title: Tag digest to docker image when re-tagging registry
body: <p>We have two URLs for our registry: one internal in our VPC and one external for customers pulling our images. We switched to a digest based reference system, so we pull images by their <code>sha256</code> digests. Now we also want to give customers the option to install without internet access, so we export the images using <code>docker save</code> and then can load them using <code>docker load</code>. Unfortunately, we are having issues persisting the digest in this process.</p>
  <p><strong>How can I transfer a digest from one registry name to another when using <code>docker tag</code>?</strong></p>
  <p>An example might be illuminating here:</p>
  <pre><code>$ docker pull internal.registry.local/development/img:0.23.0@sha256:9c3c425cc0114e358c58800b544e104be5d5c8f3b594871dafbaf9f28444d267
  internal.registry.local/development/mdbrain/aneurysm_segmentation@sha256:9c3c425cc0114e358c58800b544e104be5d5c8f3b594871dafbaf9f28444d267: Pulling from development/img
  Digest: sha256:9c3c425cc0114e358c58800b544e104be5d5c8f3b594871dafbaf9f28444d267
  Status: Image is up to date for internal.registry.local/development/img:0.23.0@sha256:9c3c425cc0114e358c58800b544e104be5d5c8f3b594871dafbaf9f28444d267
  internal.registry.local/development/img:0.23.0@sha256:9c3c425cc0114e358c58800b544e104be5d5c8f3b594871dafbaf9f28444d267
  </code></pre>
  <p>gives me my image under the dev registry</p>
  <pre><code>$ docker image ls --digests
  internal.registry.local/development/img   0.23.0                               sha256:9c3c425cc0114e358c58800b544e104be5d5c8f3b594871dafbaf9f28444d267   dc9c4901ced1   8 weeks ago    10.7GB
  </code></pre>
  <p>and is equipped with the digest</p>
  <pre><code>$ docker image inspect internal.registry.local/development/img@sha256:9c3c425cc0114e358c58800b544e104be5d5c8f3b594871dafbaf9f28444d267 | jq '.[] | { Id, RepoTags, RepoDigests }'
  {
    &quot;Id&quot;: &quot;sha256:dc9c4901ced19676f90c95d0f82c85ba97d15ba1c39d38ca9d692f3d3658bd43&quot;,
    &quot;RepoTags&quot;: [
      &quot;547766146644.dkr.ecr.eu-central-1.amazonaws.com/development/mdbrain/aneurysm_segmentation:1.21.0&quot;
    ],
    &quot;RepoDigests&quot;: [
      &quot;547766146644.dkr.ecr.eu-central-1.amazonaws.com/development/mdbrain/aneurysm_segmentation@sha256:9c3c425cc0114e358c58800b544e104be5d5c8f3b594871dafbaf9f28444d267&quot;
    ]
  }
  </code></pre>
  <p>If I now add another tag to that image under the same registry, the digest is transferred</p>
  <pre><code>$ docker tag internal.registry.local/development/img@sha256:9c3c425cc0114e358c58800b544e104be5d5c8f3b594871dafbaf9f28444d267 internal.registry.local/development/img:0.23.0-custom
  
  $ docker image ls --digests
  internal.registry.local/development/img   0.23.0          sha256:9c3c425cc0114e358c58800b544e104be5d5c8f3b594871dafbaf9f28444d267   dc9c4901ced1   8 weeks ago    10.7GB
  internal.registry.local/development/img   0.23.0-custom   sha256:9c3c425cc0114e358c58800b544e104be5d5c8f3b594871dafbaf9f28444d267   dc9c4901ced1   8 weeks ago    10.7GB
  
  $ docker image inspect internal.registry.local/development/img@sha256:9c3c425cc0114e358c58800b544e104be5d5c8f3b594871dafbaf9f28444d267 | jq '.[] | { Id, RepoTags, RepoDigests }'
  {
    &quot;Id&quot;: &quot;sha256:dc9c4901ced19676f90c95d0f82c85ba97d15ba1c39d38ca9d692f3d3658bd43&quot;,
    &quot;RepoTags&quot;: [
      &quot;internal.registry.local/development/img:0.23.0&quot;,
      &quot;internal.registry.local/development/img:0.23.0-custom&quot;,
    ],
    &quot;RepoDigests&quot;: [
      &quot;internal.registry.local/development/img@sha256:9c3c425cc0114e358c58800b544e104be5d5c8f3b594871dafbaf9f28444d267&quot;
    ]
  }
  </code></pre>
  <p>But if I change the registry, the digest is lost</p>
  <pre><code>$ docker tag internal.registry.local/development/img@sha256:9c3c425cc0114e358c58800b544e104be5d5c8f3b594871dafbaf9f28444d267 external.example.org/production/img:0.23.0
  
