Getting an image's digest fast, within a docker-container builder

[fenollp]

Hi!

I've tried both:

• BUILDX_BUILDER=supergreen docker buildx imagetools inspect docker.io/library/rust:1.89.0-slim '--format={{json .Manifest.Digest}}'

• BUILDX_BUILDER=supergreen docker manifest inspect docker.io/library/rust:1.89.0-slim

to get that image's digest from my builder's cache (it's there, all local). BTW the expected answer (today) is:

"sha256:33219ca58c0dd38571fd3f87172b5bce2d9f3eb6f27e6e75efe12381836f71fa"

However it is incomprehensible to me why even just the (non-experimental) imagetools inspect command takes 4-5s to respond... I don't see any CPU/RAM spikes... Is this hitting the network? Everything should be in my builder's cache though.

How can I get the digest of my local copy of a tag in <1s?

Oh and BTW --format={{.Manifest.Digest}} (without json formatting) is still broken: it ignores the Go tmpl.

Thanks!

[fenollp]

To be clear, this command used to work (with the old Docker --loaded images): and was fast

BUILDX_BUILDER=supergreen docker --debug inspect --'format={{index .RepoDigests 0}}' docker.io/library/rust:1.89.0-slim

More on the imagetools command: with --debug it shows this

DEBUG: fetching layer
DEBUG: do request
DEBUG: fetch response received
DEBUG: resolving
DEBUG: do request
DEBUG: fetch response received
DEBUG: resolved
DEBUG: fetch
DEBUG: fetching layer
DEBUG: do request
DEBUG: fetch response received
DEBUG: fetch
DEBUG: fetch
DEBUG: fetch
DEBUG: fetch
DEBUG: fetch
DEBUG: fetch
DEBUG: fetching layer
DEBUG: do request
DEBUG: fetch
DEBUG: fetching layer
DEBUG: fetching layer
DEBUG: do request
DEBUG: fetching layer
DEBUG: fetching layer
DEBUG: do request
DEBUG: do request
DEBUG: fetch
DEBUG: fetching layer
DEBUG: fetch
DEBUG: fetching layer
DEBUG: do request
DEBUG: do request
DEBUG: fetch
DEBUG: fetch
DEBUG: fetching layer
DEBUG: do request
DEBUG: fetch
DEBUG: do request
DEBUG: fetching layer
DEBUG: do request
DEBUG: fetching layer
DEBUG: do request
DEBUG: fetching layer
DEBUG: do request
DEBUG: fetching layer
DEBUG: do request
DEBUG: fetch response received
DEBUG: fetch response received
DEBUG: fetch response received
DEBUG: fetch response received
DEBUG: fetch response received
DEBUG: fetch response received
DEBUG: fetch response received
DEBUG: fetch response received
DEBUG: fetch response received
DEBUG: fetch response received
DEBUG: fetch response received
DEBUG: fetch response received
DEBUG: fetch
DEBUG: fetching layer
DEBUG: do request
DEBUG: fetch response received
DEBUG: fetch
DEBUG: fetching layer
DEBUG: do request
DEBUG: fetch response received
DEBUG: fetch
DEBUG: fetching layer
DEBUG: do request
DEBUG: fetch response received
DEBUG: fetch
DEBUG: fetching layer
DEBUG: do request
DEBUG: fetch response received
DEBUG: fetch
DEBUG: fetching layer
DEBUG: do request
DEBUG: fetch response received
DEBUG: fetch
DEBUG: fetching layer
DEBUG: do request
DEBUG: fetch response received

and today, gives me a different response than yesterday:

"sha256:2ff54dd21007d5ee97026fadad80598e66136a43adc5687078d796d958bd58fb"

which tells me this command hits the network.
I'm looking for a way to read image digest from my /local/ builder cache though.

[fenollp]

Adding to my question, I found moby/buildkit#4854 which is IMO a bit more general than what I'm asking for here:

I'm trying to get the manifest digest of an image in my builder cache, but that image isn't built here: it's from a registry. E.g.: rust:1.89.0-slim
In my case maybe there's a simple/quick workaround? I actually found this one:

docker buildx du --verbose | grep rust:1.89.0-slim | sort -u

Description: pulled from docker.io/library/rust:1.89.0-slim@sha256:33219ca58c0dd38571fd3f87172b5bce2d9f3eb6f27e6e75efe12381836f71fa

which appears to match

ID:		ohxhekyoshxip5l5hnd3th9jb
Parent:		dyoo0ez6aq47esc1lu7gij20a
Created at:	2025-08-12 13:04:40.701102099 +0000 UTC
Mutable:	false
Reclaimable:	true
Shared:		false
Size:		1.09GB
Description:	pulled from docker.io/library/rust:1.89.0-slim@sha256:33219ca58c0dd38571fd3f87172b5bce2d9f3eb6f27e6e75efe12381836f71fa
Usage count:	11
Last used:	23 hours ago
Type:		regular

Any clues as to how to use --filter? From https://docs.docker.com/reference/cli/docker/buildx/du/ I only get "Provide filter values"...

[disdorqin]

Hi — I think the core issue is that docker buildx imagetools inspect always resolves the manifest from the registry, so it can never be faster than a network round-trip and will reflect whatever digest the mutable rust:1.89.0-slim tag currently points to.

To read the digest your builder already has cached locally, try these read-only commands:

docker buildx du --verbose 2>/dev/null | grep -oE 'sha256:[a-f0-9]{64}' | head
docker inspect --format '{{index .RepoDigests 0}}' rust:1.89.0-slim
docker buildx version

The first reads local build-cache records without touching the network; the second works only if the image was --loaded into the daemon. If you are building the image yourself, capturing --metadata-file at build time avoids the lookup entirely.

Could you share the output of docker buildx version and docker version, plus whether the image was loaded or only exists in the buildx cache? That will let me point to the most reliable path for your setup.