I would like to always pull a specific version, rather than just the latest.
A random example: https://registry.hub.docker.com/u/aespinosa/jenkins/builds_history/9511/
I am doing this because I only want to deploy versions that I have audited. Is this currently possible? Or am I forced to fork them and make my own?
You can pull a specific image by digest by using the following syntax:
docker pull ubuntu@sha256:45b23dee08af5e43a7fea6c4cf9c25ccf269ee113168c19722f87876677c5cb2
If you need to find the hash, it is output when pushing/pulling the image. Some automated builds output it at the end. I tried looking for the hash with docker inspect but it didn't appear to be there, so you'll have to delete the image and pull it again to view the hash.
docker images --digest
docker image inspect --format='{{index .RepoDigests 0}}' $IMAGE for a specific image
docker inspect --format='{{.Image}}' $IMAGEThe way I do it is to tag each build
docker build -t $NAMESPACE/$APP_NAME:$BUILD_SHA1 .
docker tag \
$NAMESPACE/$APP_NAME:$SHA1 \
$DOCKER_REGISTRY/$NAMESPACE/$APP_NAME:$SHA1
docker push $DOCKER_REGISTRY/$NAMESPACE/$APP_NAME:$SHA1
and then you pull the specific tag
docker pull $DOCKER_REGISTRY/$NAMESPACE/$APP_NAME:$SHA1
In addition to Joel's answer, you might want to verify the image exists on a specific Docker repo before trying to pull the image. The easiest way I know is using the Docker registry API. Make a simple HTTP GET request. Assemble the string like this -
FullURL = DomainAndPort + "/v2/" + imageName + "/blobs/sha256:" + imageHash;
An example request that works for me on our network repo -
http://10.10.9.84:5000/v2/hello-world/blobs/sha256:8089101ead9ce9b8c68d6859995c98108e1022c23beaa55754acb89d66fd3381
Entering that string into a Chrome browser returns a JSON object describing the image. If you enter an invalid sha256 hash then the API returns -
{"errors":[{"code":"DIGEST_INVALID","message":"provided digest did not match uploaded content","detail":{}}]}
For more details see "Pulling a Layer" in https://docs.docker.com/registry/spec/api/
docker pull <your build id>?