image: add opt-in identity field to image list API for containerd backend by crazy-max · Pull Request #52030 · moby/moby

crazy-max · 2026-02-11T15:03:47Z

This PR extends image identity support to GET /images/json (docker image ls API path), building on the prior inspect work in #51737. For image list, identity is opt-in and manifest-scoped: when requested, identity is returned on Manifests[].ImageData.Identity (for locally available image manifests), not as a single image-level verdict. Identity is requested with identity=1 and requires manifests=1. The implementation reuses the shared inspect/list identity computation and cache path.

Listing images is the next natural API surface, but list operations are much more frequent and can include many images. Running full verification for every list by default would be too expensive.

The goals here are to expose identity on image list when explicitly requested and avoid repeated re-verification by reusing cache. But also mutualize inspect/list identity logic in one place and keep default list behavior unchanged unless opt-in is requested.

Testing:

$ docker image pull busybox
$ docker image pull moby/buildkit:latest

Default behavior (no identity):

$ curl -sk "https://localhost:12375/v1.54/images/json?all=1" | jq

JSON output

[
  {
    "Containers": 0,
    "Created": 1769684624,
    "Id": "sha256:1e110c71d389d6d24f67b9438e2f7b8da749a6ff407b22a1631e025c95599368",
    "Labels": {},
    "ParentId": "",
    "Descriptor": {
      "mediaType": "application/vnd.oci.image.index.v1+json",
      "digest": "sha256:1e110c71d389d6d24f67b9438e2f7b8da749a6ff407b22a1631e025c95599368",
      "size": 4654
    },
    "RepoDigests": [
      "moby/buildkit@sha256:1e110c71d389d6d24f67b9438e2f7b8da749a6ff407b22a1631e025c95599368"
    ],
    "RepoTags": [
      "moby/buildkit:latest"
    ],
    "SharedSize": -1,
    "Size": 344651113
  },
  {
    "Containers": 0,
    "Created": 1727386302,
    "Id": "sha256:b3255e7dfbcd10cb367af0d409747d511aeb66dfac98cf30e97e87e4207dd76f",
    "Labels": {},
    "ParentId": "",
    "Descriptor": {
      "mediaType": "application/vnd.oci.image.index.v1+json",
      "digest": "sha256:b3255e7dfbcd10cb367af0d409747d511aeb66dfac98cf30e97e87e4207dd76f",
      "size": 9535
    },
    "RepoDigests": [
      "busybox@sha256:b3255e7dfbcd10cb367af0d409747d511aeb66dfac98cf30e97e87e4207dd76f"
    ],
    "RepoTags": [
      "busybox:latest"
    ],
    "SharedSize": -1,
    "Size": 6774325
  }
]

Opt-in identity:

$ curl -sk "https://localhost:12375/v1.54/images/json?all=1&manifests=1&identity=1" | jq

