title: Can I get an image digest without downloading the image?
body: <p>Similar to the question "<a href="https://stackoverflow.com/questions/32046334/what&#39;s-the-sha256-code-of-a-docker-image">What´s the sha256 code of a docker image?</a>", I would like to find the digest of a Docker image. I can see the digest when I download an image:</p>
  
  <pre><code>$ docker pull waisbrot/wait:latest                                                                                                  
  latest: Pulling from waisbrot/wait
  Digest: sha256:6f2185daa4ab1711181c30d03f565508e8e978ebd0f263030e7de98deee5f330
  Status: Image is up to date for waisbrot/wait:latest
  $
  </code></pre>
  
  <p>Another question, <a href="https://stackoverflow.com/questions/35186693/what-is-the-docker-registry-v2-api-endpoint-to-get-the-digest-for-an-image">What is the Docker registry v2 API endpoint to get the digest for an image</a> has an answer suggesting the <code>Docker-Content-Digest</code> header.</p>
  
  <p>I can see that there is a <code>Docker-Content-Digest</code> header when I fetch the manifest for the image:</p>
  
  <pre><code>$ curl 'https://auth.docker.io/token?service=registry.docker.io&amp;scope=repository:waisbrot/wait:pull' -H "Authorization: Basic ${username_password_base64}"
  
  # store the resulting token in DT
  
  $ curl -v https://registry-1.docker.io/v2/waisbrot/wait/manifests/latest -H "Authorization: Bearer $DT" -XHEAD
  *   Trying 52.7.141.30...
  * Connected to registry-1.docker.io (52.7.141.30) port 443 (#0)
  * TLS 1.2 connection using TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
  * Server certificate: *.docker.io
  * Server certificate: RapidSSL SHA256 CA - G3
  * Server certificate: GeoTrust Global CA
  &gt; GET /v2/waisbrot/wait/manifests/latest HTTP/1.1
  &gt; Host: registry-1.docker.io
  &gt; User-Agent: curl/7.43.0
  &gt; Accept: */*
  &gt; Authorization: Bearer LtVRw-etc-etc-etc
  &gt;
  &lt; HTTP/1.1 200 OK
  &lt; Content-Length: 4974
  &lt; Content-Type: application/vnd.docker.distribution.manifest.v1+prettyjws
  &lt; Docker-Content-Digest: sha256:128c6e3534b842a2eec139999b8ce8aa9a2af9907e2b9269550809d18cd832a3
  &lt; Docker-Distribution-Api-Version: registry/2.0
  &lt; Etag: "sha256:128c6e3534b842a2eec139999b8ce8aa9a2af9907e2b9269550809d18cd832a3"
  &lt; Date: Wed, 07 Sep 2016 16:37:15 GMT
  &lt; Strict-Transport-Security: max-age=31536000
  </code></pre>
  
  <p>However, this header isn't the same. The <code>pull</code> command got me <code>6f21</code> and the header shows <code>128c</code>. Further, the pull command doesn't work for that digest:</p>
  
  <pre><code>$ docker pull waisbrot/wait@sha256:128c6e3534b842a2eec139999b8ce8aa9a2af9907e2b9269550809d18cd832a3                               
  Error response from daemon: manifest unknown: manifest unknown
  </code></pre>
  
  <p>whereas things work as I want when I have the correct digest:</p>
  
  <pre><code>$ docker pull waisbrot/wait@sha256:6f2185daa4ab1711181c30d03f565508e8e978ebd0f263030e7de98deee5f330                                 12:46  waisbrot@influenza
  sha256:6f2185daa4ab1711181c30d03f565508e8e978ebd0f263030e7de98deee5f330: Pulling from waisbrot/wait
  Digest: sha256:6f2185daa4ab1711181c30d03f565508e8e978ebd0f263030e7de98deee5f330
  Status: Image is up to date for waisbrot/wait@sha256:6f2185daa4ab1711181c30d03f565508e8e978ebd0f263030e7de98deee5f330
  </code></pre>
  
  <p>What I'm looking for is a way to translate the <code>latest</code> tag (which changes all the time) into a fixed digest that I can reliably pull. But I don't want to actually pull it down in order to do this translation.</p>