skopeo inspect prints an image manifest, labels, and digest directly from a registry without downloading the image.
Often you only need an image digest, its labels, or its platform list. skopeo inspect fetches just the metadata, which is fast and avoids pulling gigabytes of layers.
What it does
skopeo inspect queries a registry for an image and returns its tag list, digest, created time, labels, and layer digests as JSON. --config returns the OCI config blob, and --raw returns the unprocessed manifest (useful for manifest lists).
Common usage
Terminal
skopeo inspect docker://ghcr.io/org/app:ci
# just the digest, scriptable
skopeo inspect docker://ghcr.io/org/app:ci \
| jq -r .Digest
# the raw manifest list to see architectures
skopeo inspect --raw docker://ghcr.io/org/app:ci | jq .
Options
Flag
What it does
--config
Return the image config blob instead of the manifest
--raw
Return the raw manifest (or manifest list)
--creds user:pass
Authenticate to the registry
--tls-verify=false
Disable TLS verification (testing only)
-n, --no-tags
Skip listing the repository tags
In CI
Pull the digest with skopeo inspect ... | jq -r .Digest to sign or deploy by immutable digest rather than a mutable tag. Use --raw to detect whether a reference is a multi-arch manifest list before deciding to copy with --all.
Common errors in CI
"manifest unknown" means the tag does not exist or the repo path is wrong. "unauthorized" means missing creds; add --creds or run skopeo login first. A jq error like "Cannot index string" usually means inspect returned an error string instead of JSON because the request failed; check the raw output.
Frequently asked questions
skopeo inspect: Read Image Metadata?
Often you only need an image digest, its labels, or its platform list. skopeo inspect fetches just the metadata, which is fast and avoids pulling gigabytes of layers.
What it does?
skopeo inspect queries a registry for an image and returns its tag list, digest, created time, labels, and layer digests as JSON. --config returns the OCI config blob, and --raw returns the unprocessed manifest (useful for manifest lists).
In CI?
Pull the digest with skopeo inspect ... | jq -r .Digest to sign or deploy by immutable digest rather than a mutable tag. Use --raw to detect whether a reference is a multi-arch manifest list before deciding to copy with --all.
Common errors in CI?
"manifest unknown" means the tag does not exist or the repo path is wrong. "unauthorized" means missing creds; add --creds or run skopeo login first. A jq error like "Cannot index string" usually means inspect returned an error string instead of JSON because the request failed; check the raw output.