JSON output

[
  {
    "Containers": 0,
    "Created": 1769684624,
    "Id": "sha256:1e110c71d389d6d24f67b9438e2f7b8da749a6ff407b22a1631e025c95599368",
    "Labels": {},
    "ParentId": "",
    "Descriptor": {
      "mediaType": "application/vnd.oci.image.index.v1+json",
      "digest": "sha256:1e110c71d389d6d24f67b9438e2f7b8da749a6ff407b22a1631e025c95599368",
      "size": 4654
    },
    "Manifests": [
      {
        "ID": "sha256:f5bf1331bda8069997e7d7d4f8977d6c0e5e6f12f770ec06015a34f8bc0f5428",
        "Descriptor": {
          "mediaType": "application/vnd.oci.image.manifest.v1+json",
          "digest": "sha256:f5bf1331bda8069997e7d7d4f8977d6c0e5e6f12f770ec06015a34f8bc0f5428",
          "size": 1885,
          "platform": {
            "architecture": "amd64",
            "os": "linux"
          }
        },
        "Available": true,
        "Size": {
          "Content": 106662530,
          "Total": 343173762
        },
        "Kind": "image",
        "ImageData": {
          "Platform": {
            "architecture": "amd64",
            "os": "linux"
          },
          "Identity": {
            "Signature": [
              {
                "Name": "Docker GitHub Builder Experimental (moby/[email protected])",
                "Timestamps": [
                  {
                    "Type": "Tlog",
                    "URI": "https://rekor.sigstore.dev",
                    "Timestamp": "2026-01-29T11:04:09Z"
                  },
                  {
                    "Type": "TimestampAuthority",
                    "URI": "https://timestamp.sigstore.dev/api/v1/timestamp",
                    "Timestamp": "2026-01-29T11:04:08Z"
                  }
                ],
                "Signer": {
                  "CertificateIssuer": "CN=sigstore-intermediate,O=sigstore.dev",
                  "SubjectAlternativeName": "https://github.com/docker/github-builder-experimental/.github/workflows/bake.yml@7643588149117bf0ca3a906caa3968c70484027a",
                  "Issuer": "https://token.actions.githubusercontent.com",
                  "BuildSignerURI": "https://github.com/docker/github-builder-experimental/.github/workflows/bake.yml@7643588149117bf0ca3a906caa3968c70484027a",
                  "BuildSignerDigest": "7643588149117bf0ca3a906caa3968c70484027a",
                  "RunnerEnvironment": "github-hosted",
                  "SourceRepositoryURI": "https://github.com/moby/buildkit",
                  "SourceRepositoryDigest": "5fbebf9d177edcc7af06c36c78728fdd357bf964",
                  "SourceRepositoryRef": "refs/tags/v0.27.1",
                  "SourceRepositoryIdentifier": "92969352",
                  "SourceRepositoryOwnerURI": "https://github.com/moby",
                  "SourceRepositoryOwnerIdentifier": "27259197",
                  "BuildConfigURI": "https://github.com/moby/buildkit/.github/workflows/buildkit.yml@refs/tags/v0.27.1",
                  "BuildConfigDigest": "5fbebf9d177edcc7af06c36c78728fdd357bf964",
                  "BuildTrigger": "push",
                  "RunInvocationURI": "https://github.com/moby/buildkit/actions/runs/21475065050/attempts/1",
                  "SourceRepositoryVisibilityAtSigning": "public"
                },
                "SignatureType": "bundle-v0.3"
              }
            ],
            "Pull": [
              {
                "Repository": "docker.io/moby/buildkit"
              }
            ]
          },
          "Size": {
            "Unpacked": 236511232
          },
          "Containers": null
        }
      },
      {
        "ID": "sha256:60cdc2c47022ab8ac6df002cbfc427a55b4c4b2ad2e17e59b1f57dbd6e33996e",
        "Descriptor": {
          "mediaType": "application/vnd.oci.image.manifest.v1+json",
          "digest": "sha256:60cdc2c47022ab8ac6df002cbfc427a55b4c4b2ad2e17e59b1f57dbd6e33996e",
          "size": 1384,
          "annotations": {
            "vnd.docker.reference.digest": "sha256:f5bf1331bda8069997e7d7d4f8977d6c0e5e6f12f770ec06015a34f8bc0f5428",
            "vnd.docker.reference.type": "attestation-manifest"
          },
          "platform": {
            "architecture": "unknown",
            "os": "unknown"
          }
        },
        "Available": true,
        "Size": {
          "Content": 1477351,
          "Total": 1477351
        },
        "Kind": "attestation",
        "AttestationData": {
          "For": "sha256:f5bf1331bda8069997e7d7d4f8977d6c0e5e6f12f770ec06015a34f8bc0f5428"
        }
      },
      {
        "ID": "sha256:7a9e2a8abc3428a555ade8db975f899241d4f5d242fb5599dedd4a0f97e8fc04",
        "Descriptor": {
          "mediaType": "application/vnd.oci.image.manifest.v1+json",
          "digest": "sha256:7a9e2a8abc3428a555ade8db975f899241d4f5d242fb5599dedd4a0f97e8fc04",
          "size": 1885,
          "platform": {
            "architecture": "arm64",
            "os": "linux"
          }
        },
        "Available": false,
        "Size": {
          "Content": 0,
          "Total": 0
        },
        "Kind": "image",
        "ImageData": {
          "Platform": {
            "architecture": "arm64",
            "os": "linux"
          },
          "Size": {
            "Unpacked": 0
          },
          "Containers": null
        }
      },
      {
        "ID": "sha256:00c6cb41371baf0a8da83c3af1866c8f1711c98a2119c46e8762caf60856d14a",
        "Descriptor": {
          "mediaType": "application/vnd.oci.image.manifest.v1+json",
          "digest": "sha256:00c6cb41371baf0a8da83c3af1866c8f1711c98a2119c46e8762caf60856d14a",
          "size": 1384,
          "annotations": {
            "vnd.docker.reference.digest": "sha256:7a9e2a8abc3428a555ade8db975f899241d4f5d242fb5599dedd4a0f97e8fc04",
            "vnd.docker.reference.type": "attestation-manifest"
          },
          "platform": {
            "architecture": "unknown",
            "os": "unknown"
          }
        },
        "Available": false,
        "Size": {
          "Content": 0,
          "Total": 0
        },
        "Kind": "attestation",
        "AttestationData": {
          "For": "sha256:7a9e2a8abc3428a555ade8db975f899241d4f5d242fb5599dedd4a0f97e8fc04"
        }
      },
      {
        "ID": "sha256:100572864af4134d51d0c7837aa1d8f7079ea9b3e27d02ccbef7935b48a09103",
        "Descriptor": {
          "mediaType": "application/vnd.oci.image.manifest.v1+json",
          "digest": "sha256:100572864af4134d51d0c7837aa1d8f7079ea9b3e27d02ccbef7935b48a09103",
          "size": 1885,
          "platform": {
            "architecture": "ppc64le",
            "os": "linux"
          }
        },
        "Available": false,
        "Size": {
          "Content": 0,
          "Total": 0
        },
        "Kind": "image",
        "ImageData": {
          "Platform": {
            "architecture": "ppc64le",
            "os": "linux"
          },
          "Size": {
            "Unpacked": 0
          },
          "Containers": null
        }
      },
      {
        "ID": "sha256:47aa137c0989b59d052cb302eb6cc3d31834e358cd51b02817f87f69dd0bae29",
        "Descriptor": {
          "mediaType": "application/vnd.oci.image.manifest.v1+json",
          "digest": "sha256:47aa137c0989b59d052cb302eb6cc3d31834e358cd51b02817f87f69dd0bae29",
          "size": 1384,
          "annotations": {
            "vnd.docker.reference.digest": "sha256:100572864af4134d51d0c7837aa1d8f7079ea9b3e27d02ccbef7935b48a09103",
            "vnd.docker.reference.type": "attestation-manifest"
          },
          "platform": {
            "architecture": "unknown",
            "os": "unknown"
          }
        },
        "Available": false,
        "Size": {
          "Content": 0,
          "Total": 0
        },
        "Kind": "attestation",
        "AttestationData": {
          "For": "sha256:100572864af4134d51d0c7837aa1d8f7079ea9b3e27d02ccbef7935b48a09103"
        }
      },
      {
        "ID": "sha256:598953ef120bfa7d0719e030e17bc5ba024a70c14c94049329b4e96f68a44a3b",
        "Descriptor": {
          "mediaType": "application/vnd.oci.image.manifest.v1+json",
          "digest": "sha256:598953ef120bfa7d0719e030e17bc5ba024a70c14c94049329b4e96f68a44a3b",
          "size": 1885,
          "platform": {
            "architecture": "riscv64",
            "os": "linux"
          }
        },
        "Available": false,
        "Size": {
          "Content": 0,
          "Total": 0
        },
        "Kind": "image",
        "ImageData": {
          "Platform": {
            "architecture": "riscv64",
            "os": "linux"
          },
