Layers
Layers
Naming scheme
- Format:
<registry>/<repository>:<tag> -
<repository>describes purpose -
<tag>describes variant or version -
<repository>:<tag>is called an image
Docker Hub
- On Docker Hub:
<repository>:<tag> - Official image:
alpine:stable - Community image:
nicholasdille/insulatr
Images and layers
- Images consist of layers
- Layers improve download performance
- Layers enable reusability
Image Manifest
Layers
- Lists layers in the image
- Layers are referenced as blobs
- References are SHA256 hashed:
sha256:...
Image configuration
- Contains command used to create layers
- Stored as blob
–
Demo: Layers
Preparation
Upload image to local registry:
docker run -d -p 5000:5000 registry:2
docker build --tag localhost:5000/hello-world-java .
docker push localhost:5000/hello-world-java
Investigate layers locally
docker history hello-world-java
–
Demo: Image Manifest
Download image manifest:
curl \
-sL \
-H "Accept: application/vnd.docker.distribution.manifest.v2+json" \
http://localhost:5000/v2/hello-world-java/manifests/latest \
| jq
–
Demo: Image Configuration
Download image configuration:
curl \
-sL \
-H "Accept: application/vnd.docker.container.image.v1+json" \
http://localhost:5000/v2/hello-world-java/manifests/latest \
| jq
–
Demo: Download image layer
DIGEST=$(
curl \
-sL \
-H "Accept: application/vnd.docker.container.image.v1+json" \
http://localhost:5000/v2/hello-world-java/manifests/latest \
| jq --raw-output '.layers[-1].digest'
)
curl \
-sL \
-H "Accept: application/vnd.docker.image.rootfs.diff.tar.gzip" \
http://localhost:5000/v2/hello-world-java/blobs/${DIGEST} \
| tar -tvz
–
Demo: Verifying a layer’s digest
DIGEST=$(
curl \
-sL \
-H "Accept: application/vnd.docker.container.image.v1+json" \
http://localhost:5000/v2/hello-world-java/manifests/latest \
| jq --raw-output '.layers[-1].digest'
)
curl \
-sL \
-H "Accept: application/vnd.docker.image.rootfs.diff.tar.gzip" \
http://localhost:5000/v2/hello-world-java/blobs/${DIGEST} \
| sha256sum
–
Demo: Determining the content length
DIGEST=$(
curl \
-sL \
-H "Accept: application/vnd.docker.container.image.v1+json" \
http://localhost:5000/v2/hello-world-java/manifests/latest \
| jq --raw-output '.layers[-1].digest'
)
curl \
-sL \
-H "Accept: application/vnd.docker.image.rootfs.diff.tar.gzip" \
http://localhost:5000/v2/hello-world-java/blobs/${DIGEST} \
| wc -c
Registries
- REST API
- No UI
- Manage images, layers, configurations
- Upload, list, update, delete
Usage
- Registries are accessed using HTTPS
- Insecure registries must be defined expicitly
- Accepted insecure registry:
127.0.0.1/8
Further reading
–
Demo: Registries
Tagging images remotely
# Download manifest from old name
MANIFEST=$(curl -sL \
-H "Accept: application/vnd.docker.distribution.manifest.v2+json" \
localhost:5000/v2/hello-world-java/manifests/latest
)
# Push manifest with new name
curl -X PUT \
-H "Content-Type: application/vnd.docker.distribution.manifest.v2+json" \
-d "${MANIFEST}" \
localhost:5000/v2/hello-world-java/manifests/new
# Test
docker pull localhost:5000/v2/hello-world-java/manifests/new