Hey there, let's work through your two Jenkins Docker image issues together:

1. Why the jenkins:2.60.3 digest doesn't match after docker pull #

There are a few common reasons for this mismatch, along with actionable fixes:

• Architecture discrepancy
  Docker Hub typically displays the digest for the amd64 architecture by default, but if your machine runs on a different architecture (like arm64 or ppc64le), you’ll pull a unique image variant with its own digest. To pull the exact variant matching the Docker Hub digest, specify the platform explicitly:

  docker pull --platform linux/amd64 jenkins:2.60.3
  

  Verify the digest afterward with:

  docker inspect --format='{{.RepoDigests}}' jenkins:2.60.3
  

• Tag re-pushed by maintainers
  Even with a fixed version tag like 2.60.3, maintainers sometimes update the image under that tag (e.g., to patch security vulnerabilities). The digest you saw on Docker Hub might belong to an older iteration of the tag. To pull the exact image matching that digest directly, use the digest instead of the tag:

  docker pull jenkins@sha256:cd14cecfdb3a657ba7d05bea026e7ac8b9abafc6e5c66253ab327c7211fa6281
  

  (Note: Convert Docker Hub’s sha256-xxx format to sha256:xxx for the pull command)

• Local Docker cache
  Your local Docker daemon might be holding a cached version of the image. Clear the cache first:

  docker rmi jenkins:2.60.3
  

  Re-run the pull command and check the digest again.

2. How to find the SHA digest for jenkins:latest #

The Docker Hub tags page doesn’t always display the latest digest directly, but these methods will help you retrieve it:

• Docker Manifest Inspect
  Use the docker manifest command to fetch architecture-specific digests for the latest tag. First enable experimental features (required for Docker Desktop):

  docker config set experimental true
  

  Then run:

  docker manifest inspect jenkins:latest
  

  Look for the digest field under the architecture you need (e.g., amd64).

• Docker Hub API
  Query the Docker Hub API directly to get the latest digest. Use curl (and jq for optional formatting):

  # Get raw JSON response
  curl -s https://hub.docker.com/v2/repositories/library/jenkins/tags/latest
  # Filter to get amd64 digest with jq
  curl -s https://hub.docker.com/v2/repositories/library/jenkins/tags/latest | jq '.images[] | select(.architecture == "amd64") | .digest'
  

• Skopeo Tool
  Skopeo is a lightweight tool for inspecting container images without pulling them. Install it, then run:

  skopeo inspect docker://docker.io/jenkins:latest
  

  The output will include the Digest field for the image (and variants for different architectures).

内容的提问来源于stack exchange，提问作者Ashar