          "Size": {
            "Unpacked": 0
          },
          "Containers": null
        }
      },
      {
        "ID": "sha256:75530b99ff63f171ba46c1b17cb741d1e9ddbb3b7fcf6eb5dcb3dd9b9aef4908",
        "Descriptor": {
          "mediaType": "application/vnd.oci.image.manifest.v1+json",
          "digest": "sha256:75530b99ff63f171ba46c1b17cb741d1e9ddbb3b7fcf6eb5dcb3dd9b9aef4908",
          "size": 1384,
          "annotations": {
            "vnd.docker.reference.digest": "sha256:598953ef120bfa7d0719e030e17bc5ba024a70c14c94049329b4e96f68a44a3b",
            "vnd.docker.reference.type": "attestation-manifest"
          },
          "platform": {
            "architecture": "unknown",
            "os": "unknown"
          }
        },
        "Available": false,
        "Size": {
          "Content": 0,
          "Total": 0
        },
        "Kind": "attestation",
        "AttestationData": {
          "For": "sha256:598953ef120bfa7d0719e030e17bc5ba024a70c14c94049329b4e96f68a44a3b"
        }
      },
      {
        "ID": "sha256:7985ce1de8899f5727d3d483e19b1794446f6dc51be106d24bcf1caba6a3bece",
        "Descriptor": {
          "mediaType": "application/vnd.oci.image.manifest.v1+json",
          "digest": "sha256:7985ce1de8899f5727d3d483e19b1794446f6dc51be106d24bcf1caba6a3bece",
          "size": 1885,
          "platform": {
            "architecture": "s390x",
            "os": "linux"
          }
        },
        "Available": false,
        "Size": {
          "Content": 0,
          "Total": 0
        },
        "Kind": "image",
        "ImageData": {
          "Platform": {
            "architecture": "s390x",
            "os": "linux"
          },
          "Size": {
            "Unpacked": 0
          },
          "Containers": null
        }
      },
      {
        "ID": "sha256:86834bac34c93b0c31974404cf5614566cd4fc6a98ea622bd44300400e752eee",
        "Descriptor": {
          "mediaType": "application/vnd.oci.image.manifest.v1+json",
          "digest": "sha256:86834bac34c93b0c31974404cf5614566cd4fc6a98ea622bd44300400e752eee",
          "size": 1384,
          "annotations": {
            "vnd.docker.reference.digest": "sha256:7985ce1de8899f5727d3d483e19b1794446f6dc51be106d24bcf1caba6a3bece",
            "vnd.docker.reference.type": "attestation-manifest"
          },
          "platform": {
            "architecture": "unknown",
            "os": "unknown"
          }
        },
        "Available": false,
        "Size": {
          "Content": 0,
          "Total": 0
        },
        "Kind": "attestation",
        "AttestationData": {
          "For": "sha256:7985ce1de8899f5727d3d483e19b1794446f6dc51be106d24bcf1caba6a3bece"
        }
      },
      {
        "ID": "sha256:d5ff0f224469a641a2b467f32b4400aca2c4d06e4edf311eac35e4112e4b7553",
        "Descriptor": {
          "mediaType": "application/vnd.oci.image.manifest.v1+json",
          "digest": "sha256:d5ff0f224469a641a2b467f32b4400aca2c4d06e4edf311eac35e4112e4b7553",
          "size": 1884,
          "platform": {
            "architecture": "arm",
            "os": "linux",
            "variant": "v7"
          }
        },
        "Available": false,
        "Size": {
          "Content": 0,
          "Total": 0
        },
        "Kind": "image",
        "ImageData": {
          "Platform": {
            "architecture": "arm",
            "os": "linux",
            "variant": "v7"
          },
          "Size": {
            "Unpacked": 0
          },
          "Containers": null
        }
      },
      {
        "ID": "sha256:1662e1ad2943ef140b2e12a819a74a1e296e3d42961618343adae88c89b40d4a",
        "Descriptor": {
          "mediaType": "application/vnd.oci.image.manifest.v1+json",
          "digest": "sha256:1662e1ad2943ef140b2e12a819a74a1e296e3d42961618343adae88c89b40d4a",
          "size": 1384,
          "annotations": {
            "vnd.docker.reference.digest": "sha256:d5ff0f224469a641a2b467f32b4400aca2c4d06e4edf311eac35e4112e4b7553",
            "vnd.docker.reference.type": "attestation-manifest"
          },
          "platform": {
            "architecture": "unknown",
            "os": "unknown"
          }
        },
        "Available": false,
        "Size": {
          "Content": 0,
          "Total": 0
        },
        "Kind": "attestation",
        "AttestationData": {
          "For": "sha256:d5ff0f224469a641a2b467f32b4400aca2c4d06e4edf311eac35e4112e4b7553"
        }
      }
    ],
    "RepoDigests": [
      "moby/buildkit@sha256:1e110c71d389d6d24f67b9438e2f7b8da749a6ff407b22a1631e025c95599368"
    ],
    "RepoTags": [
      "moby/buildkit:latest"
    ],
    "SharedSize": -1,
    "Size": 344651113
  },
  {
    "Containers": 0,
    "Created": 1727386302,
    "Id": "sha256:b3255e7dfbcd10cb367af0d409747d511aeb66dfac98cf30e97e87e4207dd76f",
    "Labels": {},
    "ParentId": "",
    "Descriptor": {
      "mediaType": "application/vnd.oci.image.index.v1+json",
      "digest": "sha256:b3255e7dfbcd10cb367af0d409747d511aeb66dfac98cf30e97e87e4207dd76f",
      "size": 9535
    },
    "Manifests": [
      {
        "ID": "sha256:70ce0a747f09cd7c09c2d6eaeab69d60adb0398f569296e8c0e844599388ebd6",
        "Descriptor": {
          "mediaType": "application/vnd.oci.image.manifest.v1+json",
          "digest": "sha256:70ce0a747f09cd7c09c2d6eaeab69d60adb0398f569296e8c0e844599388ebd6",
          "size": 610,
          "annotations": {
            "com.docker.official-images.bashbrew.arch": "amd64",
            "org.opencontainers.image.base.name": "scratch",
            "org.opencontainers.image.created": "2026-01-05T17:31:19Z",
            "org.opencontainers.image.revision": "cf5073498e5dd419f77f0a6af431fcec847de048",
            "org.opencontainers.image.source": "https://github.com/docker-library/busybox.git",
            "org.opencontainers.image.url": "https://hub.docker.com/_/busybox",
            "org.opencontainers.image.version": "1.37.0-glibc"
          },
          "platform": {
            "architecture": "amd64",
            "os": "linux"
          }
        },
        "Available": true,
        "Size": {
          "Content": 2212725,
          "Total": 6771573
        },
        "Kind": "image",
        "ImageData": {
          "Platform": {
            "architecture": "amd64",
            "os": "linux"
          },
          "Identity": {
            "Pull": [
              {
                "Repository": "docker.io/library/busybox"
              }
            ]
          },
          "Size": {
            "Unpacked": 4558848
          },
          "Containers": null
        }
      },
      {
        "ID": "sha256:afa90197716ae01be9facc62cdd0d029caaacd89d7aceea84b828817f7251b94",
        "Descriptor": {
          "mediaType": "application/vnd.oci.image.manifest.v1+json",
          "digest": "sha256:afa90197716ae01be9facc62cdd0d029caaacd89d7aceea84b828817f7251b94",
          "size": 559,
          "annotations": {
            "com.docker.official-images.bashbrew.arch": "amd64",
            "vnd.docker.reference.digest": "sha256:70ce0a747f09cd7c09c2d6eaeab69d60adb0398f569296e8c0e844599388ebd6",
            "vnd.docker.reference.type": "attestation-manifest"
          },
          "platform": {
            "architecture": "unknown",
            "os": "unknown"
          }
        },
        "Available": true,
        "Size": {
          "Content": 2752,
          "Total": 2752
        },
        "Kind": "attestation",
        "AttestationData": {
          "For": "sha256:70ce0a747f09cd7c09c2d6eaeab69d60adb0398f569296e8c0e844599388ebd6"
        }
      },
      {
        "ID": "sha256:a8f87a9308d2019066be00520f7704dda3f6255e75902fa70e29ff5801cceadc",
        "Descriptor": {
          "mediaType": "application/vnd.oci.image.manifest.v1+json",
          "digest": "sha256:a8f87a9308d2019066be00520f7704dda3f6255e75902fa70e29ff5801cceadc",
          "size": 610,
          "annotations": {
            "com.docker.official-images.bashbrew.arch": "arm32v5",
            "org.opencontainers.image.base.name": "scratch",
            "org.opencontainers.image.created": "2026-01-05T17:31:19Z",
            "org.opencontainers.image.revision": "36426ad7ac2f3d5c807cef900d8dbee0e29ba477",
            "org.opencontainers.image.source": "https://github.com/docker-library/busybox.git",
            "org.opencontainers.image.url": "https://hub.docker.com/_/busybox",
            "org.opencontainers.image.version": "1.37.0-glibc"
          },
          "platform": {
            "architecture": "arm",
            "os": "linux",
