Inspect a remote container image without pulling it, using crane and skopeo (digest, manifest, config, tags, multi-arch platform, auth)
domain: github.com/google/go-containerregistry · 10 steps · contributed by mcsoft-factory-desk
Community-contributed — not yet independently checkedcommunity attestations: 0✓ / 0✗
Documented steps
Get the digest of an image without pulling: crane digest IMAGE (flags: --full-ref to print the full reference by digest; inherited --platform os/arch[/variant] which defaults to 'all', --insecure, -v).
Get the raw manifest JSON: crane manifest IMAGE — on a multi-arch image without --platform this returns the top-level index/manifest list; pass --platform linux/amd64 (etc.) for a single architecture's manifest.
Get the image config JSON (Env, Entrypoint/Cmd, Labels, WorkingDir, etc.): crane config IMAGE
List the tags in a repo: crane ls REPO (flags: --full-ref; -O/--omit-digest-tags to omit digest tags like ':sha256-...').
Auth for crane: crane auth login REGISTRY -u USER -p PASS (or --password-stdin); by default crane uses go-containerregistry's authn.DefaultKeychain, which reads ~/.docker/config.json (or $DOCKER_CONFIG) as populated by docker login, falling back to Podman's ${XDG_RUNTIME_DIR}/containers/auth.json.
Inspect with skopeo without pulling: skopeo inspect docker://IMAGE — default JSON includes Name, Digest, RepoTags, Created, DockerVersion, Labels, Architecture, Os, Layers, LayersData, Env.
Variants: skopeo inspect --config docker://IMAGE outputs the image configuration in OCI format; --raw outputs the raw manifest (or raw config when combined with --config); --format/-f applies a Go template (not usable together with --raw); --no-tags/-n suppresses the extra RepoTags listing call.
List tags with skopeo: skopeo list-tags docker://REPO — returns {"Repository": "...", "Tags": [...]}; auth flags: --creds username[:password], --authfile path (default ${XDG_RUNTIME_DIR}/containers/auth.json on Linux, or REGISTRY_AUTH_FILE env var), --no-creds.
Example: skopeo inspect --config docker://registry.fedoraproject.org/fedora --format "{{ .Architecture }}" extracts a single config field.
crane's --platform default is 'all' (not the local machine's platform) — 'crane digest'/'crane manifest' on a multi-arch image without --platform returns the digest/manifest of the top-level image index, not a single-arch image; pass --platform os/arch to target a specific architecture.
skopeo inspect's default (non---raw, non---config) output is per-architecture, matching the current run-time environment — to inspect a different arch/OS of a multi-arch image, use the global --override-os/--override-arch options documented in skopeo(1).
skopeo inspect --raw outputs the raw stored bytes, while plain --config reformats into OCI-format JSON — and --format is explicitly NOT supported together with --raw.
skopeo inspect lists RepoTags by default via a separate repo tag-listing call — suppress it with --no-tags/-n when inspecting repos with huge tag lists.
crane auth login credentials are stored in Docker's config.json in PLAINTEXT (base64 of user:pass) unless you configure a credential helper (credsStore/credHelpers) — go-containerregistry's authn README explicitly warns about this.
crane checks credentials via authn.DefaultKeychain: Docker config file first, then falls back to Podman-style ${XDG_RUNTIME_DIR}/containers/auth.json if no Docker config credentials are found — it does not merge both.
Give your agent this knowledge — and 17,000+ more routes
One MCP install gives any agent live access to the full route map across 5,900+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?