Docker: How do I pull a specific build-id?

Question

I would like to always pull a specific version, rather than just the latest.

A random example: https://registry.hub.docker.com/u/aespinosa/jenkins/builds_history/9511/

I am doing this because I only want to deploy versions that I have audited. Is this currently possible? Or am I forced to fork them and make my own?

not sure if this will work, but have you tried `docker pull `? — Jim Jeffries, Aug 22 '14 at 11:24

score 49 · Accepted Answer · answered Nov 21 '16 at 22:41

49

You can pull a specific image by digest by using the following syntax:

docker pull ubuntu@sha256:45b23dee08af5e43a7fea6c4cf9c25ccf269ee113168c19722f87876677c5cb2

If you need to find the hash, it is output when pushing/pulling the image. Some automated builds output it at the end. I tried looking for the hash with docker inspect but it didn't appear to be there, so you'll have to delete the image and pull it again to view the hash.

answered Nov 21 '16 at 22:41

Joel B

12,082
10
61
69

3

Using docker ce 17.05, I'm able to retrieve digest from local image: `docker images --digest` – Patrice Tisserand Apr 06 '18 at 11:57
10

or `docker image inspect --format='{{index .RepoDigests 0}}' $IMAGE` for a specific image – protometa Jul 05 '18 at 20:56
For docker 20.10: `docker inspect --format='{{.Image}}' $IMAGE` – Kristofer Aug 03 '22 at 10:48

score 4 · Answer 2 · answered Aug 22 '14 at 18:40

4

The way I do it is to tag each build

docker build -t $NAMESPACE/$APP_NAME:$BUILD_SHA1 .
docker tag $NAMESPACE/$APP_NAME:$SHA1  $DOCKER_REGISTRY/$NAMESPACE/$APP_NAME:$SHA1
docker push $DOCKER_REGISTRY/$NAMESPACE/$APP_NAME:$SHA1

and then you pull the specific tag

docker pull $DOCKER_REGISTRY/$NAMESPACE/$APP_NAME:$SHA1

answered Aug 22 '14 at 18:40

fabrizioM

46,639
15
102
119

1

So looks like I'll have to keep a fork of my own – Sam Aug 26 '14 at 09:12
7

But tags are not immutable, how is this secure without immutability? – Leo Gallucci Jun 02 '15 at 15:18

score 0 · Answer 3 · answered Jul 21 '21 at 17:20

In addition to Joel's answer, you might want to verify the image exists on a specific Docker repo before trying to pull the image. The easiest way I know is using the Docker registry API. Make a simple HTTP GET request. Assemble the string like this -

FullURL = DomainAndPort + "/v2/" + imageName + "/blobs/sha256:" + imageHash;

An example request that works for me on our network repo -
http://10.10.9.84:5000/v2/hello-world/blobs/sha256:8089101ead9ce9b8c68d6859995c98108e1022c23beaa55754acb89d66fd3381

Entering that string into a Chrome browser returns a JSON object describing the image. If you enter an invalid sha256 hash then the API returns -

{"errors":[{"code":"DIGEST_INVALID","message":"provided digest did not match uploaded content","detail":{}}]}

For more details see "Pulling a Layer" in https://docs.docker.com/registry/spec/api/

Docker: How do I pull a specific build-id?

3 Answers3

Linked