            "variant": "v5"
          }
        },
        "Available": false,
        "Size": {
          "Content": 0,
          "Total": 0
        },
        "Kind": "image",
        "ImageData": {
          "Platform": {
            "architecture": "arm",
            "os": "linux",
            "variant": "v5"
          },
          "Size": {
            "Unpacked": 0
          },
          "Containers": null
        }
      },
      {
        "ID": "sha256:df563415b6109aa0da73993952cdd8e2b1d7cd821f553f844f9c690fdca20329",
        "Descriptor": {
          "mediaType": "application/vnd.oci.image.manifest.v1+json",
          "digest": "sha256:df563415b6109aa0da73993952cdd8e2b1d7cd821f553f844f9c690fdca20329",
          "size": 559,
          "annotations": {
            "com.docker.official-images.bashbrew.arch": "arm32v5",
            "vnd.docker.reference.digest": "sha256:a8f87a9308d2019066be00520f7704dda3f6255e75902fa70e29ff5801cceadc",
            "vnd.docker.reference.type": "attestation-manifest"
          },
          "platform": {
            "architecture": "unknown",
            "os": "unknown"
          }
        },
        "Available": false,
        "Size": {
          "Content": 0,
          "Total": 0
        },
        "Kind": "attestation",
        "AttestationData": {
          "For": "sha256:a8f87a9308d2019066be00520f7704dda3f6255e75902fa70e29ff5801cceadc"
        }
      },
      {
        "ID": "sha256:d1ba3375824b1e605503225e2f42280aea16d388fb2e400b9fe7c4d93b9e8d42",
        "Descriptor": {
          "mediaType": "application/vnd.oci.image.manifest.v1+json",
          "digest": "sha256:d1ba3375824b1e605503225e2f42280aea16d388fb2e400b9fe7c4d93b9e8d42",
          "size": 608,
          "annotations": {
            "com.docker.official-images.bashbrew.arch": "arm32v6",
            "org.opencontainers.image.base.name": "scratch",
            "org.opencontainers.image.created": "2026-01-22T18:01:52Z",
            "org.opencontainers.image.revision": "e4def65e99453b20d5cb5a90b2029fe38825c3e3",
            "org.opencontainers.image.source": "https://github.com/docker-library/busybox.git",
            "org.opencontainers.image.url": "https://hub.docker.com/_/busybox",
            "org.opencontainers.image.version": "1.37.0-musl"
          },
          "platform": {
            "architecture": "arm",
            "os": "linux",
            "variant": "v6"
          }
        },
        "Available": false,
        "Size": {
          "Content": 0,
          "Total": 0
        },
        "Kind": "image",
        "ImageData": {
          "Platform": {
            "architecture": "arm",
            "os": "linux",
            "variant": "v6"
          },
          "Size": {
            "Unpacked": 0
          },
          "Containers": null
        }
      },
      {
        "ID": "sha256:9068648d425cdab0144ced6b2f6671d56856dd48c5dfd65349545f7e3b972743",
        "Descriptor": {
          "mediaType": "application/vnd.oci.image.manifest.v1+json",
          "digest": "sha256:9068648d425cdab0144ced6b2f6671d56856dd48c5dfd65349545f7e3b972743",
          "size": 610,
          "annotations": {
            "com.docker.official-images.bashbrew.arch": "arm32v7",
            "org.opencontainers.image.base.name": "scratch",
            "org.opencontainers.image.created": "2026-01-05T17:31:19Z",
            "org.opencontainers.image.revision": "e36bb53e58b98ea14b6974c374f7a25c45215c72",
            "org.opencontainers.image.source": "https://github.com/docker-library/busybox.git",
            "org.opencontainers.image.url": "https://hub.docker.com/_/busybox",
            "org.opencontainers.image.version": "1.37.0-glibc"
          },
          "platform": {
            "architecture": "arm",
            "os": "linux",
            "variant": "v7"
          }
        },
        "Available": false,
        "Size": {
          "Content": 0,
          "Total": 0
        },
        "Kind": "image",
        "ImageData": {
          "Platform": {
            "architecture": "arm",
            "os": "linux",
            "variant": "v7"
          },
          "Size": {
            "Unpacked": 0
          },
          "Containers": null
        }
      },
      {
        "ID": "sha256:1247378d9e4c733a8bda3b5c22b9626446d3449342c67684ad2b5e8af75dfc09",
        "Descriptor": {
          "mediaType": "application/vnd.oci.image.manifest.v1+json",
          "digest": "sha256:1247378d9e4c733a8bda3b5c22b9626446d3449342c67684ad2b5e8af75dfc09",
          "size": 559,
          "annotations": {
            "com.docker.official-images.bashbrew.arch": "arm32v7",
            "vnd.docker.reference.digest": "sha256:9068648d425cdab0144ced6b2f6671d56856dd48c5dfd65349545f7e3b972743",
            "vnd.docker.reference.type": "attestation-manifest"
          },
          "platform": {
            "architecture": "unknown",
            "os": "unknown"
          }
        },
        "Available": false,
        "Size": {
          "Content": 0,
          "Total": 0
        },
        "Kind": "attestation",
        "AttestationData": {
          "For": "sha256:9068648d425cdab0144ced6b2f6671d56856dd48c5dfd65349545f7e3b972743"
        }
      },
      {
        "ID": "sha256:bf9536d50cebf4337eb4a802e4786f25a9068665385d82a780d210316b818cf8",
        "Descriptor": {
          "mediaType": "application/vnd.oci.image.manifest.v1+json",
          "digest": "sha256:bf9536d50cebf4337eb4a802e4786f25a9068665385d82a780d210316b818cf8",
          "size": 610,
          "annotations": {
            "com.docker.official-images.bashbrew.arch": "arm64v8",
            "org.opencontainers.image.base.name": "scratch",
            "org.opencontainers.image.created": "2026-01-05T17:31:19Z",
            "org.opencontainers.image.revision": "f9967ecdd4c9957e38cac7a1327949b262c593b7",
            "org.opencontainers.image.source": "https://github.com/docker-library/busybox.git",
            "org.opencontainers.image.url": "https://hub.docker.com/_/busybox",
            "org.opencontainers.image.version": "1.37.0-glibc"
          },
          "platform": {
            "architecture": "arm64",
            "os": "linux",
            "variant": "v8"
          }
        },
        "Available": false,
        "Size": {
          "Content": 0,
          "Total": 0
        },
        "Kind": "image",
        "ImageData": {
          "Platform": {
            "architecture": "arm64",
            "os": "linux",
            "variant": "v8"
          },
          "Size": {
            "Unpacked": 0
          },
          "Containers": null
        }
      },
      {
        "ID": "sha256:6496ba7cedf7ded74d50a58ef76c601b2bedbe7426b5eea9307946b2c85704fd",
        "Descriptor": {
          "mediaType": "application/vnd.oci.image.manifest.v1+json",
          "digest": "sha256:6496ba7cedf7ded74d50a58ef76c601b2bedbe7426b5eea9307946b2c85704fd",
          "size": 559,
          "annotations": {
            "com.docker.official-images.bashbrew.arch": "arm64v8",
            "vnd.docker.reference.digest": "sha256:bf9536d50cebf4337eb4a802e4786f25a9068665385d82a780d210316b818cf8",
            "vnd.docker.reference.type": "attestation-manifest"
          },
          "platform": {
            "architecture": "unknown",
            "os": "unknown"
          }
        },
        "Available": false,
        "Size": {
          "Content": 0,
          "Total": 0
        },
        "Kind": "attestation",
        "AttestationData": {
          "For": "sha256:bf9536d50cebf4337eb4a802e4786f25a9068665385d82a780d210316b818cf8"
        }
      },
      {
        "ID": "sha256:4630ec42856ce4bb9e3c3c28974b2e5352e5ddb83f30f6dff593af6bd61a04fc",
        "Descriptor": {
          "mediaType": "application/vnd.oci.image.manifest.v1+json",
          "digest": "sha256:4630ec42856ce4bb9e3c3c28974b2e5352e5ddb83f30f6dff593af6bd61a04fc",
          "size": 610,
          "annotations": {
            "com.docker.official-images.bashbrew.arch": "i386",
            "org.opencontainers.image.base.name": "scratch",
            "org.opencontainers.image.created": "2026-01-05T17:31:19Z",
            "org.opencontainers.image.revision": "81727bf17c1db6d3bf38dd853028cad04380c1d7",
            "org.opencontainers.image.source": "https://github.com/docker-library/busybox.git",
            "org.opencontainers.image.url": "https://hub.docker.com/_/busybox",
            "org.opencontainers.image.version": "1.37.0-glibc"
          },
          "platform": {
            "architecture": "386",
            "os": "linux"
          }
