Docker image digests?

Docker image digests?

When you download something from the internet, a common method for determining both integrity and authenticity of an object is to generate a cryptographic hash of it and compare it to what you expect.

Let’s say you’re using Docker Hub to store images, and you’re also deploying Docker images to your infrastructure by specifying a tag like oneminutenotes/app:v1.2.11.

Now, one day, you discover that someone’s Docker Hub credentials on your team have been exposed. Docker Hub doesn’t support MFA, so you know an attacker could have had push access to your repositories.

How can you be sure that the image you’re running, hasn’t been overwritten with a malicious version? Short answer is you can’t, because you’re not verifying what you’re downloading from the internet.

The answer to this in the Docker world is digests

Images that use the v2 or later format have a content-addressable identifier called a digest. As long as the input used to generate the image is unchanged, the digest value is predictable.

Instead of specifying oneminutenotes/app:v1.2.11, we should have been specifying the content addressable identifier for that tag; oneminutenotes/app@sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

When we use the digest as the identifier, Docker will not only pull the image with that digest, but also calculate the sha256 digest of what we downloaded and verify it against what we specified.

This provides a number of protections:

1. It removes any attack vector through the Docker Registry to change what we’re running in production. An attack that overwrites a mutable tag, has no effect on what we’re running.

2. It prevents any possibility of a MiTM attack, since any alteration (either malicious, or accidental) will be checked.

3. It increases the overall stability of the system as a whole, by the simple fact that the digest is an immutable identifier, so we know it can never change.

4. It improves cacheability for docker pull’s; content-addressable identifiers can never change, so they can be cached efficiently.


How to see container digest ?
docker images --digests

docker pull ubuntu:latest ----------bydefault

docker pull ubuntu@sha256:5d1d5407f353843ecf8b16524bc5565aa332e9e6a1297c73a92d3e754b8a636d
docker pull nginx@sha256:67f9a4f10d147a6e04629340e6493c9703300ca23a2f7f3aa56fe615d75d31ca