How to update a Docker image digest without pulling the image

Often times I’m working in a repo where I want to update the digest of a Docker image. Usually that means navigating to the container registry in some form of console or UI and sorting to find the tag that I want and the latest digest. Pretty easy for a public registry like Docker Hub, but less convenient for a corporate registry that I need to login to see.

I recently came across the docker buildx imagetools inspect¹ command.

docker buildx imagetools inspect redis:7.4.1

It spits out the following output where Manifests is a list of manifests for different platforms. In this case I can grab the image index² digest and update the Docker image without worrying about what platform other users of the Docker image use.

Name:      docker.io/library/redis:7.4.1
MediaType: application/vnd.oci.image.index.v1+json
Digest:    sha256:af0be38eb8e43191bae9b03fe5c928803930b6f93e2dde3a7ad1165c04b1ce22

Manifests:
  Name:        docker.io/library/redis:7.4.1@sha256:126cc4da63a39000ce527ae644b880d26608d27d8b7d35b3ee37670f5ee55eea
  MediaType:   application/vnd.oci.image.manifest.v1+json
  Platform:    linux/amd64
  Annotations:
    ...

docker manifest inspect looks like it would be helpful as well. But it only shows the digests of each of the individual images rather than the image index.

Pulling a Docker image (docker pull redis:7.4.1) and inspecting the image (docker image inspect redis:7.4.1) also shows image index digest of af0be38eb8e43191bae9b03fe5c928803930b6f93e2dde3a7ad1165c04b1ce22 even though it’s a platform specific image. The downside here is the image needs to be downloaded.