# skopeo inspect: Read Image Metadata Without Pulling

> skopeo inspect prints an image manifest, config, and labels straight from a registry without pulling it. Reference for --raw, --config, --creds, and CI errors.

Source: https://latchkey.dev/learn/command-reference/skopeo-inspect-remote  
Updated: 2026-06-30

skopeo inspect fetches an image manifest and config from a registry and prints them as JSON without downloading the layers.

To read labels, the digest, or the exposed ports of a remote image you do not need to pull it. skopeo inspect reads the metadata directly and is easy to pipe into jq.

## What it does

skopeo inspect retrieves an image manifest and config document from the registry and prints a JSON summary (tags, digest, layers, labels, architecture). With `--raw` it prints the raw manifest exactly as served, useful for checking a multi-arch index.

## Common usage

```Terminal
# high-level summary as JSON
skopeo inspect docker://ghcr.io/acme/app:1.4.0

# raw manifest (see if it is a manifest list)
skopeo inspect --raw docker://alpine:3.20 | jq .

# just the digest and labels
skopeo inspect docker://ghcr.io/acme/app:1.4.0 \
  | jq -r '.Digest, .Labels'
```

## Options

| Flag | What it does |
| --- | --- |
| --raw | Print the raw manifest as served (no interpretation) |
| --config | Print the image config blob instead of the manifest |
| --creds user:pass | Registry credentials for a private image |
| --tls-verify=false | Skip TLS verification (insecure registry) |
| --override-arch <arch> | Inspect a specific architecture from an index |

## In CI

Use skopeo inspect to resolve a tag to its immutable digest before a deploy, so the pipeline pins `image@sha256:...` instead of a moving tag. It reads metadata only, so it is fast and cheap even against large images.

## Common errors in CI

"unauthorized: authentication required" needs `--creds` or `skopeo login`. "manifest unknown" means the tag does not exist. "Error parsing image name ... Invalid reference format" usually means the `docker://` transport prefix was omitted. On a manifest list, plain inspect may error "choose an instance from the manifest list"; add `--raw` or `--override-arch amd64`.

## FAQ

### skopeo inspect: Read Image Metadata Without Pulling?

To read labels, the digest, or the exposed ports of a remote image you do not need to pull it. skopeo inspect reads the metadata directly and is easy to pipe into jq.

### What it does?

skopeo inspect retrieves an image manifest and config document from the registry and prints a JSON summary (tags, digest, layers, labels, architecture). With --raw it prints the raw manifest exactly as served, useful for checking a multi-arch index.

### In CI?

Use skopeo inspect to resolve a tag to its immutable digest before a deploy, so the pipeline pins image@sha256:... instead of a moving tag. It reads metadata only, so it is fast and cheap even against large images.

### Common errors in CI?

"unauthorized: authentication required" needs --creds or skopeo login. "manifest unknown" means the tag does not exist. "Error parsing image name ... Invalid reference format" usually means the docker:// transport prefix was omitted.

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt