Rules_docker: Docker images created by `docker_build` are missing sha:256 digests

[greggdonovan]

I'd like to use the sha:256 digests of Docker images in my Kubernetes manifests so that my K8S manifests only change if the content of the docker images changes.

However, I don't see the DIGEST field in the docker images built by docker_build.

$ docker images --digests
REPOSITORY                                TAG                            DIGEST                                                                    IMAGE ID            CREATED             SIZE
gcr.io/our-gcp-project/our-base-image     created-by-docker          sha256:ae272ac453c0bbeab222b1c5c65d7d5a9caf507edb8b750702a43058079586cd   08c7690013b4        6 days ago          198MB
bazel/our/rules_docker_img                   created-by-bazel                   <none>                                                                    ff5382112f0d        48 years ago        108MB

[jonjohnsonjr]

The digest isn't known until an image is pushed because computing an image's digest involves gzipping all of its layers. This zipping is expensive, so it's done lazily at push time. I believe docker handles this similarly and doesn't display the digest of a locally-built image until after you push it.

The digest should get printed here if you do a container_push.

The discussion in #63 is somewhat relevant, and you might want to check out rules_k8s if you want to reify this dependency within bazel's dependency graph.

[greggdonovan]

Thanks, @jonjohnsonjr! That's very helpful. We will definitely check out rules_k8s.