dockerdockerfilesha

How to use a multiarch base docker image when specifying SHA

I'm stuck following our internal procedure that requires pinning a docker base image to a specific SHA. And, I'm stuck needing to build a mulitarch image for both x86_64 and ARM.

The base image that I'm looking at has a SHA for each architecture (which I would expect, makes total sense). So how can I specify a specific SHA in the FROM if the resulting image is also supposed to be multiarch? Am I stuck using a Dockerfile for each arch??

Solution

  • Update: Docker Hub now shows the digest for the multi-platform index, so you can use that, or one of the tools listed below to get that digest:

    Docker Hub screenshot of a tag including the index digest

    The manifest list for a multi-platform image has its own digest, and that is what you want to provide to tools. There are a variety of tools that can get this. My own tool is regclient with the regctl CLI, go-containerregistry from Google has crane, and Docker has been including an imagetools CLI under buildx:

    $ regctl image digest bitnami/minideb
sha256:713d1fbd2edbc7adf0959721ad360400cb39d6b680057f0b50599cba3a4db09f

$ crane digest bitnami/minideb
sha256:713d1fbd2edbc7adf0959721ad360400cb39d6b680057f0b50599cba3a4db09f

$ docker buildx imagetools inspect bitnami/minideb
Name:      docker.io/bitnami/minideb:latest
MediaType: application/vnd.docker.distribution.manifest.list.v2+json
Digest:    sha256:713d1fbd2edbc7adf0959721ad360400cb39d6b680057f0b50599cba3a4db09f
           
Manifests: 
  Name:      docker.io/bitnami/minideb:latest@sha256:2abaa4a8ba2c3ec9ec3cb16a55820db8d968919f41439e1e8c86faca81c8674a
  MediaType: application/vnd.docker.distribution.manifest.v2+json
  Platform:  linux/amd64
             
  Name:      docker.io/bitnami/minideb:latest@sha256:3c44390903734b2657728fcad8fb33dcdf311bdeaafcc3b9f179d78bdf4da669
  MediaType: application/vnd.docker.distribution.manifest.v2+json
  Platform:  linux/arm64