如何判断本地构建镜像是否存在于AWS ECR？无需拉取获取镜像摘要

Great question! The confusion here comes from the difference between two types of digests in Docker/ECR: manifest digests (what list_images returns) and config digests (which matches your local image ID).

Your local image ID is actually the SHA-256 digest of the image's configuration blob, whereas the manifest digest is a hash of the entire manifest file (which includes references to all the image layers plus the config blob). To check if your local image exists in ECR without pulling it, you need to fetch the config digest from ECR and compare it to your local image's ID.

Here's how to do it step by step:

1. Fetch all config digests from your ECR repository #

First, we'll use list_images to get all manifest digests, then use batch_get_image to retrieve the full manifest for each, and extract the config digest from there. Note that batch_get_image has a limit of 100 images per call, so we'll handle pagination if needed:

import boto3
import json

client = boto3.client('ecr')
repo_name = "your-repo-name"
repo_id = "your-registry-id"

# Get all manifest digests from the repo (handle pagination)
ecr_manifest_digests = []
next_token = None
while True:
    response = client.list_images(
        repositoryName=repo_name,
        registryId=repo_id,
        nextToken=next_token
    )
    ecr_manifest_digests.extend([img['imageDigest'] for img in response['imageIds']])
    next_token = response.get('nextToken')
    if not next_token:
        break

# Batch fetch full manifests and extract config digests
ecr_config_digests = set()
# Split into chunks of 100 (max for batch_get_image)
for i in range(0, len(ecr_manifest_digests), 100):
    chunk = ecr_manifest_digests[i:i+100]
    batch_response = client.batch_get_image(
        repositoryName=repo_name,
        registryId=repo_id,
        imageIds=[{'imageDigest': digest} for digest in chunk]
    )
    for image in batch_response['images']:
        manifest = json.loads(image['imageManifest'])
        # Extract config digest, strip the "sha256:" prefix to match local image ID
        config_digest = manifest['config']['digest'].split('sha256:')[-1]
        ecr_config_digests.add(config_digest)

2. Get your local image's ID #

Using the Docker Python API, you already have this covered, but here's a quick recap:

import docker

docker_client = docker.from_env()
# Build your image (or fetch an existing one by tag)
image, build_logs = docker_client.build(path="./your-docker-directory")
local_image_id = image.id  # This is the config digest without the "sha256:" prefix

3. Compare the two #

Now just check if your local image ID is in the set of ECR config digests:

if local_image_id in ecr_config_digests:
    print("✅ This image already exists in ECR!")
else:
    print("❌ This image is not present in ECR.")

Bonus: Check by image tag (more efficient) #

If you're tagging your images (e.g., my-app:v1), you can skip fetching all images and directly query the manifest for that tag. This is much faster if you know the tag you're working with:

tag = "v1"
try:
    response = client.batch_get_image(
        repositoryName=repo_name,
        registryId=repo_id,
        imageIds=[{'imageTag': tag}]
    )
    if response['images']:
        manifest = json.loads(response['images'][0]['imageManifest'])
        ecr_config_digest = manifest['config']['digest'].split('sha256:')[-1]
        if ecr_config_digest == local_image_id:
            print(f"✅ Image with tag {tag} matches your local image in ECR.")
        else:
            print(f"⚠️ Tag {tag} exists in ECR but points to a different image.")
    else:
        print(f"❌ Tag {tag} does not exist in ECR.")
except client.exceptions.ImageNotFoundException:
    print(f"❌ Tag {tag} does not exist in ECR.")

Key Notes #

• The manifest digest changes if any part of the manifest (layers or config) changes, but the config digest only changes if the image's configuration (like CMD, ENV, WORKDIR, etc.) or layer content changes.
• Using batch_get_image is efficient because it lets you fetch multiple manifests in one API call, avoiding rate limits.

内容的提问来源于stack exchange，提问作者djsumdog