Answers: <p>Typically, if it's from a registry, you see that in the name of the image (if it's not from the default registry, Docker Hub). Images from Quay look like <code>quay.io/&lt;namespace&gt;/&lt;image name&gt;:&lt;tag&gt;</code>. </p>
  
  <p>Some images are from <em>from</em> anywhere else at all. For example images that are <code>FROM: scratch</code> and images created via <code>docker import</code> will not be associated with any registry. These are the famous <code>none:none</code> images (no repository and no tag). In this case, you only have the ID (SHA) and you need do be Sherlock Holmes (or Jessie Frazelle) to match it with something.</p>
  
  <p>So, you can only see what is written in the manifest. Should you trust it? The manifest can be signed, using <a href="https://docs.docker.com/engine/security/trust/content_trust/" rel="noreferrer">docker content trust</a> even if the image contents themselves are not.  If you need more certainty on the provenance, you probably need <a href="https://github.com/theupdateframework/notary" rel="noreferrer">notary </a> to ensure that trust is maintained throughout the delegation chain.</p>
  
  <p>Hope that answers the question.</p>
  
Answers: CC BY-SA 4.0
Answers: 2018-12-04T18:23:39.040Z
Answers: 2018-12-04T18:23:39.040Z
Answers: Bruce Becker
Body: <p>I have a Docker image on my system <code>12346789ABCD</code>.</p>
  
  <p>Is there a way to know where it is coming from?</p>
  
  <p>Specifically, I would like to know if it was built locally or downloaded from a repository, and in that latter case, downloaded from which repository.</p>
  
Comments: CC BY-SA 4.0
Comments: 2018-12-04T17:00:23.913Z
Comments: Hi, not an answer but  maybe first hint - https://stackoverflow.com/questions/44769315/how-to-see-docker-image-contents
Comments: Ta Mu
Comments: CC BY-SA 4.0
Comments: 2018-12-04T17:04:21.523Z
Comments: Also: https://www.projectatomic.io/blog/2015/07/what-are-docker-none-none-images/
Comments: Ta Mu
Comments: CC BY-SA 4.0
Comments: 2018-12-04T17:09:27.907Z
Comments: Thanks @Peter. I've already investigated `docker inspect`: `docker inspect -f '{{json .}}' debian | jq '{RepoTags,RepoDigests}'` The presence of RepoTags and RepoDigest is a clue the image was downloaded. But I can't see from where.
Comments: Sylvain Leroux
Comments: CC BY-SA 4.0
Comments: 2018-12-04T17:50:31.170Z
Comments: Consider starting a container to explore contents.
Comments: Ta Mu
Tags: <docker>
Title: How to know where a docker image came from?
UserDisplayName: Sylvain Leroux
ThreadText: # How to know where a docker image came from?
  
  (Asked by: username_0 on 2018-12-04)
  
  I have a Docker image on my system `12346789ABCD`.
  
  Is there a way to know where it is coming from?
  
  Specifically, I would like to know if it was built locally or downloaded from a repository, and in that latter case, downloaded from which repository.
  
  **Tags:** docker
  
  > **Comments:**
  > **username_1**: Hi, not an answer but  maybe first hint - https://stackoverflow.com/questions/44769315/how-to-see-docker-image-contents  
  > **username_1**: Also: https://www.projectatomic.io/blog/2015/07/what-are-docker-none-none-images/  
  > **username_0**: Thanks @Peter. I've already investigated `docker inspect`: `docker inspect -f '{{json .}}' debian | jq '{RepoTags,RepoDigests}'` The presence of RepoTags and RepoDigest is a clue the image was downloaded. But I can't see from where.  
  > **username_1**: Consider starting a container to explore contents.  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_2 on 2018-12-04. Score: 5 | Accepted answer
  
  Typically, if it's from a registry, you see that in the name of the image (if it's not from the default registry, Docker Hub). Images from Quay look like `quay.io/<namespace>/<image name>:<tag>`.
  
  Some images are from *from* anywhere else at all. For example images that are `FROM: scratch` and images created via `docker import` will not be associated with any registry. These are the famous `none:none` images (no repository and no tag). In this case, you only have the ID (SHA) and you need do be Sherlock Holmes (or Jessie Frazelle) to match it with something.
  
  So, you can only see what is written in the manifest. Should you trust it? The manifest can be signed, using [docker content trust](https://docs.docker.com/engine/security/trust/content_trust/) even if the image contents themselves are not. If you need more certainty on the provenance, you probably need [notary](https://github.com/theupdateframework/notary)  to ensure that trust is maintained throughout the delegation chain.
  
  Hope that answers the question.
  
  
  ---
  
  