Docker image digest incorrect at docker hub

[crogre]

Please provide a brief summary of the bug

I'm using the eclipse-temurin:11.0.17_8-jre image for linux/amd64 from docker hub. According to the tags page, https://hub.docker.com/_/eclipse-temurin/tags?page=1&name=11.0.17_8-jre, the digest of that image should be Digest:sha256:772b0000ef09d2099ef07d1df87b12d942248419e79ff46fa739a5feb617e543. However, the image I pulled has Digest:sha256:81b132098ddaba7dc53b67e23e83452f458029a8eeafde911a3076f82d22e946.

Please provide steps to reproduce where possible

Just do a
docker pull eclipse-temurin:11.0.17_8-jre

Expected Results

Image digest should match the sha256 on docker hub.

Actual Results

$ docker inspect eclipse-temurin:11.0.17_8-jre -f "{{.RepoDigests}}"

[eclipse-temurin@sha256:81b132098ddaba7dc53b67e23e83452f458029a8eeafde911a3076f82d22e946]

What Java Version are you using?

Not applicable

What is your operating system and platform?

No response

How did you install Java?

No response

Did it work before?

No response

Did you test with other Java versions?

No response

Relevant log output

No response

[karianna]

@gdams This is a DockerHub only concern or on us?

[gdams]

What architecture are you pulling?

[crogre]

Amd64

[gdams]

Yeah, I can recreate this on my end. @tianon / @yosifkit any idea what might be going on here?

[yosifkit]

The ID that docker shows when pulling is actually the ID of the image index (the list of architecture specific images that each have their own ID; aka manifest list) instead of the architecture specific ID. So, this is an unfortunate "bug" in how docker cli and engine uses the content addressable ID for the image index and how the Docker Hub does not display the ID for the index.

You can see the ID in the git history of our docker-library/repo-info that tracks image changes as seen on Docker Hub (which is where I see that Windows images have changed the image index). See history of this file: https://github.com/docker-library/repo-info/blame/master/repos/eclipse-temurin/remote/11.0.17_8-jre.md.

Other tools can also show you that the ID you get is the image index id: https://explore.ggcr.dev/?image=eclipse-temurin%3A11.0.17_8-jre. The Docker-Content-Digest: sha256:a22c10c5e01a19f85018f5708a1b2a9ac7b20bc93cb85371359db717827e3c87 matches what I pull today:

$ docker pull eclipse-temurin:11.0.17_8-jre
11.0.17_8-jre: Pulling from library/eclipse-temurin
6e3729cf69e0: Already exists 
96aa423488f0: Pull complete 
a149af9550da: Pull complete 
e1a0fd4e771c: Pull complete 
Digest: sha256:a22c10c5e01a19f85018f5708a1b2a9ac7b20bc93cb85371359db717827e3c87
Status: Downloaded newer image for eclipse-temurin:11.0.17_8-jre
docker.io/library/eclipse-temurin:11.0.17_8-jre

[tianon]

See also docker/roadmap#262 👀 😭

[gdams]

Thanks for your comments @tianon / @yosifkit. I'm going to close this issue for now. @crogre I hope that these comments help you with your problem.