What does each sha mean in a docker image

Question

If I do docker inspect {img}, I will get a list of many sha256s. What does each of these sha mean? Here's a list of all the shas from docker inspect ubuntu:16.04:

"Id": "sha256:0ef2e08ed3fabfc44002ccb846c4f2416a2135affc3ce39538834059606f32dd"

"RepoDigests": ["ubuntu@sha256:dd7808d8792c9841d0b460122f1acf0a2dd1f56404f8d1e56298048885e45535"]

"ContainerConfig"."Image":"sha256:518b94cfb647aca74cc36f08ddacd5cb61abee3c8cf5cd66b1fadff40c7240eb"

"Config"."Image":"sha256:518b94cfb647aca74cc36f08ddacd5cb61abee3c8cf5cd66b1fadff40c7240eb"

"RootFS"."Layers":["sha256:745f5be9952c1a22dd4225ed6c8d7b760fe0d3583efd52f91992463b53f7aea3", "sha256:85782553e37a2998422ecb14fb34ac3fda94dbc90c6630d721a3bcc770939946", "sha256:29660d0e5bb2bae1d415f5638fa6011ab4063d1c0895e889d51ad365186d1995", "sha256:440e02c3dcde277c7426c07c6e240a40b1e53da4a8a0cc22a8cecd4e6f419a98", "sha256:56827159aa8b327a1b15c2102040ee87f3ca0bf8285aab00a1286e8af79a4beb"]

This leads to my second question, I have seen people use sha as the source when they build docker images: FROM ubuntu@sha256:.... Which sha from the above that it pulls that from?

Answer 1

Those are digests of image layers. The same image might be tagged with different names. But the SHA256 digest is a unique and immutable identifier you can reference.

If you pull an image specifying the digest, you have a guarantee that the image you’re using is always the same.

The more details can be found in docs, here: Pull an image by digest (immutable identifier) and here: Understand images, containers, and storage drivers