What is the relationship between a docker image ID and the IDs in the manifests?

Question

I am trying to understand the connection between the image ID as reported by docker images (or docker inspect) and the actual layers or images in the registry or manifest (using v2).

I run docker images, I get (abbreviated and changed to protect the not-so-innocent):

REPOSITORY                                             TAG                 IMAGE ID
my.local.registry/some/image      latest              abcdefg

If I pull the manifest for the above image using the API, I get one that contains fsLayers, not one of which matches the (full) ID for the image. I get that, since the image is the sum of the layers.

However, if I pull that image elsewhere, I get the same ID. If I update the image, push and pull it, the new version has a new ID.

I thought it might be the hash of the manifest. However, (a) pulling the manifest via the API does not return the hash of the manifest in the JSON, and (b) looking in the registry directory itself, the sha256 of the given manifest in /var/lib/registry/v2/repositories/some/image/_manifests/tags/latest/current/link (or those in index/sha256/) give the correct link for the manifest that was downloaded, but does not match the image ID.

I had assumed the image ID matches the blob, but perhaps I am in error?

Answer 1

When we push an image into a registry,

1. We create a manifest that defines the image - layers inside it, and push both the manifest and layers independently.
2. We compress the layers and only then push them.

So in our host the hashes we have are the hashes of the content present in those layers, called the Content Hashes.

But to the registry we send the compressed layers, due to which the content changes and so the hashes change. So before those compressed layers are sent, the hashes for the compressed layers are calculated which are called the Distribution Hashes and those hashes are put in the manifest file.

Due to the difference in these Content and Distribution hashes, you see a difference in the ids.