Get container image label without pulling the image from GCR

Question

I am trying to create a dataset for at least 250 container images built by docker and pushed to a single GCP project on Google Container Repository (GCR). The GCR is highly active, thus it changes the version quite frequently, thus the automation.

All of these images add a certain label at the time of push from the CI system. I want to add those labels in the dataset. I tried accessing the label and its value after pulling the image, however, pulling 250+ images and then inspecting them is taking too much resources on this automation and may not even be possible.

So in short, I just want to know if there's any gcloud API (REST or CLI) which can fetch the label metadata without pulling the image first?

I tried looking in the docs, but couldn't find anything. I tried the following command which only gives the SHA256 digest and the repository details, but not labels

gcloud container images describe gcr.io/[PROJECT-ID]/[IMAGE]

# Output

image_summary:
  digest: sha256:[SHA_DIGEST_HERE]
  fully_qualified_digest: gcr.io/[PROJECT-ID]/[IMAGE]@sha256:[SHA_DIGEST_HERE]
  registry: gcr.io
  repository: [PROJECT-ID]/[IMAGE]

Update:
I tried the curl command with the access token which gave me different layers instead

$> curl https://gcr.io:443/v2/[PROJECT-ID]/[IMAGE]/manifests/latest -H "Authorization: Bearer {token}"

// output

{
   "schemaVersion": 2,
   "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
   "config": {
      "mediaType": "application/vnd.docker.container.image.v1+json",
      "size": [size],
      "digest": "sha256:[SHA_256_DIGEST]"
   },
   "layers": [
      // different layers here
      ]
}

Not sure how can I actually extract the manifest itself and look into it.

I want something like what this question is asking, but for GCR instead of dockerhub.

Answer 1

I want something like what this question is asking, but for GCR instead of dockerhub.

You're in luck because Container Registry implements a Docker protocol! This means you're actually able to reuse its accepted answer (with some small modifications):

$ REGISTRY="eu.gcr.io"
$ IMAGE="[YOUR-PROJECT-ID]/[YOUR-IMAGE]"
$ TAG="latest"
$ TOKEN="$(gcloud auth print-access-token)"
$ DIGEST="$(curl -s -H "Authorization: Bearer $TOKEN" "https://$REGISTRY/v2/$IMAGE/manifests/$TAG" | jq '.config.digest' -r)"
$ curl -sL -H "Authorization: Bearer $TOKEN" "https://$REGISTRY/v2/$IMAGE/blobs/$DIGEST" | jq '.config.Labels'

This should give you a JSON-formatted collection of labels for the image without pulling the whole thing and save lots of time and bandwidth.