        },
        "Available": false,
        "Size": {
          "Content": 0,
          "Total": 0
        },
        "Kind": "image",
        "ImageData": {
          "Platform": {
            "architecture": "386",
            "os": "linux"
          },
          "Size": {
            "Unpacked": 0
          },
          "Containers": null
        }
      },
      {
        "ID": "sha256:39f40e786c548e737ca4dcbd54bc7aa5523b4c3cfba55f992fc48173cb1bf604",
        "Descriptor": {
          "mediaType": "application/vnd.oci.image.manifest.v1+json",
          "digest": "sha256:39f40e786c548e737ca4dcbd54bc7aa5523b4c3cfba55f992fc48173cb1bf604",
          "size": 559,
          "annotations": {
            "com.docker.official-images.bashbrew.arch": "i386",
            "vnd.docker.reference.digest": "sha256:4630ec42856ce4bb9e3c3c28974b2e5352e5ddb83f30f6dff593af6bd61a04fc",
            "vnd.docker.reference.type": "attestation-manifest"
          },
          "platform": {
            "architecture": "unknown",
            "os": "unknown"
          }
        },
        "Available": false,
        "Size": {
          "Content": 0,
          "Total": 0
        },
        "Kind": "attestation",
        "AttestationData": {
          "For": "sha256:4630ec42856ce4bb9e3c3c28974b2e5352e5ddb83f30f6dff593af6bd61a04fc"
        }
      },
      {
        "ID": "sha256:41f9ea4595f1e281d876d5552fddeebe7aae73227d87ff36cce6cf2d8a4dfd76",
        "Descriptor": {
          "mediaType": "application/vnd.oci.image.manifest.v1+json",
          "digest": "sha256:41f9ea4595f1e281d876d5552fddeebe7aae73227d87ff36cce6cf2d8a4dfd76",
          "size": 610,
          "annotations": {
            "com.docker.official-images.bashbrew.arch": "ppc64le",
            "org.opencontainers.image.base.name": "scratch",
            "org.opencontainers.image.created": "2026-01-05T17:31:19Z",
            "org.opencontainers.image.revision": "782c2e1ec06596179dcfaeb54c5b98dae706b398",
            "org.opencontainers.image.source": "https://github.com/docker-library/busybox.git",
            "org.opencontainers.image.url": "https://hub.docker.com/_/busybox",
            "org.opencontainers.image.version": "1.37.0-glibc"
          },
          "platform": {
            "architecture": "ppc64le",
            "os": "linux"
          }
        },
        "Available": false,
        "Size": {
          "Content": 0,
          "Total": 0
        },
        "Kind": "image",
        "ImageData": {
          "Platform": {
            "architecture": "ppc64le",
            "os": "linux"
          },
          "Size": {
            "Unpacked": 0
          },
          "Containers": null
        }
      },
      {
        "ID": "sha256:a130874970495456eab6247439ce281394112d623b706cf2c2a435c54b515041",
        "Descriptor": {
          "mediaType": "application/vnd.oci.image.manifest.v1+json",
          "digest": "sha256:a130874970495456eab6247439ce281394112d623b706cf2c2a435c54b515041",
          "size": 559,
          "annotations": {
            "com.docker.official-images.bashbrew.arch": "ppc64le",
            "vnd.docker.reference.digest": "sha256:41f9ea4595f1e281d876d5552fddeebe7aae73227d87ff36cce6cf2d8a4dfd76",
            "vnd.docker.reference.type": "attestation-manifest"
          },
          "platform": {
            "architecture": "unknown",
            "os": "unknown"
          }
        },
        "Available": false,
        "Size": {
          "Content": 0,
          "Total": 0
        },
        "Kind": "attestation",
        "AttestationData": {
          "For": "sha256:41f9ea4595f1e281d876d5552fddeebe7aae73227d87ff36cce6cf2d8a4dfd76"
        }
      },
      {
        "ID": "sha256:1d91cf227b86953df96c0407e45cb6bae3b54c8483f1a9d4e8da66b3150afe2a",
        "Descriptor": {
          "mediaType": "application/vnd.oci.image.manifest.v1+json",
          "digest": "sha256:1d91cf227b86953df96c0407e45cb6bae3b54c8483f1a9d4e8da66b3150afe2a",
          "size": 610,
          "annotations": {
            "com.docker.official-images.bashbrew.arch": "riscv64",
            "org.opencontainers.image.base.name": "scratch",
            "org.opencontainers.image.created": "2026-01-05T17:31:19Z",
            "org.opencontainers.image.revision": "7075be67a8b05f6d4fd03c0662f7653ebcdd8dd6",
            "org.opencontainers.image.source": "https://github.com/docker-library/busybox.git",
            "org.opencontainers.image.url": "https://hub.docker.com/_/busybox",
            "org.opencontainers.image.version": "1.37.0-glibc"
          },
          "platform": {
            "architecture": "riscv64",
            "os": "linux"
          }
        },
        "Available": false,
        "Size": {
          "Content": 0,
          "Total": 0
        },
        "Kind": "image",
        "ImageData": {
          "Platform": {
            "architecture": "riscv64",
            "os": "linux"
          },
          "Size": {
            "Unpacked": 0
          },
          "Containers": null
        }
      },
      {
        "ID": "sha256:46786dc99f64b9c92dbe24bc4de3d6c081c2bd5c04e3a4a47876376a02527324",
        "Descriptor": {
          "mediaType": "application/vnd.oci.image.manifest.v1+json",
          "digest": "sha256:46786dc99f64b9c92dbe24bc4de3d6c081c2bd5c04e3a4a47876376a02527324",
          "size": 559,
          "annotations": {
            "com.docker.official-images.bashbrew.arch": "riscv64",
            "vnd.docker.reference.digest": "sha256:1d91cf227b86953df96c0407e45cb6bae3b54c8483f1a9d4e8da66b3150afe2a",
            "vnd.docker.reference.type": "attestation-manifest"
          },
          "platform": {
            "architecture": "unknown",
            "os": "unknown"
          }
        },
        "Available": false,
        "Size": {
          "Content": 0,
          "Total": 0
        },
        "Kind": "attestation",
        "AttestationData": {
          "For": "sha256:1d91cf227b86953df96c0407e45cb6bae3b54c8483f1a9d4e8da66b3150afe2a"
        }
      },
      {
        "ID": "sha256:ec7f86785d9baa161eb74285aabd5d98a388d7ea9c7ab9d31bb1d653ab55f974",
        "Descriptor": {
          "mediaType": "application/vnd.oci.image.manifest.v1+json",
          "digest": "sha256:ec7f86785d9baa161eb74285aabd5d98a388d7ea9c7ab9d31bb1d653ab55f974",
          "size": 610,
          "annotations": {
            "com.docker.official-images.bashbrew.arch": "s390x",
            "org.opencontainers.image.base.name": "scratch",
            "org.opencontainers.image.created": "2026-01-05T17:31:19Z",
            "org.opencontainers.image.revision": "12a7475c2080084ba5091bddfe227a896859ef41",
            "org.opencontainers.image.source": "https://github.com/docker-library/busybox.git",
            "org.opencontainers.image.url": "https://hub.docker.com/_/busybox",
            "org.opencontainers.image.version": "1.37.0-glibc"
          },
          "platform": {
            "architecture": "s390x",
            "os": "linux"
          }
        },
        "Available": false,
        "Size": {
          "Content": 0,
          "Total": 0
        },
        "Kind": "image",
        "ImageData": {
          "Platform": {
            "architecture": "s390x",
            "os": "linux"
          },
          "Size": {
            "Unpacked": 0
          },
          "Containers": null
        }
      },
      {
        "ID": "sha256:feeeebd21329b236e67d2d717b9087ddaf4b19a970352dd297694463cf619653",
        "Descriptor": {
          "mediaType": "application/vnd.oci.image.manifest.v1+json",
          "digest": "sha256:feeeebd21329b236e67d2d717b9087ddaf4b19a970352dd297694463cf619653",
          "size": 559,
          "annotations": {
            "com.docker.official-images.bashbrew.arch": "s390x",
            "vnd.docker.reference.digest": "sha256:ec7f86785d9baa161eb74285aabd5d98a388d7ea9c7ab9d31bb1d653ab55f974",
            "vnd.docker.reference.type": "attestation-manifest"
          },
          "platform": {
            "architecture": "unknown",
            "os": "unknown"
          }
        },
        "Available": false,
        "Size": {
          "Content": 0,
          "Total": 0
        },
        "Kind": "attestation",
        "AttestationData": {
          "For": "sha256:ec7f86785d9baa161eb74285aabd5d98a388d7ea9c7ab9d31bb1d653ab55f974"
        }
      }
    ],
    "RepoDigests": [
      "busybox@sha256:b3255e7dfbcd10cb367af0d409747d511aeb66dfac98cf30e97e87e4207dd76f"
    ],
    "RepoTags": [
      "busybox:latest"
    ],
    "SharedSize": -1,
    "Size": 6774325
  }
]

When pulling multiple platforms, identity is retrieved for them:

$ docker image pull --platform=linux/amd64 moby/buildkit:latest
$ docker image pull --platform=linux/arm64 moby/buildkit:latest
$ curl -sk "https://localhost:12375/v1.54/images/json?all=1&manifests=1&identity=1" | jq

JSON output

[
  {
    "Containers": 0,
    "Created": 1769684624,
    "Id": "sha256:1e110c71d389d6d24f67b9438e2f7b8da749a6ff407b22a1631e025c95599368",
    "Labels": {},
    "ParentId": "",
    "Descriptor": {
      "mediaType": "application/vnd.oci.image.index.v1+json",
      "digest": "sha256:1e110c71d389d6d24f67b9438e2f7b8da749a6ff407b22a1631e025c95599368",
      "size": 4654
    },
    "Manifests": [
      {
        "ID": "sha256:f5bf1331bda8069997e7d7d4f8977d6c0e5e6f12f770ec06015a34f8bc0f5428",
        "Descriptor": {
          "mediaType": "application/vnd.oci.image.manifest.v1+json",
          "digest": "sha256:f5bf1331bda8069997e7d7d4f8977d6c0e5e6f12f770ec06015a34f8bc0f5428",
          "size": 1885,
          "platform": {
            "architecture": "amd64",
            "os": "linux"
          }
        },
        "Available": true,
        "Size": {
          "Content": 106662530,
          "Total": 343173762
        },
        "Kind": "image",
        "ImageData": {
          "Platform": {
            "architecture": "amd64",
            "os": "linux"
          },
          "Identity": {
            "Signature": [
              {
                "Name": "Docker GitHub Builder Experimental (moby/[email protected])",
                "Timestamps": [
                  {
                    "Type": "Tlog",
                    "URI": "https://rekor.sigstore.dev",
                    "Timestamp": "2026-01-29T11:04:09Z"
                  },
                  {
                    "Type": "TimestampAuthority",
                    "URI": "https://timestamp.sigstore.dev/api/v1/timestamp",
                    "Timestamp": "2026-01-29T11:04:08Z"
                  }
                ],
                "Signer": {
                  "CertificateIssuer": "CN=sigstore-intermediate,O=sigstore.dev",
                  "SubjectAlternativeName": "https://github.com/docker/github-builder-experimental/.github/workflows/bake.yml@7643588149117bf0ca3a906caa3968c70484027a",
                  "Issuer": "https://token.actions.githubusercontent.com",
                  "BuildSignerURI": "https://github.com/docker/github-builder-experimental/.github/workflows/bake.yml@7643588149117bf0ca3a906caa3968c70484027a",
                  "BuildSignerDigest": "7643588149117bf0ca3a906caa3968c70484027a",
                  "RunnerEnvironment": "github-hosted",
                  "SourceRepositoryURI": "https://github.com/moby/buildkit",
                  "SourceRepositoryDigest": "5fbebf9d177edcc7af06c36c78728fdd357bf964",
                  "SourceRepositoryRef": "refs/tags/v0.27.1",
                  "SourceRepositoryIdentifier": "92969352",
                  "SourceRepositoryOwnerURI": "https://github.com/moby",
                  "SourceRepositoryOwnerIdentifier": "27259197",
                  "BuildConfigURI": "https://github.com/moby/buildkit/.github/workflows/buildkit.yml@refs/tags/v0.27.1",
                  "BuildConfigDigest": "5fbebf9d177edcc7af06c36c78728fdd357bf964",
                  "BuildTrigger": "push",
                  "RunInvocationURI": "https://github.com/moby/buildkit/actions/runs/21475065050/attempts/1",
                  "SourceRepositoryVisibilityAtSigning": "public"
                },
                "SignatureType": "bundle-v0.3"
              }
            ],
            "Pull": [
              {
                "Repository": "docker.io/moby/buildkit"
              }
            ]
          },
          "Size": {
            "Unpacked": 236511232
          },
          "Containers": null
        }
      },
      {
        "ID": "sha256:60cdc2c47022ab8ac6df002cbfc427a55b4c4b2ad2e17e59b1f57dbd6e33996e",
        "Descriptor": {
          "mediaType": "application/vnd.oci.image.manifest.v1+json",
          "digest": "sha256:60cdc2c47022ab8ac6df002cbfc427a55b4c4b2ad2e17e59b1f57dbd6e33996e",
          "size": 1384,
          "annotations": {
            "vnd.docker.reference.digest": "sha256:f5bf1331bda8069997e7d7d4f8977d6c0e5e6f12f770ec06015a34f8bc0f5428",
            "vnd.docker.reference.type": "attestation-manifest"
          },
          "platform": {
            "architecture": "unknown",
            "os": "unknown"
          }
        },
        "Available": true,
        "Size": {
          "Content": 1477351,
          "Total": 1477351
        },
        "Kind": "attestation",
        "AttestationData": {
          "For": "sha256:f5bf1331bda8069997e7d7d4f8977d6c0e5e6f12f770ec06015a34f8bc0f5428"
        }
      },
      {
        "ID": "sha256:7a9e2a8abc3428a555ade8db975f899241d4f5d242fb5599dedd4a0f97e8fc04",
        "Descriptor": {
          "mediaType": "application/vnd.oci.image.manifest.v1+json",
          "digest": "sha256:7a9e2a8abc3428a555ade8db975f899241d4f5d242fb5599dedd4a0f97e8fc04",
          "size": 1885,
          "platform": {
            "architecture": "arm64",
            "os": "linux"
          }
        },
        "Available": true,
        "Size": {
          "Content": 100729803,
          "Total": 333648843
        },
        "Kind": "image",
        "ImageData": {
          "Platform": {
            "architecture": "arm64",
            "os": "linux"
          },
          "Identity": {
            "Signature": [
              {
                "Name": "Docker GitHub Builder Experimental (moby/[email protected])",
                "Timestamps": [
                  {
                    "Type": "Tlog",
                    "URI": "https://rekor.sigstore.dev",
                    "Timestamp": "2026-01-29T11:04:10Z"
                  },
                  {
                    "Type": "TimestampAuthority",
                    "URI": "https://timestamp.sigstore.dev/api/v1/timestamp",
                    "Timestamp": "2026-01-29T11:04:10Z"
                  }
                ],
                "Signer": {
                  "CertificateIssuer": "CN=sigstore-intermediate,O=sigstore.dev",
                  "SubjectAlternativeName": "https://github.com/docker/github-builder-experimental/.github/workflows/bake.yml@7643588149117bf0ca3a906caa3968c70484027a",
                  "Issuer": "https://token.actions.githubusercontent.com",
                  "BuildSignerURI": "https://github.com/docker/github-builder-experimental/.github/workflows/bake.yml@7643588149117bf0ca3a906caa3968c70484027a",
                  "BuildSignerDigest": "7643588149117bf0ca3a906caa3968c70484027a",
                  "RunnerEnvironment": "github-hosted",
                  "SourceRepositoryURI": "https://github.com/moby/buildkit",
                  "SourceRepositoryDigest": "5fbebf9d177edcc7af06c36c78728fdd357bf964",
                  "SourceRepositoryRef": "refs/tags/v0.27.1",
                  "SourceRepositoryIdentifier": "92969352",
                  "SourceRepositoryOwnerURI": "https://github.com/moby",
                  "SourceRepositoryOwnerIdentifier": "27259197",
                  "BuildConfigURI": "https://github.com/moby/buildkit/.github/workflows/buildkit.yml@refs/tags/v0.27.1",
                  "BuildConfigDigest": "5fbebf9d177edcc7af06c36c78728fdd357bf964",
                  "BuildTrigger": "push",
                  "RunInvocationURI": "https://github.com/moby/buildkit/actions/runs/21475065050/attempts/1",
                  "SourceRepositoryVisibilityAtSigning": "public"
                },
                "SignatureType": "bundle-v0.3"
              }
            ],
            "Pull": [
              {
                "Repository": "docker.io/moby/buildkit"
              }
            ]
          },
          "Size": {
            "Unpacked": 232919040
          },
          "Containers": null
        }
      },
      {
        "ID": "sha256:00c6cb41371baf0a8da83c3af1866c8f1711c98a2119c46e8762caf60856d14a",
        "Descriptor": {
          "mediaType": "application/vnd.oci.image.manifest.v1+json",
          "digest": "sha256:00c6cb41371baf0a8da83c3af1866c8f1711c98a2119c46e8762caf60856d14a",
          "size": 1384,
          "annotations": {
            "vnd.docker.reference.digest": "sha256:7a9e2a8abc3428a555ade8db975f899241d4f5d242fb5599dedd4a0f97e8fc04",
            "vnd.docker.reference.type": "attestation-manifest"
          },
          "platform": {
            "architecture": "unknown",
            "os": "unknown"
          }
        },
        "Available": true,
        "Size": {
          "Content": 1474250,
          "Total": 1474250
        },
        "Kind": "attestation",
        "AttestationData": {
          "For": "sha256:7a9e2a8abc3428a555ade8db975f899241d4f5d242fb5599dedd4a0f97e8fc04"
        }
      },
      {
        "ID": "sha256:100572864af4134d51d0c7837aa1d8f7079ea9b3e27d02ccbef7935b48a09103",
        "Descriptor": {
          "mediaType": "application/vnd.oci.image.manifest.v1+json",
          "digest": "sha256:100572864af4134d51d0c7837aa1d8f7079ea9b3e27d02ccbef7935b48a09103",
          "size": 1885,
          "platform": {
            "architecture": "ppc64le",
            "os": "linux"
          }
        },
        "Available": false,
        "Size": {
          "Content": 0,
          "Total": 0
        },
        "Kind": "image",
        "ImageData": {
          "Platform": {
            "architecture": "ppc64le",
            "os": "linux"
          },
          "Size": {
            "Unpacked": 0
          },
          "Containers": null
        }
      },
      {
        "ID": "sha256:47aa137c0989b59d052cb302eb6cc3d31834e358cd51b02817f87f69dd0bae29",
        "Descriptor": {
          "mediaType": "application/vnd.oci.image.manifest.v1+json",
          "digest": "sha256:47aa137c0989b59d052cb302eb6cc3d31834e358cd51b02817f87f69dd0bae29",
          "size": 1384,
          "annotations": {
            "vnd.docker.reference.digest": "sha256:100572864af4134d51d0c7837aa1d8f7079ea9b3e27d02ccbef7935b48a09103",
            "vnd.docker.reference.type": "attestation-manifest"
          },
          "platform": {
            "architecture": "unknown",
            "os": "unknown"
          }
        },
        "Available": false,
        "Size": {
          "Content": 0,
          "Total": 0
        },
        "Kind": "attestation",
        "AttestationData": {
          "For": "sha256:100572864af4134d51d0c7837aa1d8f7079ea9b3e27d02ccbef7935b48a09103"
        }
      },
      {
        "ID": "sha256:598953ef120bfa7d0719e030e17bc5ba024a70c14c94049329b4e96f68a44a3b",
        "Descriptor": {
          "mediaType": "application/vnd.oci.image.manifest.v1+json",
          "digest": "sha256:598953ef120bfa7d0719e030e17bc5ba024a70c14c94049329b4e96f68a44a3b",
          "size": 1885,
          "platform": {
            "architecture": "riscv64",
            "os": "linux"
          }
        },
        "Available": false,
        "Size": {
          "Content": 0,
          "Total": 0
        },
        "Kind": "image",
        "ImageData": {
          "Platform": {
            "architecture": "riscv64",
            "os": "linux"
          },
          "Size": {
            "Unpacked": 0
          },
          "Containers": null
        }
      },
      {
        "ID": "sha256:75530b99ff63f171ba46c1b17cb741d1e9ddbb3b7fcf6eb5dcb3dd9b9aef4908",
        "Descriptor": {
          "mediaType": "application/vnd.oci.image.manifest.v1+json",
          "digest": "sha256:75530b99ff63f171ba46c1b17cb741d1e9ddbb3b7fcf6eb5dcb3dd9b9aef4908",
          "size": 1384,
          "annotations": {
            "vnd.docker.reference.digest": "sha256:598953ef120bfa7d0719e030e17bc5ba024a70c14c94049329b4e96f68a44a3b",
            "vnd.docker.reference.type": "attestation-manifest"
          },
          "platform": {
            "architecture": "unknown",
            "os": "unknown"
          }
        },
        "Available": false,
        "Size": {
          "Content": 0,
          "Total": 0
        },
        "Kind": "attestation",
        "AttestationData": {
          "For": "sha256:598953ef120bfa7d0719e030e17bc5ba024a70c14c94049329b4e96f68a44a3b"
        }
      },
      {
        "ID": "sha256:7985ce1de8899f5727d3d483e19b1794446f6dc51be106d24bcf1caba6a3bece",
        "Descriptor": {
          "mediaType": "application/vnd.oci.image.manifest.v1+json",
          "digest": "sha256:7985ce1de8899f5727d3d483e19b1794446f6dc51be106d24bcf1caba6a3bece",
          "size": 1885,
          "platform": {
            "architecture": "s390x",
            "os": "linux"
          }
        },
        "Available": false,
        "Size": {
          "Content": 0,
          "Total": 0
        },
        "Kind": "image",
        "ImageData": {
          "Platform": {
            "architecture": "s390x",
            "os": "linux"
          },
          "Size": {
            "Unpacked": 0
          },
          "Containers": null
        }
      },
      {
        "ID": "sha256:86834bac34c93b0c31974404cf5614566cd4fc6a98ea622bd44300400e752eee",
        "Descriptor": {
          "mediaType": "application/vnd.oci.image.manifest.v1+json",
          "digest": "sha256:86834bac34c93b0c31974404cf5614566cd4fc6a98ea622bd44300400e752eee",
          "size": 1384,
          "annotations": {
            "vnd.docker.reference.digest": "sha256:7985ce1de8899f5727d3d483e19b1794446f6dc51be106d24bcf1caba6a3bece",
            "vnd.docker.reference.type": "attestation-manifest"
          },
          "platform": {
            "architecture": "unknown",
            "os": "unknown"
          }
        },
        "Available": false,
        "Size": {
          "Content": 0,
          "Total": 0
        },
        "Kind": "attestation",
        "AttestationData": {
          "For": "sha256:7985ce1de8899f5727d3d483e19b1794446f6dc51be106d24bcf1caba6a3bece"
        }
      },
      {
        "ID": "sha256:d5ff0f224469a641a2b467f32b4400aca2c4d06e4edf311eac35e4112e4b7553",
        "Descriptor": {
          "mediaType": "application/vnd.oci.image.manifest.v1+json",
          "digest": "sha256:d5ff0f224469a641a2b467f32b4400aca2c4d06e4edf311eac35e4112e4b7553",
          "size": 1884,
          "platform": {
            "architecture": "arm",
            "os": "linux",
            "variant": "v7"
          }
        },
        "Available": false,
        "Size": {
          "Content": 0,
          "Total": 0
        },
        "Kind": "image",
        "ImageData": {
          "Platform": {
            "architecture": "arm",
            "os": "linux",
            "variant": "v7"
          },
          "Size": {
            "Unpacked": 0
          },
          "Containers": null
        }
      },
      {
        "ID": "sha256:1662e1ad2943ef140b2e12a819a74a1e296e3d42961618343adae88c89b40d4a",
        "Descriptor": {
          "mediaType": "application/vnd.oci.image.manifest.v1+json",
          "digest": "sha256:1662e1ad2943ef140b2e12a819a74a1e296e3d42961618343adae88c89b40d4a",
          "size": 1384,
          "annotations": {
            "vnd.docker.reference.digest": "sha256:d5ff0f224469a641a2b467f32b4400aca2c4d06e4edf311eac35e4112e4b7553",
            "vnd.docker.reference.type": "attestation-manifest"
          },
          "platform": {
            "architecture": "unknown",
            "os": "unknown"
          }
        },
        "Available": false,
        "Size": {
          "Content": 0,
          "Total": 0
        },
        "Kind": "attestation",
        "AttestationData": {
          "For": "sha256:d5ff0f224469a641a2b467f32b4400aca2c4d06e4edf311eac35e4112e4b7553"
        }
      }
    ],
    "RepoDigests": [
      "moby/buildkit@sha256:1e110c71d389d6d24f67b9438e2f7b8da749a6ff407b22a1631e025c95599368"
    ],
    "RepoTags": [
      "moby/buildkit:latest"
    ],
    "SharedSize": -1,
    "Size": 679774206
  }
]