  $ docker image ls --digests
  internal.registry.local/development/img   0.23.0          sha256:9c3c425cc0114e358c58800b544e104be5d5c8f3b594871dafbaf9f28444d267   dc9c4901ced1   8 weeks ago    10.7GB
  internal.registry.local/development/img   0.23.0-custom   sha256:9c3c425cc0114e358c58800b544e104be5d5c8f3b594871dafbaf9f28444d267   dc9c4901ced1   8 weeks ago    10.7GB
  external.example.org/production/img       0.23.0          &lt;none&gt;                                                                    dc9c4901ced1   8 weeks ago    10.7GB
  
  $ docker image inspect internal.registry.local/development/img@sha256:9c3c425cc0114e358c58800b544e104be5d5c8f3b594871dafbaf9f28444d267 | jq '.[] | { Id, RepoTags, RepoDigests }'
  {
    &quot;Id&quot;: &quot;sha256:dc9c4901ced19676f90c95d0f82c85ba97d15ba1c39d38ca9d692f3d3658bd43&quot;,
    &quot;RepoTags&quot;: [
      &quot;internal.registry.local/development/img:0.23.0&quot;,
      &quot;internal.registry.local/development/img:0.23.0-custom&quot;,
      &quot;external.example.org/production/img:0.23.0&quot;
    ],
    &quot;RepoDigests&quot;: [
      &quot;internal.registry.local/development/img@sha256:9c3c425cc0114e358c58800b544e104be5d5c8f3b594871dafbaf9f28444d267&quot;
    ]
  }
  </code></pre>
  <p>But mind you, the registry is actually the same, just under a different host name. So I can pull the image by digest from the external name and get the digest attached to it</p>
  <pre><code>$ docker pull external.example.org/production/img@sha256:9c3c425cc0114e358c58800b544e104be5d5c8f3b594871dafbaf9f28444d267
  external.example.org/production/img@sha256:9c3c425cc0114e358c58800b544e104be5d5c8f3b594871dafbaf9f28444d267: Pulling from production/img
  Digest: sha256:9c3c425cc0114e358c58800b544e104be5d5c8f3b594871dafbaf9f28444d267
  Status: Downloaded newer image for external.example.org/production/img@sha256:9c3c425cc0114e358c58800b544e104be5d5c8f3b594871dafbaf9f28444d267
  external.example.org/production/img@sha256:9c3c425cc0114e358c58800b544e104be5d5c8f3b594871dafbaf9f28444d267
  
  $ docker image ls --digests
  internal.registry.local/development/img   0.23.0          sha256:9c3c425cc0114e358c58800b544e104be5d5c8f3b594871dafbaf9f28444d267   dc9c4901ced1   8 weeks ago    10.7GB
  internal.registry.local/development/img   0.23.0-custom   sha256:9c3c425cc0114e358c58800b544e104be5d5c8f3b594871dafbaf9f28444d267   dc9c4901ced1   8 weeks ago    10.7GB
  external.example.org/production/img       0.23.0          sha256:9c3c425cc0114e358c58800b544e104be5d5c8f3b594871dafbaf9f28444d267   dc9c4901ced1   8 weeks ago    10.7GB
  
  $ docker image inspect internal.registry.local/development/img@sha256:9c3c425cc0114e358c58800b544e104be5d5c8f3b594871dafbaf9f28444d267 | jq '.[] | { Id, RepoTags, RepoDigests }'
  {
    &quot;Id&quot;: &quot;sha256:dc9c4901ced19676f90c95d0f82c85ba97d15ba1c39d38ca9d692f3d3658bd43&quot;,
    &quot;RepoTags&quot;: [
      &quot;internal.registry.local/development/img:0.23.0&quot;,
      &quot;internal.registry.local/development/img:0.23.0-custom&quot;,
      &quot;external.example.org/production/img:0.23.0&quot;
    ],
    &quot;RepoDigests&quot;: [
      &quot;internal.registry.local/development/img@sha256:9c3c425cc0114e358c58800b544e104be5d5c8f3b594871dafbaf9f28444d267&quot;
      &quot;external.example.org/production/img@sha256:9c3c425cc0114e358c58800b544e104be5d5c8f3b594871dafbaf9f28444d267&quot;
    ]
  }
  </code></pre>
  <p><strong>How can I get the digest attached to the imgage when changing the registry by re-tagging without pulling by digest from the new registry name?</strong></p>
  <p>I've tried all permutations of</p>
  <pre><code>docker tag A/img@sha B/img:tag
  docker tag A/img:tag B/img:tag
  docker tag A/img:tag@sha B/img:tag
  docker tag A/img@sha B/img@sha  # error
  </code></pre>
  <p>no no avail.</p>