# regctl manifest get: Read a Manifest or Index

> regctl manifest get prints the manifest or multi-arch index for a reference and resolves digests, all without a daemon. Reference for --platform, --format, and CI errors.

Source: https://latchkey.dev/learn/command-reference/regctl-manifest-get  
Updated: 2026-06-30

regctl manifest get fetches the manifest or index for an image reference and can print the resolved digest, without a Docker daemon.

regctl manifest get is the regclient way to inspect what a tag points to: the raw manifest, the platform list, or just the digest for pinning.

## What it does

regctl manifest get retrieves the manifest (or manifest list) for a reference. With `--format` it can print the raw body, a specific field, or the digest; with `--platform` it resolves a single platform from an index.

## Common usage

```Terminal
# print the manifest / index
regctl manifest get ghcr.io/acme/app:1.4.0

# just the digest, for pinning
regctl manifest get --format '{{.GetDescriptor.Digest}}' ghcr.io/acme/app:1.4.0

# one platform from a multi-arch index
regctl manifest get --platform linux/amd64 docker.io/library/alpine:3.20
```

## Options

| Flag | What it does |
| --- | --- |
| REF | The image reference (positional) |
| --platform os/arch | Resolve one platform from a multi-arch index |
| --format <tmpl> | Go-template output, e.g. the digest or raw body |
| --require-list | Fail unless the reference is a manifest list/index |

## In CI

Use the `--format {{.GetDescriptor.Digest}}` form to resolve a tag to an immutable digest and pin your deploy, the daemonless equivalent of docker inspect RepoDigests. `--require-list` asserts an image is genuinely multi-arch before promotion.

## Common errors in CI

"manifest not found" means the tag or digest does not exist. "401 Unauthorized" means log in first. A template that prints nothing usually references a field name that does not exist for that manifest type; check whether it is an index or a single manifest. `--require-list` on a single-arch image fails by design.

## FAQ

### regctl manifest get: Read a Manifest or Index?

regctl manifest get is the regclient way to inspect what a tag points to: the raw manifest, the platform list, or just the digest for pinning.

### What it does?

regctl manifest get retrieves the manifest (or manifest list) for a reference. With --format it can print the raw body, a specific field, or the digest; with --platform it resolves a single platform from an index.

### In CI?

Use the --format {{.GetDescriptor.Digest}} form to resolve a tag to an immutable digest and pin your deploy, the daemonless equivalent of docker inspect RepoDigests. --require-list asserts an image is genuinely multi-arch before promotion.

### Common errors in CI?

"manifest not found" means the tag or digest does not exist. "401 Unauthorized" means log in first. A template that prints nothing usually references a field name that does not exist for that manifest type; check whether it is an index or a single manifest. --require-list on a single-arch image fails by design.

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt