title: Obtaining docker image digest
body: <p>When I execute <code>docker images --digests</code> I get the following information for the <code>alpine:latest</code> image:</p>
  
  <pre><code>sha256:9a839e63dad54c3a6d1834e29692c8492d93f90c59c978c1ed79109ea4fb9a54
  </code></pre>
  
  <p>I can find the same information when executing <code>docker image inspect alpine:latest</code> and look in the JSON path <code>RepoDigests[0]</code>.</p>
  
  <p>How to obtain the very same information from the registry using the <a href="https://docs.docker.com/registry/spec/api/" rel="nofollow noreferrer">Docker registry API</a>?</p>
  
  <p>I've tried the following:</p>
  
  <pre><code># Authenticate (https://docs.docker.com/registry/spec/auth/token/)
  curl -i "https://auth.docker.io/token?service=registry.docker.io&amp;scope=repository:alpine:pull"
  
  # Parse the token from the JSON result, JSON path: "token"
  export TOKEN=&lt;token&gt;
  
  # Query the manifest (https://docs.docker.com/registry/spec/api/)
  curl -i -H "Authorization: Bearer $TOKEN" https://registry-1.docker.io/v2/library/alpine/manifests/latest
  </code></pre>
  
  <p>According to the docs the response header <code>Docker-Content-Digest</code> should contain the digest, however, the value is different (but maybe it's the manifest's digest, not the image's digest?). The resulting JSON file doesn't contain the image digest either. Where is it?</p>
  
  <p>How to programatically obtain the same digest as above? I need the one above, because this is the one <code>docker trust sign</code> will put into the signature, and I want  to implement the signing process myself.</p>