Expose docker image digests in the UI

[danielvanmil]

Portainer doesn't expose/show the digest of an image (only the id). It would be nice (and easy) if this could be added somewhere.

[p0wertiger]

Seconding this. Here's some screenshots to give the idea how this functionality is actually ESSENTIAL since having an ID alone doesn't tell whether it is the newest image from repository.

~$ docker image list --format 'table {{.ID}}\t{{.Repository}}\t{{.Tag}}\t{{.Digest}}' gitlab/gitlab-ce
IMAGE ID       REPOSITORY         TAG       DIGEST
d9ac938eda4b   gitlab/gitlab-ce   latest    sha256:772d78d6990cd334ecfb9898adc4e8951171a5bcf4bb14866b335aeadba34b85
f85d08f83476   gitlab/gitlab-ce   <none>

[dokeraj]

why is this still not resolved? We need to know which image digest was originally the container pulled from.

[Appoxo]

Any update on this? Still don't see any reason why theres no update on the product for it.
Does Portainer consider this a premium feature so it won't even show in CE?

[Guiorgy]

Why was the issue closed?

[Moritz-Wohlgenannt]

I think because it got converted into a discussion and it makes sense to have all comments in one place.

[Moritz-Wohlgenannt]

I'd like to bring this topic up again as I just spent about an hour trying to figure out why there seemed to be a mismatch between my local docker images and the ones I was seeing on dockerhub. Finally realized that sha265 IDs and sha265 gigests for images aren't the same thing. Had to go into commandline and inspect the image to find the digest and I feel like portainer really led me astray here....
So very big upvote from me to include this and save some other folks the hassle I just went through...

[Aetherinox]

I don't think I understand why this isn't even a thing. Digest through API is insanely easy to pull. Just would be nice to have a UI to show this info.

[Guiorgy]

@Aetherinox I'm assuming that the digest is not guaranteed to be available:

$ docker image list --format 'table {{.ID}}\t{{.Repository}}\t{{.Tag}}\t{{.Digest}}' postgres
IMAGE ID       REPOSITORY   TAG       DIGEST
a299406cefae   postgres     <none>
ed30edf810c3   postgres     16        sha256:12c827ab26d9929e1fcf3439ed8f5af8616726d8a605d4dbb010abb797af1821
87477448d3db   postgres     <none>
eee71f45c6df   postgres     <none>

However, docker also provides the --digests option:

$ docker image list --digests --format 'table {{.ID}}\t{{.Repository}}\t{{.Tag}}\t{{.Digest}}' postgres
IMAGE ID       REPOSITORY   TAG       DIGEST
ed30edf810c3   postgres     16        sha256:12c827ab26d9929e1fcf3439ed8f5af8616726d8a605d4dbb010abb797af1821
a299406cefae   postgres     <none>    sha256:361c84f2bbe0f91135990841eb4eb4d2fe491f6e950686d9c746415dd1ffc65e
87477448d3db   postgres     <none>    sha256:a35ec42526e3c522eb13b4d82eddaee875d0ac6ca9eb5cc5607e412854478c71
eee71f45c6df   postgres     <none>    sha256:557fea37a744d5f4c8faab304b0a90858b53ab119735a88c131fd19dab802f36

I wonder why the digests are empty for <none> tags by default. Also, even this won't give digests for locally built images:

$ docker image list --digests --format 'table {{.ID}}\t{{.Repository}}\t{{.Tag}}\t{{.Digest}}' lazyteam/lazydocker
IMAGE ID       REPOSITORY            TAG       DIGEST
e7e106b87df3   lazyteam/lazydocker   latest    <none>

Still, I think it's better to have the field and show none or something when unavailable.

Edit: One more thing to note, when using docker image inspect to get the digest, the key is RepoDigests which is plural and it returns a list digests:

$ docker image inspect ed30edf810c3 --format '{{.RepoDigests}}' # postgres:16
[postgres@sha256:12c827ab26d9929e1fcf3439ed8f5af8616726d8a605d4dbb010abb797af1821]
$ docker image inspect a299406cefae --format '{{.RepoDigests}}' # postgres:<none>
[postgres@sha256:361c84f2bbe0f91135990841eb4eb4d2fe491f6e950686d9c746415dd1ffc65e]

So it seems the digest can be potentially not only empty, but also a list of values, further complicating things.

[Aetherinox]

Interesting. I haven't come across that yet. Wonder why. But I usually build locally with buildx / buildkit, and I push to a private registry.

I wanted to push to Gitea and browse the packages in Portainer, but I've spent hours and hours searching, and nobody has come up with a solution. People keep mentioning that either Portainer is to blame, or Gitea, and the devs keep pointing the finger at each other from the discussions I've read.

But yeah, an optional digest would be nice, or at least just show "None" if a digest couldn't be fetched. That would at least help with some instances.

I like the self-hosted docker registry available, but it's limited to API only, and is a pain at times to get data, which is also why I wanted to prefer Gitea.

[Guiorgy]

Opened a PR #12567 o7

[Moritz-Wohlgenannt]

Thanks!!!