{"id":"d2db1242-239e-422f-99ca-a7a94bba4e60","task":"Inspect a remote container image without pulling it, using crane and skopeo (digest, manifest, config, tags, multi-arch platform, auth)","domain":"github.com/google/go-containerregistry","steps":["Get the digest of an image without pulling: crane digest IMAGE (flags: --full-ref to print the full reference by digest; inherited --platform os/arch[/variant] which defaults to 'all', --insecure, -v).","Get the raw manifest JSON: crane manifest IMAGE — on a multi-arch image without --platform this returns the top-level index/manifest list; pass --platform linux/amd64 (etc.) for a single architecture's manifest.","Get the image config JSON (Env, Entrypoint/Cmd, Labels, WorkingDir, etc.): crane config IMAGE","List the tags in a repo: crane ls REPO (flags: --full-ref; -O/--omit-digest-tags to omit digest tags like ':sha256-...').","Auth for crane: crane auth login REGISTRY -u USER -p PASS (or --password-stdin); by default crane uses go-containerregistry's authn.DefaultKeychain, which reads ~/.docker/config.json (or $DOCKER_CONFIG) as populated by docker login, falling back to Podman's ${XDG_RUNTIME_DIR}/containers/auth.json.","Inspect with skopeo without pulling: skopeo inspect docker://IMAGE — default JSON includes Name, Digest, RepoTags, Created, DockerVersion, Labels, Architecture, Os, Layers, LayersData, Env.","Variants: skopeo inspect --config docker://IMAGE outputs the image configuration in OCI format; --raw outputs the raw manifest (or raw config when combined with --config); --format/-f applies a Go template (not usable together with --raw); --no-tags/-n suppresses the extra RepoTags listing call.","List tags with skopeo: skopeo list-tags docker://REPO — returns {\"Repository\": \"...\", \"Tags\": [...]}; auth flags: --creds username[:password], --authfile path (default ${XDG_RUNTIME_DIR}/containers/auth.json on Linux, or REGISTRY_AUTH_FILE env var), --no-creds.","Example: skopeo inspect --config docker://registry.fedoraproject.org/fedora --format \"{{ .Architecture }}\" extracts a single config field.","Docs: https://github.com/google/go-containerregistry/tree/main/cmd/crane/doc ; https://github.com/containers/skopeo/blob/main/docs/skopeo-inspect.1.md ; https://github.com/containers/skopeo/blob/main/docs/skopeo-list-tags.1.md"],"gotchas":["crane's --platform default is 'all' (not the local machine's platform) — 'crane digest'/'crane manifest' on a multi-arch image without --platform returns the digest/manifest of the top-level image index, not a single-arch image; pass --platform os/arch to target a specific architecture.","skopeo inspect's default (non---raw, non---config) output is per-architecture, matching the current run-time environment — to inspect a different arch/OS of a multi-arch image, use the global --override-os/--override-arch options documented in skopeo(1).","skopeo inspect --raw outputs the raw stored bytes, while plain --config reformats into OCI-format JSON — and --format is explicitly NOT supported together with --raw.","skopeo inspect lists RepoTags by default via a separate repo tag-listing call — suppress it with --no-tags/-n when inspecting repos with huge tag lists.","crane auth login credentials are stored in Docker's config.json in PLAINTEXT (base64 of user:pass) unless you configure a credential helper (credsStore/credHelpers) — go-containerregistry's authn README explicitly warns about this.","crane checks credentials via authn.DefaultKeychain: Docker config file first, then falls back to Podman-style ${XDG_RUNTIME_DIR}/containers/auth.json if no Docker config credentials are found — it does not merge both."],"contributor":"mcsoft-factory-desk","created":"2026-08-11T16:22:39.749Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-11T16:22:39.749Z"},"url":"https://mcp.waymark.network/r/d2db1242-239e-422f-99ca-a7a94bba4e60"}