"docker digest" 本地下载镜像与 dockerhub 不匹配

一、为什么拉取的不是刚更新的镜像？

[root@VM-201-4-centos ~]# docker images 
REPOSITORY            TAG             IMAGE ID       CREATED         SIZE
myjenkins-blueocean   2.332.2-1       434e658bfb01   6 months ago    770MB
jenkins/jenkins       2.332.2-jdk11   fd576e09d155   7 months ago    464MB
jenkins/jenkins       latest          55860ee0cd73   10 months ago   442MB
jenkins/jenkins       lts-jdk11       2a4bbe50c40b   11 months ago   441MB

问题：
拉取的latest镜像，怎么是 10 months ago .
拉取的lts-jdk11镜像，怎么是 11 months ago. 官网显示6天前刚推送。

image.png

二、什么是 digest

digest - 摘要

v2之后的镜像格式使用一个内容寻址标识符，称为摘要。只要用于生成镜像的输入不变，摘要值是不变的。

使用 --digests 显示摘要信息，如下：

[root@VM-201-4-centos ~]# docker images  --digests
REPOSITORY            TAG             DIGEST                                                                    IMAGE ID       CREATED         SIZE
myjenkins-blueocean   2.332.2-1                                                                           434e658bfb01   6 months ago    770MB
jenkins/jenkins       2.332.2-jdk11   sha256:97fbf50e6ba97c25efaf64590b4ed6fcc64b551b1e09c5125a1752ab284a73ad   fd576e09d155   7 months ago    464MB
jenkins/jenkins       latest          sha256:c3fa8e7f70d1e873ea6aa87040c557aa53e6707eb1d5ecace7f6884a87588ac8   55860ee0cd73   10 months ago   442MB
jenkins/jenkins       lts-jdk11       sha256:c1d02293a08ba69483992f541935f7639fb10c6c322785bdabaf7fa94cd5e732   2a4bbe50c40b   11 months ago   441MB

再次拉取

[root@VM-201-4-centos ~]# docker -D pull  jenkins/jenkins:lts-jdk11 
lts-jdk11: Pulling from jenkins/jenkins
Digest: sha256:c1d02293a08ba69483992f541935f7639fb10c6c322785bdabaf7fa94cd5e732
Status: Image is up to date for jenkins/jenkins:lts-jdk11
docker.io/jenkins/jenkins:lts-jdk11

image.png

如图所示，摘要信息明显不符，我们拉取的镜像不是刚发布的镜像。

三、问题分析

重要参考文档：
Digests on Dockerhub and those fetched by docker pull do not match · Issue #1925 · docker/hub-feedback · GitHub

[root@VM-201-4-centos ~]# docker -D manifest inspect jenkins:jenkins
DEBU[0000] endpoints for docker.io/library/jenkins:jenkins: [{false https://registry-1.docker.io v2 false true true 0xc000104c00}] 
DEBU[0002] continuing on error (errcode.Errors) manifest unknown: manifest unknown 
DEBU[0002] endpoints for docker.io/library/jenkins:jenkins: [{false https://registry-1.docker.io v2 false true true 0xc000105680}] 
DEBU[0005] continuing on error (errcode.Errors) manifest unknown: manifest unknown 
no such manifest: docker.io/library/jenkins:jenkins

四、下载指定digest版本

[root@VM-201-4-centos ~]# docker -D pull jenkins/jenkins:lts-jdk11
lts-jdk11: Pulling from jenkins/jenkins
...
Digest: sha256:c1d02293a08ba69483992f541935f7639fb10c6c322785bdabaf7fa94cd5e732
Status: Downloaded newer image for jenkins/jenkins:lts-jdk11
docker.io/jenkins/jenkins:lts-jdk11
[root@VM-201-4-centos ~]# docker images
REPOSITORY            TAG             IMAGE ID       CREATED         SIZE
myjenkins-blueocean   2.332.2-1       434e658bfb01   6 months ago    770MB
jenkins/jenkins       2.332.2-jdk11   fd576e09d155   7 months ago    464MB
jenkins/jenkins       lts-jdk11       2a4bbe50c40b   11 months ago   441MB

[root@VM-201-4-centos ~]# docker images --digests
REPOSITORY            TAG             DIGEST                                                                    IMAGE ID       CREATED         SIZE
myjenkins-blueocean   2.332.2-1                                                                           434e658bfb01   6 months ago    770MB
jenkins/jenkins       2.332.2-jdk11   sha256:97fbf50e6ba97c25efaf64590b4ed6fcc64b551b1e09c5125a1752ab284a73ad   fd576e09d155   7 months ago    464MB
jenkins/jenkins       lts-jdk11       sha256:c1d02293a08ba69483992f541935f7639fb10c6c322785bdabaf7fa94cd5e732   2a4bbe50c40b   11 months ago   441MB

[root@VM-201-4-centos ~]# docker -D pull jenkins/jenkins:lts-jdk11@sha256:9ebcb377efa17fa1b39026e8cc20c38cbcc3b32bcd349eaf56b459fdb71dd8ee
docker.io/jenkins/jenkins@sha256:9ebcb377efa17fa1b39026e8cc20c38cbcc3b32bcd349eaf56b459fdb71dd8ee: Pulling from jenkins/jenkins
...
Digest: sha256:9ebcb377efa17fa1b39026e8cc20c38cbcc3b32bcd349eaf56b459fdb71dd8ee
Status: Downloaded newer image for jenkins/jenkins@sha256:9ebcb377efa17fa1b39026e8cc20c38cbcc3b32bcd349eaf56b459fdb71dd8ee
docker.io/jenkins/jenkins:lts-jdk11@sha256:9ebcb377efa17fa1b39026e8cc20c38cbcc3b32bcd349eaf56b459fdb71dd8ee
[root@VM-201-4-centos ~]# docker images --digests
REPOSITORY            TAG             DIGEST                                                                    IMAGE ID       CREATED         SIZE
jenkins/jenkins                 sha256:9ebcb377efa17fa1b39026e8cc20c38cbcc3b32bcd349eaf56b459fdb71dd8ee   4e9055fd35b3   5 days ago      463MB
myjenkins-blueocean   2.332.2-1                                                                           434e658bfb01   6 months ago    770MB
jenkins/jenkins       2.332.2-jdk11   sha256:97fbf50e6ba97c25efaf64590b4ed6fcc64b551b1e09c5125a1752ab284a73ad   fd576e09d155   7 months ago    464MB
jenkins/jenkins       lts-jdk11       sha256:c1d02293a08ba69483992f541935f7639fb10c6c322785bdabaf7fa94cd5e732   2a4bbe50c40b   11 months ago   441MB