I want to build a very simple system (thinking some lines of Python) that converts a given docker tag (e.g. ubuntu:latest) to the SHA256 digest of the image that tag is currently pointing to.
I'm aware that if we have Docker installed, we can simply pull and then list out the digest of the pulled image. I was thinking whether this can be achieved without actually pulling the image.
The Docker client does not (appear to) surface this functionality so you'll need to use a Registry client SDK. I am using Golang and have been unable to find an SDK that's easy-to-use and works across registries (I'm interested in using Google Container Registry in addition to Docker Hub). You may be more successful with Python.
I've been working on a project with container image manifests and wrote a Medium post about how to enumerate manifests and manifest digests:
https://medium.com/google-cloud/adventures-w-docker-manifests-78f255d662ff
NB There are some inconsistencies with Docker Hub's implementation of the Docker Registry HTTP v2 API. For what it is worth, Google Container Registry (GCR) accurately implements the Registry API. I work for Google albeit not in the GCR team.