[feature request] provide sha256 of image without pushing to registry

[excavador]

Particullary in rules_k8s you need to "resolve" image sha256 to replace tag by exact value of @sha256:XXX.
Would be great to have this information without interaction with remote registry.
It would provide way to build kubernetes manifest on build phase, without interaction with external world

[tristanz]

@nlopezgi is this fixed by #1023?

[nlopezgi]

container_image produces a digest since #445, but this issue was opened after that PR, so I'm not sure if something is missing.

#1023 is part of a migration we are doing, but specifically, I think that PR had to be temporarily reverted (details about that in #1051). Will close for now, but please let me know to reopen if the initial intent of the issue was different than what #445 does.

[tristanz]

@nlopezgi in my tests the image.digest sha256 does not match the digest returned after pushing to a registry. So unless I'm doing something wrong, this issue should remain open.

My understanding was that #1023 fixed it such that image.digest matched the registry digest, or was this something that was already possible?

[smukherj1]

@tristanz #1023 introduced the bug where the image.digest wouldn't match the registry digest. This was reverted in #1058. Could you please sync your rules_docker import in your WORKSPACE file to commit b4e5dd0fdd79e4a5d0eb475f1f372e1be2b287f0 or later and try again? If you still see a difference in the digest, this issue can be reopened.

[tristanz]

@smukherj1 I just checked from HEAD and it looks like docker push of a Bazel built images yields a different digest but container_push yields a matching digest. Is it expected that docker push and container_push don't match?

[smukherj1]

@tristanz Yes that is expected. The digest reported by an image registry is a sha256 sum of the image manifest. The generated image manifest can be different between Docker & Bazel. Note that the manifest should contain the same information but differences such as the order of the keys in the manifest or indentation can change the digest.