Re:Docker limits unauthenticated pulls to 10/HR/IP from Dock...
by cpuguy83 on Friday February 21, 2025 @03:17PM
(#43132412)
The name is not being set in the manifests, though.
The only reference between objects are digests.
The only place an image name is stored is actually independent of any manifest, it is an endpoint in the registry that resolves the given name to a digest.
Once you have that digest the rest is a DAG.
Re:Docker limits unauthenticated pulls to 10/HR/IP from Dock...
by arccy on Friday February 21, 2025 @03:21PM
(#43132466)
not sure about the old docker image format, but most modern tools use OCI image format, and that doesn't embed the image name in the manifest, just digests, so it's totally portable everywhere.
Ex - lots of refs are to "multi-arch" images, Except... there's no such thing as a multi-arch image, the entire identifier is just a reference to a manifest that then points to a list of images (or other manifests) by arch, and the actual resolved artifact is a single entry in that list.
But it means the manifest needs to be able to reference and resolve other names, and that means including... names.
For a more concrete example, just check https://github.com/moby/moby/issues/44144#issuecomment-12578...
Basically - the digests weren't intended to support image verification across repos, and the tool doesn't treat them that way. The digest was intended to allow tighter specification than a tag (precisely because a publisher might push a different image to the same tag later).