changelog:

`GET /images/json` now supports an `identity` query parameter. When set, the response includes manifest summaries and may include an `Identity` field for each manifest with trusted identity and origin information.
client: `ImageListOptions` now supports `Identity` field. When set, the response includes manifest summaries and may include an `Identity` field for each manifest with trusted identity and origin information.

api/types/image/summary.go

daemon/server/router/image/image_routes.go

daemon/containerd/image_identity.go

crazy-max · 2026-02-12T13:53:40Z

integration/image/identity_test.go

Would have liked to test with a signed image like moby/buildkit but currently blocked by frozen image script that does not support copy of referrers.

Could be fixed with #50668. I see regctl now supports referrers copy: https://github.com/regclient/regclient/blob/4a603732cf0b36aacc441bbe729979cb36296b9c/image.go#L221-L233

crazy-max · 2026-02-13T15:21:11Z

Switched from in-memory cache to content store. Cache entries are now stored as a JSON blob in content store (application/vnd.moby.image.identity-cache.v1+json). The blob is linked from the image root content via containerd.io/gc.ref.content.moby/image.identity-cache=<digest>. So cache lifecycle follows image lifecycle, and old cache blobs are naturally GC'd when unreferenced. Let me know if that looks good.

api/types/image/signature_identity.go

vvoland · 2026-02-26T13:10:47Z

api/types/image/manifest.go

+	// Identity holds information about the identity and origin of the image
+	// manifest.
+	// For list responses, this can duplicate Build/Pull fields across manifests,
+	// because those parts of identity are image-level metadata.
+	Identity *Identity `json:"Identity,omitempty"`


Suggested change

// Identity holds information about the identity and origin of the image

// manifest.

// For list responses, this can duplicate Build/Pull fields across manifests,

// because those parts of identity are image-level metadata.

Identity *Identity `json:"Identity,omitempty"`

Considering that Identity is a property of an image, and not manifest, this should go into ImageProperties

Ah good point I missed that

api/swagger.yaml

daemon/containerd/image_identity.go

api/docs/v1.54.yaml

daemon/containerd/image_list.go

thaJeztah · 2026-02-27T14:42:32Z

daemon/containerd/image_identity.go

+		si, err := i.signatureIdentity(ctx, desc, multi.Best, multi.BestPlatform)
+		if err != nil {
+			log.G(ctx).WithError(err).Error("failed to validate image signature")
+		}
+		if si != nil {
+			identity.Signature = append(identity.Signature, *si)


We're still adding it if validation failed; is that intentional? Does the signature itself indicate "we added it, but couldn't verify?" (just curious).

If it's "not ideal", but "expected", this should also be a warning probably (not an error).

This has been changed in last commits, maybe outdated review?

oh! I was probably stepping through the commits; will check again

thaJeztah · 2026-02-27T14:44:50Z

daemon/containerd/image_identity.go

+	}
+
+	if sc.ImageManifest.Digest != img.Target().Digest {
+		log.L.Infof("signature chain image manifest digest mismatch: %s != %s", sc.ImageManifest.Digest, img.Target().Digest)


log.G(ctx) probably

if this is "expected", perhaps the message should have something "skipping because ..." to make it more clear it's not a "fail".

also consider using WithFields for the digests (instead of Infof

This change doesn't relate to this PR but this one: https://github.com/moby/moby/pull/51737/changes#diff-2d86600f6bc5eb845fe4038a7b8a19832d384724d7a2b3e7aaa32d9666287949R229
I guess you got confused by the commit moving identity logic to a dedicated file.

thaJeztah · 2026-02-27T14:46:03Z

daemon/containerd/image_identity.go

+	switch si.SignatureType {
+	case policytypes.SignatureBundleV03:
+		out.SignatureType = imagetypes.SignatureTypeBundleV03
+	case policytypes.SignatureSimpleSigningV1:
+		out.SignatureType = imagetypes.SignatureTypeSimpleSigningV1
+	}


Should there be handling here for "other" types? (either log as "ignore", or ... something?)

thaJeztah · 2026-02-27T14:47:12Z

daemon/containerd/image_identity.go

+	rp := &referrersProvider{Store: i.content}
+	sc, err := policyimage.ResolveSignatureChain(ctx, rp, desc, &platform)
+	if err != nil {
+		return nil, errors.Wrapf(err, "resolving signature chain for image %s", desc.Digest)


For most new code, we moved away from pkg/errors unless we had a strong reason for it; if not, then could be just fmt.Errorf

daemon/containerd/identitycache/bbolt.go

Signed-off-by: CrazyMax <[email protected]>

crazy-max · 2026-02-27T17:03:30Z

Smth flaky with "Stop OpenTelemetry Collector" step? https://github.com/moby/moby/actions/runs/22494533565/job/65167361726?pr=52030#step:20:25

