{"record":{"id":"a520c654da266fa3","repo":"docker/compose","slug":"failed-to-resolve-digest-for-s-w","errorCode":null,"errorMessage":"failed to resolve digest for %s: %w","messagePattern":"failed to resolve digest for (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/compose/pull.go","lineNumber":360,"sourceCode":"// It deliberately returns the registry descriptor digest — the multi-platform\n// index digest for multi-arch images — via DistributionInspect: a published\n// compose file must stay deployable on any platform. This is NOT the same\n// digest kind as localContentDigest, which selects the platform-specific\n// runnable manifest to compare a running container with a fresh build/pull;\n// never funnel this resolution through the local content-digest producer, and\n// never pin a published reference with a per-platform digest.\nfunc ImageDigestResolver(ctx context.Context, file *configfile.ConfigFile, apiClient client.APIClient) func(named reference.Named) (digest.Digest, error) {\n\treturn func(named reference.Named) (digest.Digest, error) {\n\t\tauth, err := encodedAuth(named, file)\n\t\tif err != nil {\n\t\t\treturn \"\", err\n\t\t}\n\t\tinspect, err := apiClient.DistributionInspect(ctx, named.String(), client.DistributionInspectOptions{\n\t\t\tEncodedRegistryAuth: auth,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn \"\",\n\t\t\t\tfmt.Errorf(\"failed to resolve digest for %s: %w\", named.String(), err)\n\t\t}\n\t\treturn inspect.Descriptor.Digest, nil\n\t}\n}\n\ntype authProvider interface {\n\tGetAuthConfig(registryHostname string) (clitypes.AuthConfig, error)\n}\n\nfunc encodedAuth(ref reference.Named, configFile authProvider) (string, error) {\n\tauthConfig, err := configFile.GetAuthConfig(registry.GetAuthConfigKey(reference.Domain(ref)))\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\n\tbuf, err := json.Marshal(authConfig)\n\tif err != nil {\n\t\treturn \"\", err","sourceCodeStart":342,"sourceCodeEnd":378,"githubUrl":"https://github.com/docker/compose/blob/ddc4b044b62e9f715212ea4143fa830fac76382f/pkg/compose/pull.go#L342-L378","documentation":"ImageDigestResolver resolves a manifest digest for an image reference by calling DistributionInspect against the registry (with encoded auth from the config file). Any registry-side failure — auth, unknown repository, network, unsupported API — is wrapped with the image name into this error. It is used to pin image references, e.g. when preparing a published artifact.","triggerScenarios":"Calling an API that pins digests (publish/commit-style flows) for an image that does not exist in the registry, the user lacks pull rights, credentials in the config file are stale, the registry is unreachable, or the reference includes a tag that was never pushed.","commonSituations":"Image not pushed yet before referencing it; docker login token expired; private registry with self-signed cert or network policy blocking it; typo in the image tag; referencing a local-only build output by digest-pinning path.","solutions":["Verify the reference exists and is pullable: docker pull <image> (or docker manifest inspect <image>).","Re-authenticate: docker login <registry> with credentials that have read access to the repository.","Fix typos in the image name/tag and confirm the image was actually pushed.","Check registry reachability (DNS, TLS, proxy) and retry once network issues clear."],"exampleFix":"# before\nservices:\n  api:\n    image: registry.example.com/team/api:v1.0   # tag never pushed\n\n# after\nservices:\n  api:\n    image: registry.example.com/team/api:latest  # existing tag; or push v1.0 first","handlingStrategy":"retry","validationCode":"func imageResolvable(ctx context.Context, cli client.APIClient, ref string) bool {\n\t_, err := cli.DistributionInspect(ctx, ref, client.DistributionInspectOptions{})\n\treturn err == nil\n}","typeGuard":null,"tryCatchPattern":"dgst, err := resolver(named)\nif err != nil {\n    if strings.Contains(err.Error(), \"failed to resolve digest\") {\n        if isAuthError(err) { /* re-login, retry once */ }\n        if isNotFound(err) { /* push image first or fix tag */ }\n    }\n    return err\n}","preventionTips":["Push images before referencing them in digest-pinning flows.","docker login to each registry before publish/pull operations.","Verify tags with docker manifest inspect in CI before compose runs."],"tags":["compose","registry","digest","auth","network"],"backgroundTag":null,"analyzedSha":"ddc4b044b62e9f715212ea4143fa830fac76382f","analyzedAt":"2026-08-15T13:31:42.319Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}