skopeo inspect: Read Image Metadata
skopeo inspect prints an image manifest, labels, and digest directly from a registry without downloading the image.
Often you only need an image digest, its labels, or its platform list. skopeo inspect fetches just the metadata, which is fast and avoids pulling gigabytes of layers.
What it does
skopeo inspect queries a registry for an image and returns its tag list, digest, created time, labels, and layer digests as JSON. --config returns the OCI config blob, and --raw returns the unprocessed manifest (useful for manifest lists).
Common usage
skopeo inspect docker://ghcr.io/org/app:ci
# just the digest, scriptable
skopeo inspect docker://ghcr.io/org/app:ci \
| jq -r .Digest
# the raw manifest list to see architectures
skopeo inspect --raw docker://ghcr.io/org/app:ci | jq .Options
| Flag | What it does |
|---|---|
| --config | Return the image config blob instead of the manifest |
| --raw | Return the raw manifest (or manifest list) |
| --creds user:pass | Authenticate to the registry |
| --tls-verify=false | Disable TLS verification (testing only) |
| -n, --no-tags | Skip listing the repository tags |
In CI
Pull the digest with skopeo inspect ... | jq -r .Digest to sign or deploy by immutable digest rather than a mutable tag. Use --raw to detect whether a reference is a multi-arch manifest list before deciding to copy with --all.
Common errors in CI
"manifest unknown" means the tag does not exist or the repo path is wrong. "unauthorized" means missing creds; add --creds or run skopeo login first. A jq error like "Cannot index string" usually means inspect returned an error string instead of JSON because the request failed; check the raw output.