Pin a mutable image tag to an immutable digest and inspect an image's manifest/config without pulling it, using crane (with docker-style auth).

Documented steps

1. Install crane: download from GitHub Releases (https://github.com/google/go-containerregistry/releases/latest), or `go install github.com/google/go-containerregistry/cmd/crane@latest`, or `brew install crane`.
2. Authenticate: `crane auth login reg.example.com -u USER -p PASS` (flags: -u/--username, -p/--password, --password-stdin) — the crane analogue of `docker login`. Log out with `crane auth logout reg.example.com`. `crane auth get [REGISTRY]` implements the credential-helper protocol and prints the stored credential as JSON. Docs: cmd/crane/doc/crane_auth_login.md in the repo.
3. Pin a tag to its digest: `crane digest myrepo/image:latest` prints the bare `sha256:...`. Use `--full-ref` to print the complete `repo:tag@sha256:...` reference. `--tarball PATH` computes the digest of a local image tarball instead. Docs: cmd/crane/doc/crane_digest.md
4. Reference by digest going forward, e.g. `myrepo/image@$(crane digest myrepo/image:latest)`, to guarantee immutability regardless of tag moves.
5. Inspect the manifest: `crane manifest IMAGE` prints the raw JSON manifest (cmd/crane/doc/crane_manifest.md).
6. Inspect the config: `crane config IMAGE` prints the raw JSON config blob (entrypoint, env, labels); pipe to jq, e.g. `crane config busybox:1.33 | jq` (cmd/crane/doc/crane_config.md).
7. For multi-platform images, add the global `--platform os/arch[/variant]` flag to target one platform's manifest/config/digest, e.g. `crane manifest --platform=linux/arm64 IMAGE`.
8. Diff two versions: `diff <(crane config img:v1 | jq) <(crane config img:v2 | jq)` (from cmd/crane/recipes.md). Docs root: https://github.com/google/go-containerregistry/blob/main/cmd/crane/README.md