Stop-Service: D:\a\_temp\3a4bbf69-79c0-45f5-981c-903baeb6ff64.ps1:2
Line |
   2 |  (Stop-Service -DisplayName "OpenTelemetry Collector" -PassThru).WaitF …
     |   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     | Cannot find any service with display name 'OpenTelemetry Collector'.

thaJeztah · 2026-02-27T17:24:29Z

Looks like the setup failed;

Run New-Item -ItemType Directory -Force -Path bundles -ErrorAction Continue
  New-Item -ItemType Directory -Force -Path bundles -ErrorAction Continue
  Start-Process "msiexec" -ArgumentList "/i",
      "https://github.com/open-telemetry/opentelemetry-collector-releases/releases/download/v$($Env:OTEL_COLLECTOR_VERSION)/otelcol_$($Env:OTEL_COLLECTOR_VERSION)_windows_x64.msi",
      "/qn", "/l*v", "$(Join-Path (Get-Location) "bundles/otelcol-install.log")",
      "COLLECTOR_SVC_ARGS=`"--config=`"`"file:$(Join-Path (Get-Location) "otelcol-ci-config.yml")`"`" --config=`"`"yaml:exporters::file::path: $(Join-Path (Get-Location) "bundles/otel-trace.jsonl")`"`"`"" `
      -NoNewWindow -Wait
  @("OTEL_EXPORTER_OTLP_ENDPOINT=http://127.0.0.1:4318/", "OTEL_EXPORTER_OTLP_PROTOCOL=http/protobuf") | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf-8 -Append
  shell: C:\Program Files\PowerShell\7\pwsh.EXE -command ". '{0}'"
  env:
    GO_VERSION: 1.25.7
    GOTESTLIST_VERSION: v0.3.1
    TESTSTAT_VERSION: v0.1.25
    WINDOWS_BASE_IMAGE: mcr.microsoft.com/windows/servercore
    WINDOWS_BASE_TAG_2022: ltsc2022
    WINDOWS_BASE_TAG_2025: ltsc2025
    TEST_IMAGE_NAME: moby:test
    TEST_CTN_NAME: moby
    DOCKER_BUILDKIT: 0
    ITG_CLI_MATRIX_SIZE: 6
    GOPATH: D:\a\moby\moby\go
    GOBIN: D:\a\moby\moby\go\bin
    BIN_OUT: D:\a\moby\moby\out
    GOTOOLCHAIN: local
    OTEL_COLLECTOR_VERSION: 0.144.0

    Directory: D:\a\moby\moby\go\src\github.com\docker\docker

Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
d----           2/27/2026  4:43 PM                bundles
This installation package could not be opened.  Verify that the package exists and that you can access it, or contact the application vendor to verify that this is a valid Windows Installer package.

thaJeztah · 2026-02-27T17:30:07Z

URL looks correct though; after setting the version in it;

curl -fsSLO "https://github.com/open-telemetry/opentelemetry-collector-releases/releases/download/v0.144.0/otelcol_0.144.0_windows_x64.msi"

ls -lah otelcol_0.144.0_windows_x64.msi
-rw-r--r--  1 thajeztah  staff    41M Feb 27 18:28 otelcol_0.144.0_windows_x64.msi

github-actions bot added impact/changelog area/images Image Distribution area/daemon Core Engine containerd-integration Issues and PRs related to containerd integration module/api module/client labels Feb 11, 2026

crazy-max force-pushed the image-list-identity branch from 52ebe2c to abe80e4 Compare February 11, 2026 15:21

crazy-max added kind/feature Functionality or other elements that the project doesn't currently have. Features are new and shiny impact/api labels Feb 11, 2026

thaJeztah reviewed Feb 11, 2026

View reviewed changes

api/types/image/summary.go Outdated Show resolved Hide resolved

thaJeztah reviewed Feb 11, 2026

View reviewed changes

daemon/server/router/image/image_routes.go Outdated Show resolved Hide resolved

thaJeztah reviewed Feb 11, 2026

View reviewed changes

daemon/containerd/image_identity.go Outdated Show resolved Hide resolved

thaJeztah reviewed Feb 11, 2026

View reviewed changes

daemon/containerd/image_identity.go Outdated Show resolved Hide resolved

tonistiigi reviewed Feb 12, 2026

View reviewed changes

daemon/containerd/image_identity.go Outdated Show resolved Hide resolved

daemon/containerd/image_identity.go Outdated Show resolved Hide resolved

crazy-max force-pushed the image-list-identity branch 3 times, most recently from 9b43a76 to 018f593 Compare February 12, 2026 13:51

crazy-max commented Feb 12, 2026

View reviewed changes

crazy-max force-pushed the image-list-identity branch 4 times, most recently from d2a90d9 to b54b342 Compare February 13, 2026 14:14

crazy-max requested review from thaJeztah, tonistiigi and vvoland February 13, 2026 15:22

crazy-max marked this pull request as ready for review February 13, 2026 15:22

thaJeztah reviewed Feb 13, 2026

View reviewed changes

api/types/image/signature_identity.go Outdated Show resolved Hide resolved

crazy-max force-pushed the image-list-identity branch 2 times, most recently from b10feb7 to 548fa2d Compare February 16, 2026 13:51

vvoland requested changes Feb 26, 2026

View reviewed changes

vvoland reviewed Feb 26, 2026

View reviewed changes

api/swagger.yaml Outdated Show resolved Hide resolved

crazy-max force-pushed the image-list-identity branch from 98d52bd to 28c2f10 Compare February 26, 2026 14:59

tonistiigi reviewed Feb 26, 2026

View reviewed changes

daemon/containerd/image_identity.go Show resolved Hide resolved

crazy-max force-pushed the image-list-identity branch from 28c2f10 to a539f1a Compare February 26, 2026 16:38

tonistiigi approved these changes Feb 26, 2026

View reviewed changes

thaJeztah reviewed Feb 27, 2026

View reviewed changes

api/docs/v1.54.yaml Outdated Show resolved Hide resolved

thaJeztah reviewed Feb 27, 2026

View reviewed changes

daemon/containerd/image_list.go Outdated Show resolved Hide resolved

thaJeztah reviewed Feb 27, 2026

View reviewed changes

vvoland reviewed Feb 27, 2026

View reviewed changes

daemon/containerd/identitycache/bbolt.go Show resolved Hide resolved

crazy-max force-pushed the image-list-identity branch from a539f1a to df80fbc Compare February 27, 2026 15:32

crazy-max and others added 5 commits February 27, 2026 16:35

image: add opt-in identity support to image list API

6d133c5

Signed-off-by: CrazyMax <[email protected]>

image: move image identity logic to dedicated file

e22eb8c

Signed-off-by: CrazyMax <[email protected]>

image: cache image identity signature lookups

2ba7c77

Signed-off-by: CrazyMax <[email protected]>

image: warm identity cache on image changes

fae834d

Signed-off-by: CrazyMax <[email protected]>

image: identity unit and integration tests

3aef780

Signed-off-by: CrazyMax <[email protected]>

crazy-max force-pushed the image-list-identity branch from df80fbc to 96641c7 Compare February 27, 2026 15:35

crazy-max added 2 commits February 27, 2026 17:26

image: add identity cache backend walk and prune expired support

59bf6b3

Signed-off-by: CrazyMax <[email protected]>

image: refresh identity cache entries before expiry

1433bee

Signed-off-by: CrazyMax <[email protected]>

crazy-max force-pushed the image-list-identity branch from 96641c7 to 1433bee Compare February 27, 2026 16:27

vvoland approved these changes Feb 27, 2026

View reviewed changes

vvoland merged commit 11d1267 into moby:master Feb 27, 2026
204 of 216 checks passed

crazy-max deleted the image-list-identity branch February 27, 2026 18:50

thaJeztah mentioned this pull request Mar 10, 2026

daemon produces "reference for unknown type" warnings for Sigstore bundles #52158

Open

Conversation

crazy-max commented Feb 11, 2026 • edited by vvoland Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

crazy-max Feb 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

crazy-max commented Feb 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

crazy-max commented Feb 27, 2026

Uh oh!

thaJeztah commented Feb 27, 2026

Uh oh!

thaJeztah commented Feb 27, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

crazy-max commented Feb 11, 2026 •

edited by vvoland

Loading

crazy-max Feb 12, 2026 •

edited

Loading

crazy-max commented Feb 13, 2026 •

edited

Loading