Docker Digest

source	condition	target
✔	✔	✗

source

condition

target

✔

✗

Description

The dockerdigest resource resolves a container image tag to the digest it currently points at, so deployments can pin an immutable reference instead of a mutable tag.

source: Returns the digest for image and tag, in the form jenkins/jenkins:lts-jdk11@sha256:….
condition: Checks that an image exists in the registry for the given digest - digest when set, otherwise the source output. A missing image reports the Docker image <ref> doesn’t exist. rather than erroring.
target: Not supported - a target fails with Target not supported for the plugin Docker Digest. Write the digest into a file with the "Yaml" or "File" resources.

Note	An `scm` is accepted but ignored, logging `scm is not supported, ignoring`. The lookup always goes to the registry.

Parameters

Name	Type	Description
architecture	string	architecture specifies the container image architecture such as `amd64` compatible: * source * condition default: amd64
digest	string	digest specifies the container image digest such as `sha256:ce782db15ab5491c6c6178da8431b3db66988ccd11512034946a9667846952a6` compatible: * condition default: When used from a condition, the default value is set to the linked source output.
hidetag	boolean	hideTag specifies if the tag should be hidden from the digest compatible: * source default: false
image	string	image specifies the container image such as `updatecli/updatecli` example: `updatecli/updatecli` compatible: * source * condition
password	string	password specifies the container registry password to use for authentication. Not compatible with token compatible: * source * condition * target default: by default credentials are fetch from the local environment such as `~/.docker/config.json`. remark: Not compatible with token
tag	string	tag specifies the container image tag such as `latest` compatible: * source * condition
token	string	token specifies the container registry token to use for authentication. compatible: * source * condition * target default: by default credentials are fetch from the local environment such as `~/.docker/config.json`. remark: Not compatible with username/password
username	string	username specifies the container registry username to use for authentication. compatible: * source * condition * target default: by default credentials are fetch from the local environment such as `~/.docker/config.json`. remark: Not compatible with token

image: Mandatory, e.g. updatecli/updatecli.
tag: Defaults to latest. It must not already contain a digest (a value starting with @ is rejected with invalid tag <image>: only contain a digest).
architecture: Defaults to amd64. Unset, the digest returned is that of the image index, valid on any platform; set, it is the digest of that one platform’s image. The two are different values for the same tag.
digest: Condition only, defaulting to the source output.
hidetag: Source only. Changes the shape of the returned value.

hidetag

By default the source keeps the tag alongside the digest, which stays readable in a diff while still pinning the exact image:

index.docker.io/jenkins/jenkins:lts-jdk11@sha256:ce782db15ab...

With hidetag: true the tag is dropped:

index.docker.io/jenkins/jenkins@sha256:ce782db15ab...

Authentication

Credentials are given inline on the spec. Depending on the registry, how you obtain a token differs.

Important

Storing credentials in an unencrypted manifest is a bad practice. Read them from the environment with '{{ requiredEnv "TOKEN" }}'.

GHCR

GitHub uses a personal access token (see Creating a personal access token).

DockerHub

The simplest route is to run docker login and read the token from ~/.docker/config.json:

"auths": {
        "https://index.docker.io/v1/": {
                "auth": "token"
        }
},

Example

This example uses a Go template, updatecli.tpl, with values from values.yaml, so that {{ requiredEnv "…" }} can read the GitHub token from the environment.

# updatecli.tpl
sources:
  lastDockerDigest:
    kind: dockerdigest
    spec:
      image: "jenkins/jenkins"
      tag: "lts-jdk11"
targets:
  imageTag:
    name: "jenkins/jenkins:lts-jdk11 docker digest"
    kind: yaml
    spec:
      file: "config/default/jenkins-release.yaml"
      key: "jenkins.master.imageTag"
    scm:
      github:
        user: "{{ .github.user }}"
        email: "{{ .github.email }}"
        owner: "jenkins-infra"
        repository: "charts"
        token: "{{ requiredEnv .github.token }}"
        username: "{{ .github.username }}"
        branch: "master"

# values.yaml
github:
  user: "updatebot"
  email: "updatebot@olblak.com"
  username: "jenkins-infra-bot"
  token: "UPDATECLI_GITHUB_TOKEN"
  branch: "master"
  owner: "olblak"
  repository: "charts"

What it says:

Source: Retrieve the digest of jenkins/jenkins:lts-jdk11 from DockerHub.
Target: Update the YAML key jenkins.master.imageTag in config/default/jenkins-release.yaml in the GitHub repository jenkins-infra/charts.

Docs

Title here

Docker Digest

Description

Parameters

hidetag

Authentication

GHCR

DockerHub

Example

Links

Docker Digest

Description#

Parameters#

hidetag#

Authentication#

GHCR#

DockerHub#

Example#

Links#

Description

Parameters

hidetag

Authentication

GHCR

DockerHub

Example

Links