<p>Typically, if it's from a registry, you see that in the name of the image (if it's not from the default registry, Docker Hub). Images from Quay look like <code>quay.io/&lt;namespace&gt;/&lt;image name&gt;:&lt;tag&gt;</code>. </p>

<p>Some images are from <em>from</em> anywhere else at all. For example images that are <code>FROM: scratch</code> and images created via <code>docker import</code> will not be associated with any registry. These are the famous <code>none:none</code> images (no repository and no tag). In this case, you only have the ID (SHA) and you need do be Sherlock Holmes (or Jessie Frazelle) to match it with something.</p>

<p>So, you can only see what is written in the manifest. Should you trust it? The manifest can be signed, using <a href="https://docs.docker.com/engine/security/trust/content_trust/" rel="noreferrer">docker content trust</a> even if the image contents themselves are not.  If you need more certainty on the provenance, you probably need <a href="https://github.com/theupdateframework/notary" rel="noreferrer">notary </a> to ensure that trust is maintained throughout the delegation chain.</p>

<p>Hope that answers the question.</p>

CC BY-SA 4.0
2018-12-04T18:23:39.040Z
2018-12-04T18:23:39.040Z
Bruce Becker
<p>I have a Docker image on my system <code>12346789ABCD</code>.</p>

<p>Is there a way to know where it is coming from?</p>

<p>Specifically, I would like to know if it was built locally or downloaded from a repository, and in that latter case, downloaded from which repository.</p>

CC BY-SA 4.0
2018-12-04T17:00:23.913Z
Hi, not an answer but  maybe first hint - https://stackoverflow.com/questions/44769315/how-to-see-docker-image-contents
Ta Mu
CC BY-SA 4.0
2018-12-04T17:04:21.523Z
Also: https://www.projectatomic.io/blog/2015/07/what-are-docker-none-none-images/
Ta Mu
CC BY-SA 4.0
2018-12-04T17:09:27.907Z
Thanks @Peter. I've already investigated `docker inspect`: `docker inspect -f '{{json .}}' debian | jq '{RepoTags,RepoDigests}'` The presence of RepoTags and RepoDigest is a clue the image was downloaded. But I can't see from where.
Sylvain Leroux
CC BY-SA 4.0
2018-12-04T17:50:31.170Z
Consider starting a container to explore contents.
Ta Mu
<docker>
How to know where a docker image came from?
Sylvain Leroux
# How to know where a docker image came from?

(Asked by: username_0 on 2018-12-04)

I have a Docker image on my system `12346789ABCD`.

Is there a way to know where it is coming from?

Specifically, I would like to know if it was built locally or downloaded from a repository, and in that latter case, downloaded from which repository.

**Tags:** docker

> **Comments:**
> **username_1**: Hi, not an answer but  maybe first hint - https://stackoverflow.com/questions/44769315/how-to-see-docker-image-contents  
> **username_1**: Also: https://www.projectatomic.io/blog/2015/07/what-are-docker-none-none-images/  
> **username_0**: Thanks @Peter. I've already investigated `docker inspect`: `docker inspect -f '{{json .}}' debian | jq '{RepoTags,RepoDigests}'` The presence of RepoTags and RepoDigest is a clue the image was downloaded. But I can't see from where.  
> **username_1**: Consider starting a container to explore contents.  

---

## 1 answers

### Answer by username_2 on 2018-12-04. Score: 5 | Accepted answer

Typically, if it's from a registry, you see that in the name of the image (if it's not from the default registry, Docker Hub). Images from Quay look like `quay.io//:`.

Some images are from *from* anywhere else at all. For example images that are `FROM: scratch` and images created via `docker import` will not be associated with any registry. These are the famous `none:none` images (no repository and no tag). In this case, you only have the ID (SHA) and you need do be Sherlock Holmes (or Jessie Frazelle) to match it with something.

So, you can only see what is written in the manifest. Should you trust it? The manifest can be signed, using [docker content trust](https://docs.docker.com/engine/security/trust/content_trust/) even if the image contents themselves are not. If you need more certainty on the provenance, you probably need [notary](https://github.com/theupdateframework/notary)  to ensure that trust is maintained throughout the delegation chain.

Hope that answers the question.


---

