title: Why is a parent container image SHA not listed in the layers of the child?
body: <p>Consider a container image, lets call it <code>BaseContainerImage</code>.  I build this container image based off a container image on docker hub (the .Net Core 3.1 runtime if it matters).  By &quot;based off&quot; I mean that the <code>FROM</code> references that docker hub image.</p>
  <p>When I build it, it gets a SHA of: <code>sha256:9ec7b7481feee3eb141f7321be1df353b1ab8b6bdf0d871717b6f7e90e6ed0f6</code>.  (Found by checking <code>config</code>.<code>digest</code> of the container image's manifest.)</p>
  <p>Then I go make a new container image, lets call it <code>ApplicationContainerImage</code>. It is based off the <code>BaseContainerImage</code>, using a tag that refers to the above SHA.  After I build it, I look at the container image's manifest.</p>
  <p>I expected the <code>layers</code> section to contain the SHA of the &quot;parent&quot; container image.  <strong>But it does not.</strong></p>
  <p>When I compare the layers of both, all the layers of the <code>BaseContainerImage</code> are in the <code>ApplicationContainerImage</code>.  So I know that the <code>FROM</code> working.  But I just don't understand why the SHA of the <code>BaseContainerImage</code> is left out of the layers of the <code>ApplicationContainerImage</code>.</p>
  <p><strong>Why is the SHA of the <code>BaseContainerImage</code> not listed in layers of the <code>ApplicationContainerImage</code>?</strong></p>
  <p>Later Notes:<br />
  When I went and downloaded the <code>BaseContainerImage</code> from a remote repository, it tells me (as part of the <code>PULL</code> command ouput that the Digest is <code>Digest: sha256:a1dd2dfdfc51e7abba1d2db319ba457e7b72f7258f5cefca0ee6ec6845f564b6</code>  Which clearly does not match the above digest.  But when I run <code>docker manifest inspect</code> the the exact same image, the <code>config</code>.<code>digest</code> is <code>sha256:9ec7b7481feee3eb141f7321be1df353b1ab8b6bdf0d871717b6f7e90e6ed0f6</code>, matching what I got earlier.</p>
  <p>Why are there two different SHA values?  Is one just for the pull action somehow?</p>