What causes "getting digest: %w" in GoogleContainerTools/skaffold?

Upgrade the Docker daemon to a version that returns digests in build aux output

getting digest: %w

Error message

getting digest: %w

What it means

After the build, if no imageID (digest) was returned via aux messages — some older Docker versions omit it — Build looks the image up by tag with ImageID. If that lookup fails, the digest cannot be determined and the build is reported as failed with `getting digest`.

Source

Thrown at pkg/skaffold/docker/image.go:412

			return
		}
		imageID = result.ID
	}

	if err := streamDockerMessages(out, resp.Body, auxCallback); err != nil {
		var jm *jsonstream.Error
		if errors.As(err, &jm) {
			return "", fmt.Errorf("docker build failure: %w", err)
		}
		return "", fmt.Errorf("unable to stream build output: %w", err)
	}

	if imageID == "" {
		// Maybe this version of Docker doesn't return the digest of the image
		// that has been built.
		imageID, err = l.ImageID(ctx, opts.Tag)
		if err != nil {
			return "", fmt.Errorf("getting digest: %w", err)
		}
	}

	return imageID, nil
}

// streamDockerMessages streams formatted json output from the docker daemon
func streamDockerMessages(dst io.Writer, src io.Reader, auxCallback func(jsonstream.Message)) error {
	termFd, isTerm := term.IsTerminal(dst)
	return progress.DisplayJSONMessagesStream(src, dst, termFd, isTerm, auxCallback)
}

// Push pushes an image reference to a registry. Returns the image digest.
func (l *localDaemon) Push(ctx context.Context, out io.Writer, ref string) (string, error) {
	registryAuth, err := l.encodedRegistryAuth(ctx, DefaultAuthHelper, ref)
	if err != nil {
		return "", fmt.Errorf("getting auth config for %q: %w", ref, err)
	}

View on GitHub (pinned to a1189de023)

Solutions

Upgrade the Docker daemon to a version that returns digests in build aux output
Confirm the image exists with `docker images` under the exact tag used
Re-run the build; a race with another retag/prune job may have removed the tag
Check daemon connectivity and API version negotiation

Defensive patterns

Strategy: fallback

Try / catch

imageID, err := daemon.Build(...)
if err != nil && strings.Contains(err.Error(), "getting digest") {
	// fall back to looking the image up manually by tag
	imageID, lookupErr := daemon.ImageID(ctx, tag)
	if lookupErr != nil { return lookupErr }
}

Prevention

Use a reasonably recent Docker daemon that streams digests via aux messages
Avoid concurrent retag/prune jobs targeting the same tags during builds

When it happens

Trigger: The build succeeded but the daemon did not return an aux digest (older daemon API version), and the subsequent ImageID(ctx, opts.Tag) call fails — image not found under that tag, daemon query error, or auth failure.

Common situations: Old Docker daemon versions that don't stream digest aux messages; the tag was retagged/removed by a concurrent job between build and lookup; daemon API version mismatch.

Related errors

AI-assisted analysis of GoogleContainerTools/skaffold@a1189de023 (2026-09-05). Data as JSON: /api/errors/98e4d65fff59e168. Report an issue: GitHub.