skopeo inspect: Read Image Metadata Without Pulling
skopeo inspect fetches an image manifest and config from a registry and prints them as JSON without downloading the layers.
To read labels, the digest, or the exposed ports of a remote image you do not need to pull it. skopeo inspect reads the metadata directly and is easy to pipe into jq.
What it does
skopeo inspect retrieves an image manifest and config document from the registry and prints a JSON summary (tags, digest, layers, labels, architecture). With --raw it prints the raw manifest exactly as served, useful for checking a multi-arch index.
Common usage
# high-level summary as JSON
skopeo inspect docker://ghcr.io/acme/app:1.4.0
# raw manifest (see if it is a manifest list)
skopeo inspect --raw docker://alpine:3.20 | jq .
# just the digest and labels
skopeo inspect docker://ghcr.io/acme/app:1.4.0 \
| jq -r '.Digest, .Labels'Options
| Flag | What it does |
|---|---|
| --raw | Print the raw manifest as served (no interpretation) |
| --config | Print the image config blob instead of the manifest |
| --creds user:pass | Registry credentials for a private image |
| --tls-verify=false | Skip TLS verification (insecure registry) |
| --override-arch <arch> | Inspect a specific architecture from an index |
In CI
Use skopeo inspect to resolve a tag to its immutable digest before a deploy, so the pipeline pins image@sha256:... instead of a moving tag. It reads metadata only, so it is fast and cheap even against large images.
Common errors in CI
"unauthorized: authentication required" needs --creds or skopeo login. "manifest unknown" means the tag does not exist. "Error parsing image name ... Invalid reference format" usually means the docker:// transport prefix was omitted. On a manifest list, plain inspect may error "choose an instance from the manifest list"; add --raw or --override-arch amd64.