How to find the creation date of an image in a (private) Docker registry (API v2)?

Question

I would like to find out the latest timestamp for an image in a private Docker registry using the v2 API without first pulling the image to my local host.

Solution 1

So after some hacking around, I got the following to work using the curl and jq tools:

curl -X GET http://registry:5000/v2/<IMAGE>/manifests/<TAG> \
    | jq -r '.history[].v1Compatibility' \
    | jq '.created' \
    | sort \
    | tail -n1

This seems to work but I don't really know how the v1 Compatibility representation is to be interpreted so I don't know if I am really getting the correct number out of this.

Comments on this are welcome!

Solution 2

A minor improvement to the answer from @snth : print the date more user friendly by using date:

date --date=$(curl -s -X GET http://$REGISTRY:5000/v2/$IMAGE/manifests/$TAG | \
  jq -r '.history[].v1Compatibility' | jq -r '.created' | sort | tail -n 1 )

Prints something like:

Fr 12. Okt 15:26:03 CEST 2018

Solution 3

Compiling the comments and answers above here is a complete solution

With Authentication

# Setup variables to make this more usalbe
USERNAME=docker_user
PASSWORD=docker_pass
DOCKER_REGISTRY=http://my-registry.myorg.org:9080
REPO=myrepo
TAG=atag

# Query Registry and pipe results to jq

DOCKER_DATE=$(curl -s -u $USERNAME:$PASSWORD -H 'Accept: application/vnd.docker.distribution.manifest.v1+json' -X GET http://$REGISTRY_URL/v2/circle-lb/manifests/master | jq -r '[.history[]]|map(.v1Compatibility|fromjson|.created)|sort|reverse|.[0]')
echo "Date for $REPO:$TAG is $DOCKER_DATE"

Without Authentication

DOCKER_DATE=$(curl -s -H 'Accept: application/vnd.docker.distribution.manifest.v1+json' -X GET http://$REGISTRY_URL/v2/circle-lb/manifests/master | jq -r '[.history[]]|map(.v1Compatibility|fromjson|.created)|sort|reverse|.[0]')

And lastly if you want to parse with the date command (gnu date)

on linux:

date -d $DOCKER_DATE

on mac:

gdate -d $DOCKER_DATE

Solution 4

With the V2 image manifest, schema version 2, the response from http://registry:5000/v2/<IMAGE>/manifests/<TAG> does not contain the 'history' field, and I haven't found a way to retrieve the image creation date in one request. However one can use another request to obtain it, based on the image manifest config's digest.

First, get the config's digest (notice the header which specifies the schema version):

digest=$(curl -H 'Accept: application/vnd.docker.distribution.manifest.v2+json' \
 http://registry:5000/v2/<IMAGE>/manifests/<TAG> \
 | jq -r '.config.digest')

The value of digest will be something similar to sha256:ec4b8955958665577945c89419d1af06b5f7636b4ac3da7f12184802ad867736.

Then, get the blob of the object identified by the digest, i.e. the configuration object for a container, and retrieve the creation date from there:

curl -H 'Accept: application/vnd.docker.distribution.manifest.v2+json' \
  http://registry:5000/v2/<IMAGE>/blobs/$digest | jq -r '.created'

This should produce:

2021-10-27T12:18:24.105617451Z

Bonus: Getting the creation dates using skopeo

I'm not sure if the above is the only or the best way, but by the way, it is apparently more or less what skopeo does under the hood when one runs:

skopeo inspect docker://registry:5000/<IMAGE>:<TAG>

The above command returns information about the image tag, among them the creation date:

{
  "Name": "registry:5000/<IMAGE>",
  "Digest": "sha256:655721ff613ee766a4126cb5e0d5ae81598e1b0c3bcf7017c36c4d72cb092fe9",
  "RepoTags": [...],
  "Created": "2021-10-27T12:18:24.105617451Z",
  ...
}

View more solutions

Comments

[Grief]

You have to accept your answer, I googled the whole day today and didn't find a better approach :(

[rsutormin]

Thanks for the comemnt @Grief

[Chris]

Thanks! As an excuse to learn more jq, I condensed the parsing into a single command: jq -r '[.history[]]|map(.v1Compatibility|fromjson|.created)|sort|.‌​[0]

[Chris]

Oops, forgot the reverse: jq -r '[.history[]]|map(.v1Compatibility|fromjson|.created)|sort|r‌​everse|.[0]

[JJarava]

Doing some checking on this, isn't always the fist Object in the "history" the latest one?? I'm getting the same results using jq -r '[.history[0]]|map(.v1Compatibility|fromjson|.created)

[Bharat]

If your manifest schema version is v2, you may not see the history and v1Compatibility fields. If this is the case, you may need to force schema v1 using an Accept header. So your command would then be curl -X GET -H 'Accept: application/vnd.docker.distribution.manifest.v1+json' ...

[Mikha]

Thanks, the date helps! To make the others' life a bit easier - inside $(...), it's like the command in accepted answer, but the "jq -r '.created'" bit has '-r' flag

[Stav Alfi]

it doesn't work for me: hub.docker.com/v2/redis/manifests/latest - 404 - what is the problem?