: 454
schannel: decrypted data cached: offset 454 length 102400
schannel: encrypted data buffer: offset 0 length 103424
schannel: decrypted data buffer: offset 454 length 102400
schannel: schannel_recv cleanup
schannel: decrypted data returned 454
schannel: decrypted data buffer: offset 0 length 102400
< HTTP/1.1 200 OK
< Cache-Control: public, max-age=300
< Content-Length: 1583
< Content-Type: application/vnd.docker.distribution.manifest.v2+json
< Vary: Authorization
< Server: Microsoft-IIS/10.0
< X-AspNet-Version: 4.0.30319
< X-ProGet-Version: 5.2.23.7
< Docker-Distribution-API-Version: registry/2.0
< Docker-Content-Digest: sha256:219db0d935303e3d454231d6146ee56d658c8399f10de95648cdd91379139ce5
< X-Powered-By: ASP.NET
< Date: Tue, 11 Feb 2020 19:25:03 GMT
<
schannel: client wants to read 1583 bytes
schannel: encrypted data buffer: offset 0 length 103424
schannel: Curl_read_plain returned CURLE_RECV_ERROR
schannel: encrypted data buffer: offset 0 length 103424
schannel: encrypted data buffer: offset 0 length 103424
schannel: decrypted data buffer: offset 0 length 102400
schannel: schannel_recv cleanup
Closing connection 1
schannel: shutting down SSL/TLS connection with <proget_repo> port 443
Send failure: Connection was reset
schannel: failed to send close msg: Failed sending data to the peer (bytes written: -1)
schannel: clear security context handle

Do I run option 1: 'DELETE /v2/<container>/library/<image>/manifestsd8622010e224b5c7dc541c0e8843b993fd5c5afe422ed1309aac207bd06885a7'

or option 2 (Docker-Content-Digest)

'DELETE /v2/<container>/library/<image>/manifests/219db0d935303e3d454231d6146ee56d658c8399f10de95648cdd91379139ce5'

Thanks,
Scott

atripp

Option 1. That digest references the blob which represents your manifest.

According to Docker's Content Digest Docs, option 2 (the Docker-Content-Digest header) does not reference a blob, it's just a hash of the response itself.

scusson_9923

Thanks for the reply!

scusson_9923

Just for reference, I was able to get the correct digest of a tag and delete it with this PowerShell script...

$image = "some_image"
$some_image_tag = "some_tag"

get digest

$curlReturn = curl -I HEAD https://<proget_repo>/v2/<container>/library/$image/manifests/$some_image_tag
foreach ($line in $curlReturn)
{
if ($line -match "Docker-Content-Digest: (.+)")
{
$digest = $Matches[1]
Write-Host "$image digest is $digest"
}
}

delete tag digest

$URI = "https://<proget_repo>/v2/<container>/library/$image/manifests/$digest"
Write-Host "Deleting tag $some_image_tag from image $image"
Invoke-WebRequest -Uri $URI -Method Delete -Headers @{"X-ApiKey"="<proget_api_key>"; }